0003512: MaxMind GeoLite2: Update from CC BY-SA 3.0 licensed dataset to newer CC BY-SA 4.0 licensed work

MantisBT - Doomseeker

View Issue Details

Project

Category

Suggestion => IP2C

Notes

Quote from Zalewa
From what I understand this ticket describes this approach [generating a new IpToCountry.dat] as impossible because it would be illegal.

How so?

Let's disregard IP2C autoupdates for a moment. I'll make some interpretations and perhaps some assumptions, no warranties of what I speak of is correct.

Consider Doomseeker 1.1 is released under GPLv2. Consider Doomseeker 1.1 uses CC BY-SA 3.0'd GeoLite2. Consider CC BY-SA 3.0 is not compatible with GPLv2 or GPLv3. Binaries of Doomseeker 1.1 with GeoLite2 in it (linked) could be "illegal" to distribute, for plausibility of violating the copyright of both parties. (Fyi, 1.1 has not been relicensed to LGPLv2.1+ or granted any special linking exemption with MaxMind's database under GPLv2.)

Now, consider: Doomseeker 1.2 is released under LGPLv2.1+. MaxMind has licensed newer versions of GeoLite2 under CC BY-SA 4.0. One-way compatibility exists from CC BY-SA 4.0 to GPLv3, that is, CC BY-SA 4.0 works can be incorporated to GPLv3'd works but GPLv3'd works cannot be incorporated into CC BY-SA 4.0 works.

A compatibility chart between different versions of GNU licenses is available on GNU website:'https://www.gnu.org/licenses/gpl-faq.en.html#AllCompatibility [^]' – that is, "LGPLv2.1 gives you permission to relicense the code under any version of the GPL since GPLv2". Distributing Doomseeker 1.2 under terms of GPLv2+ seems fine.

A resulting adaptation of GeoLite2 (CC BY-SA 4.0) in Doomseeker (media/IpToCountry.dat) authored with tools/geolite2_conv.py would be licensable under GPLv3-only.

As GPLv3 license text also clarifies in section 5, a compilation of a work is called an "aggregate" and not a combined larger work. Or in other words, multiple incompatibly licensed works can reside on an aggregate medium like a filesystem or a CD without interference from GPLv3. "Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate." Doomseeker 1.2 source code may be legally conveyed under terms of LGPLv2.1+, resulting larger work binaries with GeoLite2 under GPLv3-only, and GeoLite2 under CC BY-SA 4.0 and GPLv3.

I say go ahead with updating media/IpToCountry.dat, as long as MaxMind's copyright notices are updated to reflect the license change to CC BY-SA 4.0.

Quote from WubTheCaptain
Lastly (?), don't forget to indicate you made changes to the CC BY-SA'd work

I wasn't aware of CC BY-SA 4.0 section 2, article (a)(4).

Quote from Zalewa
However, it seems the matter is as simple as removing the IpToCountry.dat database from the executable (resources.qrc) and putting it into /usr/share/doomseeker or Doomseeker dir on Windows.

I'm more dubious of practicability (especially for redistributors) of this, and not convinced due to lack of more detailed interpretation of the two licenses from you. The software still links with IpToCountry.dat (CC BY-SA 4.0). LGPLv2.1+ seemingly allows this (weak copyleft), but how can the CC BY-SA 4.0 license's copyleft be respected in such scenario for binaries? My answer: It cannot be. (I was initially going to say "Probably cannot be [under LGPLv2.1], but maybe under LGPLv3 leastmost could be respected.", but I later found out that's not true.)

Seems trivial to change something from static to dynamic linking if redistributors (NB: not you, The Doomseeker Team) still have to doubt about CC BY-SA 4.0 compliance under something else but GPLv3 or via Creative Commons proxy. It does still have some apparent benefits for redistributors, so I support the idea.

All the better for me (us) if GeoLite2 will be completely optional in use, so that any permanent license termination of CC BY-SA 4.0 does not make using Doomseeker with GeoLite2 useless or illegal too in such scenario beyond exceptions and limitations.

--

And now, the boring detail because I always ought to reason my views (how correct or incorrect ever those may be). I'm afraid it will most often just make me look worse or my opinions get easily dismissed for other reasons (such as in issue 0003510), because I feel like being the one-sided party arguing in this while not receiving arguments and interpretations back in detail. 🙁 I don't want that to happen... Not the least someone would be asking the right questions for clarification, so I will try to explain almost everything at risk it will make me look worse and less comprehensible.

The benefit of dynamic linking (above) is that Doomseeker binary may (?) become distributable solely under LGPLv2.1+, if it can work without the BY-SA database (e.g., displaying "?" country flags for every server). I say "may", because [insert my incomprehensible question the "corresponding source", removed at last minute]. This may not immediately concern the supplier (Zalewa / Blzut3 at DRDTeam), but does arguably concern redistributors who do not want to infringe the copyrights in Doomseeker (its authors). There's no other benefit in Zalewa's proposal of dynamic linking / seperating the database from the Doomseeker binary.

The other part to solve is the copyleft provision of BY-SA 4.0's effect in Doomseeker, and respect that license.

I'm feeling quiet confident to claim the distribution of static linked Doomseeker binary with GeoLite2 (NB: excluding Doomseeker source code distribution from the claim) under terms of anything but GPLv3-only is unauthorized by the copyright holders (MaxMind), and leads to termination of the CC BY-SA license. (Hey, I believe to have started the 30-day BY-SA 4.0 license termination clock just now or slightly earlier! Oops, BY-SA 3.0 already terminated a long ago for DRDTeam. 🙁)

"Share" in CC BY-SA 4.0 includes definition of communication, and an "adapted material" [sic] (from here on referred as "adapted work") includes, but is not limited to, "arranging" and "transforming" the works. It is my broad interpretation static or dynamic linking the two pieces fits these definitions. I'm thinking like collages (Commons:Collages), but in this case with software. The comparison to collages seems especially true with static linking.

The "contents" of IpToCountry.dat is not original work of Doomseeker developers; that's almost exclusively under MaxMind's copyright, despite the format change.

CC BY-SA 4.0 prohibits additional terms which restrict rights to that license. Far fetched, there's incompatibilities: LGPLv2.1 does not reinstate the license automatically and terminates immediately, unlike LGPLv3, GPLv3 and CC BY-SA 4.0. (It's far fetched, because changing from MMDB / CVS format to Doomseeker format doesn't seem to be an adaptation under CC BY-SA 4.0 section 2, article (a)(4); thus, there would be no adapter's license grant to terminate to that adapted work and the original BY-SA'd work. But I believe arranging and transforming (= linking) the two works together is an adaptation, so this plays a role.)

Assuming we have an adapted CC BY-SA 4.0 section 3, is LGPLv3 fine then? No... because article (b)(1) essentially says it needs to CC BY-SA 4.0 or later version, or a "BY-SA Compatible License", where the latter's explicit definition requires it to be "approved by Creative Commons as essentially the equivalent of this Public License" at the URL mentioned; and LGPLv3 is not on that list.

I emphasize: The BY-SA compatibility is a required condition of the license. Even though personally I think LGPLv3 (NB: not LGPLv2.1) makes sense with BY-SA 4.0 (NB: not BY-SA 3.0) compatibility in almost every way, the BY-SA 4.0 license does not allow to redistribute any adapted work of LGPLv2.1+/GPLv2+ and BY-SA 4.0 under anything but GPLv3-only + BY-SA 4.0; because Creative Commons (assumably) didn't review the LGPLv3 license for compatibility, and it is not recognized as "BY-SA compatible" by them. 💩

Honestly, I stopped reviewing differences between the two licenses after this was so explicit in BY-SA 4.0.

If I didn't conclude something yet here, it's that Doomseeker binaries with GeoLite2 could be built with a GPLv3 configure flag (CMake, `-DENABLE_GPL`) at compile time. Else it could build without GeoLite2 and distribute under LGPLv2.1+. Neither is really an issue for a motivated redistributor, and not a concern for the source code supplier due to aggregation.

Hopefully my three hours of personal time saved in this note can save some costs on any questions to lawyers per hour. If the situation doesn't satisfy Zalewa, please take it to Creative Commons for compatibility review (if you will agree to at least LGPLv3+), remove GeoLite2 from LGPLv2.1+ distributions (CMake flag) or seek permission from MaxMind to have them relicense GeoLite2 under CC BY-4.0 (or similar compatible license without the conflicting copyleft).

While I don't disagree with your interpretation of BY-SA, I think that Zalewa's proposal to move it out the binary would indeed work. If you were to take that database and import it into a Microsoft SQL database (MS SQL being the first thing that comes to mind when I think proprietary database software but take your pick), would I be violating the license? To that end I don't think Doomseeker reading the work is equivalent to linking, although this has made me think about just how arbitrary the line is between dynamically linking code and reading a file.

With that said, if I may direct you to'https://wiki.creativecommons.org/wiki/ShareAlike_compatibility:_GPLv3#Considerations_for_adapters_applying_the_GPLv3 [^]'

Quote
This one-way compatibility mechanism with GPLv3 is not for general use. It was designed to help solve a specific problem for those working in niche areas where content is adapted and melded with code. Please take advantage of it only when you are adapting BY-SA 4.0 works and incorporating the adaptation into GPLv3 software in ways that make it difficult or impossible for downstream users to distinguish the content from code.

With a separate file I don't think there's any doubt at all here so per this quote I don't believe the use of CC-BY-SA data has any implications of the licensing of the program. I'm not even certain that having the files separated is a requirement although it might not be a bad idea to be on the safe side.

Quote from WubTheCaptain
And now, the boring detail because I always ought to reason my views (how correct or incorrect ever those may be). I'm afraid it will most often just make me look worse or my opinions get easily dismissed for other reasons (such as in issue 0003510), because I feel like being the one-sided party arguing in this while not receiving arguments and interpretations back in detail. 🙁 I don't want that to happen... Not the least someone would be asking the right questions for clarification, so I will try to explain almost everything at risk it will make me look worse and less comprehensible.

Please understand that while we disagree on a lot of things I very much appreciate your point of view.

OK, let's see if I can make something out of this:

Download the database from MaxMind, unzip it and add it to the repository (?)

Quote from Blzut3

do we actually benefit from having the database in the repo? The alternative is to download/convert it in our release scripts

Update media/IpToCountry.dat with new CC BY-SA 4.0 licensed dataset from MaxMind with tools/geolite2_conv.py, but not with the autodownloaddatabase but by using the geolite2_conv.py's 3-argument mode that allows to specify blocks and locations files from the local filesystem

Keep media/SOURCES.txt at CC BY-SA 4.0

Update about dialog year and text to 2018 / CC BY-SA 4.0

Update tools/geolite2_conv.py copyright year and comment to 2018 / CC BY-SA 4.0 (please add the required attribution blurb from MaxMind too, see below)

Remove IpToCountry.dat from resources.qrc

Add IpToCountry.dat from the repo to Doomseeker's distribution/installation as a separate file

Quote from Wub
Will be DFSG-removed from the Debian package and generated from source (point #1), but I don't think this is your concern.

Get Doomseeker into state where it can run without the IP2C database altogether. The '?' flags shouldn't be displayed. Instead no flags should be displayed apart the icons for LAN and localhost servers.

Ensure Doomseeker is capable of reading the personally downloaded IP2C database from the "IP2C update" feature without having any other copy of the database lying around. The country flags should reappear.

Ensure Doomseeker will read this file if there's no personally downloaded IP2C database.

Ensure Doomseeker will read the personally downloaded IP2C database instead of the preinstalled file if such downloaded IP2C database is ready.

I'm trying to get the ideas clear, this ticket turned out to be a lot more complex than expected🤔. I'm getting quite confused, and it is not helping the fever I'm dealing with 😂😅