Forum: JRuby JRuby under EPL

Hi All,

I'm trying to convince my company to use JRuby for a big upcoming
project, and I'm hitting a wall with Legal. Can someone take a look at
their response to our inquiry (pasted below) and let me know if
there's any route to the desired license (EPL)?

Thanks so much!
Mark
---------------------

CPL is also known as Eclipse Common Public License, which is one of
the licenses that we prefer not be used in  product code (along with
GPL and LGPL).  If you can determine that JRuby is available from the
Eclipse Foundation under the Eclipse Public License, which is the
successor license to CPL, then that would be acceptable.  If not,
meaning that the options are only GPL, LGPL or CPL, wed recommend
that you try to find an alternative technology.

We are somewhat stuck on this.   We never created a legal entity for
JRuby as an organization and so all committers retain copyright.  In
order to change the licensing we would need to contact all
contributors and ask for permission.  This may still happen in the
future once we have a copyright assignment entity, but it is not
happening right now.

Ironically, we did do this once like 5-6 years ago and it was
unbelievably difficult to track everyone down...

-Tom

On Fri, Feb 1, 2013 at 11:23 PM, Steven McCraw <smmccraw@gmail.com> 
wrote:
>
>
>     http://xircles.codehaus.org/manage_email
>
>



--
blog: http://blog.enebo.com       twitter: tom_enebo
mail: tom.enebo@gmail.com

*if* we moved to the eclipse foundation, they would do this job for us - 
not sure if we want the rest of the package (all stuff like gerrit, 
bugzilla) that comes with it.

-- qmx (mobile)

This is a very interesting question. I presume someone is concerned that 
the JRuby licences may undermine the protection of corporate 
intellectual property in parts of their program. I doubt it this is the 
intention of the JRuby licences.

Perhaps you could get your legal team to identify what is objectionable
to them in the JRuby licences and how that is treated in the EPL. This
may help to identify a solution.

...R

>Steven McCraw wrote in post #1094862:
> Hi All,
>
> I'm trying to convince my company to use JRuby for a big upcoming
> project, and I'm hitting a wall with Legal. Can someone take a look at
> their response to our inquiry (pasted below) and let me know if
> there's any route to the desired license (EPL)?
>
> Thanks so much!
> Mark
> ---------------------
>
> CPL is also known as Eclipse Common Public License, which is one of
> the licenses that we prefer not be used in  product code (along with
> GPL and LGPL).  If you can determine that JRuby is available from the
> Eclipse Foundation under the Eclipse Public License, which is the
> successor license to CPL, then that would be acceptable.  If not,
> meaning that the options are only GPL, LGPL or CPL, wed recommend
> that you try to find an alternative technology.

qmx, are you saying that Eclipse Foundation would track down the 
authors, etc.?

Why does that legal department specify "available *from the Eclipse 
Foundation* under the Eclipse Public License"?  Does it make a 
difference legally whether the Eclipse Foundation declares the license 
or someone else, when it's the same license?

For those of us like me who didn't know what the JRuby license was, or 
what the tri-license means,
the file that specifies the JRuby license is at 
https://github.com/jruby/jruby/blob/master/COPYING. It said, at the 
beginning:

===

JRuby is Copyright (c) 2007-2013 The JRuby project, and is released
under a tri CPL/GPL/LGPL license. You can use it, redistribute it
and/or modify it under the terms of the:

  Common Public License version 1.0
  GNU General Public License version 2
  GNU Lesser General Public License version 2.1

===

and some information about JRuby's tri-license is at:

https://mpl.mozilla.org/scope/tri-license-and-the-gpl/.
http://en.wikipedia.org/wiki/Multi-licensing

- Keith

My reading of the original post is that the legal dept wants the JRuby 
code to be supplied (in the contractual sense) by the Eclipse Foundation 
(and not just the text of the licence) and I suspect that is unlikely.

Hence my suggestion that the OP asks the legal dept to specify where the 
problem lies.

...R

>Keith B. wrote in post #1094909:

>
> Why does that legal department specify "available *from the Eclipse
> Foundation* under the Eclipse Public License"?  Does it make a
> difference legally whether the Eclipse Foundation declares the license
> or someone else, when it's the same license?
>

Hi All,

Thanks for all the replies and apologies for the late reply myself.  My
understanding is that the legal department wants EPL, and they don't 
really
care if the Eclipse Foundation declares the license.  I think that was 
just
poor wording (and from a lawyer no less!).  Robin, here's some info I've
been given from legal on GPL and its variants:

"While use of open source code does have many benefits, it also carries 
the
risk that inclusion of open source code will create an argument that all 
of
the code for the product is now open source. Many of the open source
licenses recognize that this is a problem for commercial software, but
others still carry this risk, notably the GNU licenses. Other open 
source
licenses allow use of the code in commercial software, but try to put 
large
liability risks on the vendor using the code. For these reasons and many
more, all open source licenses need to be reviewed by Legal before the 
open
source code is included...."

"With regard to code from other vendors, the licenses for this code must
also be reviewed by Legal. While the code may be "free", it's use often
places a great deal of risk on [the company]."

They don't really say why they object to ECPL/CPL, just that it's
prohibited, but I assume it's for the same reasons.  The only three
generally approved licenses are Apache (v1 or v2) and EPL.

It sounds like the answer to my original question (is there a path to 
the
use of JRuby under EPL) is "not any time soon, if ever" so unless anyone 
on
the list thinks otherwise, I'll start pursuing some other option (Groovy 
is
my next choice, because it is a dynamic language with a decent set of
language features, even if the syntax seems more like a clone of Java).
 Whatever it is, it has to be a JVM based language, but I hate the 
thought
of going back to writing a bunch of code in Java.

I understand that it's probably a large undertaking, and furthermore, I
don't want to make the mistake of generalizing my own experiences, but I
think that JRuby is amazing and might be the ticket to wider adoption of
Ruby, if the licensing isn't prohibitive.  I think it's probably worth
(re?)visiting what effort would be necessary to make things available 
under
a more commercially viable license if the goal is wider adoption. 
Thanks
for all the great work and the consideration!

Mark

I would also love to know your Legal dept's objections to the GPL / LGPL
in this case.

Unfortunately it sounds like a "general company policy that is invoked
without regards to specific situations".

Is the project you are working on a web application or something to be
distributed? If it is to be distributed then
I can kind of see reasoning for your legal bods to be cautious (Well,
not really, but I can see why they think that way).

If it is an application that will only be run on your servers then I
cannot think even think of a logical reason apart
from said corporate policy.

Not wanting to start a license flame-war, just interested in this
specific situation.

Hi Jeffrey,

See my reply from earlier today about the GPL/LGPL issue. As for
distributed or not, it would be distributed.

Mark

Sent from my mobile device. Apologies for brevity.

Hi Mark
I am responding to this to support your suggestion that the JRuby team 
should consider the legal issues associated with commercial companies 
using JRuby.

I suppose there must be an assumption in the mind of some Open Source
developers that all code should be open-source and it would be a good
thing if open-source licences cause that to happen. There's no answer
to this - it's just a matter of different opinions.

On the other hand, I assume that many Open Source developers also work
on non-Open Source projects to earn their living, are likely to
recognize the realities of commerce and would probably be anxious to
ensure that Open Source licences only apply to the open-source code and
not to proprietary code added on top of an open-source system like
JRuby.

Whichever camp one sits in there is another legal issue - the liability
of a product vendor for its product.

The simple case is where a customer suffers a loss because the product
fails to perform and expects the vendor to compensate. If the vendor is
using an open-source product as the base for its commercial product and
the failure is due to a problem in the open-source part the vendor
can't, in turn, expect compensation from the open-source developers.
This means the vendor must actually carry the product quality risk for
the open-source code as well as for his own code.

The more difficult issue (and potentially the most expensive) would be
if the vendor was challenged for infringing someone's rights and the
infringement arose in the open-source code. It's easy to see that an
aggrieved party might not bother suing an open-source team but would
jump at the first chance to sue a solid commercial business.

And, to pick up on Jeffrey's comment, I don't think it would make any
difference with either of my scenarios whether it was a distributed or
an online app.

Perhaps the legal answer is to encapsulate the product in its own
limited liability subsidiary so that legal action can't bring the whole
company down :)

This, at least, would allow the choice of development tools to be
decided on an economic basis rather than a legal one. Would it be more
productive to use JRuby or Groovy or Java? - how do you tell?. A lot
must depend on what skills the programmers already have and that,
surely, depends on corporate policy.


...R
> Mark McCraw wrote in post #1095040:

> CPL is also known as Eclipse Common Public License, which is one of
> the licenses that we prefer not be used in  product code (along with
> GPL and LGPL)


Assuming that you don't mean to change the source code of Jruby itself, 
you
would not incorporate code governed by this licence *in* product code. 
The
JRuby code would be used *by* your product's code.  As I understand it,
this is specifically why the LGPL exists.

-Justin

:-)  You are under the mistaken assumption that I have some kind of
influence on my legal department.  I'm not an attorney, nor do I have 
even
a toehold in that knowledge space, so even if I could challenge my
company's assumptions about what is or isn't safe for protection of 
their
intellectual property, I wouldn't.  I appreciate the notion that my
particular situation doesn't apply to everyone (I understand that my
company is but one data point), but would encourage others who have
challenged the interpretations of various licenses to do the same when
considering what makes sense with regard to the licensing vs. adoption
question.  That's about all of the intelligent feedback I can offer.

Again, thanks for the consideration!

Mark

I figured that was the case Mark. Too bad.  I'm just wondering if 
someone
could confirm or refute my assumptions.

-Justin

This is incredibly well-timed, actually. :-)

Over the weekend, I learned from Mike Milinkovich, director of The
Eclipse Foundation, that we can transparently update from CPL to EPL
because of an upgrade clause in CPL. We are looking into doing that
now.

The remaining questions for us to make this move:

* Can we *really* just change the license without consulting
contributors? Everyone we talk to (non-lawyers, but folks who should
know) has indicated that this is the case.
* What are the actual changes from CPL to EPL?
* Should we make this change for a minor release of JRuby or wait
until a major release?

The github issue tracking this discussion is here:
https://github.com/jruby/jruby/issues/526

Another interesting point from the GH issue: Wayne Meissner (not a
lawyer) theorizes, based on the wording of the upgrade clause, that
you (Mark or Mark's employer) could choose to update JRuby to EPL or
treat it as EPL (unsure of the language here), so it's possible that
any delay in us updating to EPL would not necessarily prevent you from
using JRuby. You will want to propose this option to your company's
legal department.

- Charlie

Unfortunately if you don't consult lawyers AND you are wrong you won't 
have a legal leg to stand on. If you do consult a lawyer there might be 
an equal chance of being wrong but you won't be held to have been 
negligent.

And you certainly won't convince other lawyers unless you can show them 
a respectable legal opinion - so they don't have to worry about being 
negligent.

...R

>Charles Nutter wrote in post #1095258:

>
> * Can we *really* just change the license without consulting
> contributors? Everyone we talk to (non-lawyers, but folks who should
> know) has indicated that this is the case.

That *is* incredibly well timed. I'm going     to forward this to our
legal department, and

Sent from my mobile device. Apologies for brevity.

Sorry, send got hit accidentally (maybe email by iPhone at 5am is a
bad idea, but whatever). Here's my complete thought:

That *is* incredibly well timed. I'm going     to forward this to our
legal department, and I'll post back any information I can get from
them on the issue. Very exciting!

Sent from my mobile device. Apologies for brevity.

This is certainly true. However, given that we are already CPL, the
clause spells out that upgrading is possible, Eclipse did the same
thing, and we have heard from a number of non-lawyers whose
organizations or projects *have* gone through the legal process of
making the transition...it seems like there's an extremely low chance
of things going awry.

Nevertheless, I will probably try to ping someone at Red Hat about
this transition, just so we can get some eyes on it...and because Tom
and I now work there, it seems reasonable to expect them to help us
with OSS legal matters :-)

A bit more below...

On Tue, Feb 5, 2013 at 10:41 AM, Robin McKay <lists@ruby-forum.com> 
wrote:
> Unfortunately if you don't consult lawyers AND you are wrong you won't
> have a legal leg to stand on. If you do consult a lawyer there might be
> an equal chance of being wrong but you won't be held to have been
> negligent.
>
> And you certainly won't convince other lawyers unless you can show them
> a respectable legal opinion - so they don't have to worry about being
> negligent.

It's rather likely that the Eclipse project has some respectable legal
documentation of how/why they were able to make the CPL to EPL
upgrade. I have some contacts there now, and will try to get a bit
more information along those lines.

- Charlie

I like the accidental send coupled with your sig on brevity.  Good 
giggle this am. (I'm easily amused :) )

Jay

Well, I am *very* happy to report that JRuby got by legal using the "We 
can
distribute under EPL since we are contributers (which is loosely defined 
to
include distributers)" argument.  I still hope the pursuit of EPL in a 
near
future version works out.  There's now one last legal issue to hash
through.  Since my company sells software all over the world, we have to 
be
concerned with export restrictions.  Does anyone on the list know what 
the
Export Control Classification Number (ECCN) is for JRuby?  I can't seem 
to
find it on Google.

Thanks!
Mark

On Tue, Feb 5, 2013 at 1:38 AM, Charles Oliver Nutter