Hi All,
I've been looking into some differences between Drupal/GPL and CiviCRM/AGPL and wanted register my thoughts for consideration and/or further clarification.
As FAQ #11 points out:
...some 3rd party systems that integrate with Drupal, such as CiviCRM, are released under the Affero General Public License (AGPL) version 3. The AGPL does require that visitors to the site be given a copy of the server-side code if they request it. If you install such a system with Drupal, then the entire work is considered under the AGPL, and must be made available.
AGPL adds the 2(d) clause to the GPL which (generally) says the following: If you started with some AGPL software that included a "download a copy of the source" link/button (which CiviCRM does), then you must keep that download facility intact. Further, that download facility must offer not only the original code you received, but the code base as a whole as it's being used, including any other derivative works, as defined by the rest of the (A)GPL.
So, by my reading of the AGPL, we'd have to include a "download source code" facility on every Drupal page as well that would include the Drupal code base as well as any contrib or custom modules you have written if CiviCRM is running in that same memory space and you're using civicrm.module.
CiviCRM, however, defines derivative work as actually having changed the CiviCRM code. They claim that accessing the CiviCRM app via its API's are sufficient to keep drupal and modules immunized against being considered derivatives of CiviCRM and subject to AGPL (http://civicrm.org/node/166, points 4 and 5). Is this just an (mis- ?) interpretation of the AGPL by the folks at CiviCRM? Am I ignorant in my reading of GPL and AGPL?
Previously, the original Affero GPL and GPL were not compatible. Now, however, GNU AGPLv3 and GPLv3 are [1].
- Drupal is GPL v2 or v3 [2]
- CiviCRM 1.x is Affero GPL
- CiviCRM 2.x is GNU AGPLv3 [3]
So, CiviCRM 2.x and Drupal are at least license compatible.
My questions for consideration here are:
- Is there a professional opinion available on the license status of a site that uses Drupal and CiviCRM 2.x?
- Does merely using CiviCRM via it's API's in a Drupal installation subject that Drupal installation and all of it's modules to be download on demand?
- If so, does the download link have to appear in the derivative works (Drupal pages), or must it only include the derivative projects' code when accessed via the orginal links in the CiviCRM footers?
Thanks All,
Seth
[1] http://www.fsf.org/licensing/licenses/gpl-faq.html#SeparateAffero
[2] http://drupal.org/licensing/faq#q1
[3] http://civicrm.org/licensing
Comments
It would appear from my
It would appear from my non-lawyerly reading of the GPL 3 that once a user interacts with a combined GPL/AGPL Drupal/CiviCRM site, the AGPL provision applies and a download link must be available.
Since both FAQs were prepared by SFLC, it would appear that the advice of SFLC changes somewhat depending on how the question is phrased (or perhaps even depending on the desire of the client..?)
I've distributed some Drupal modules (that use the CiviCRM API) under GPL 3, following the advice of SFLC on the CiviCRM page, that the GPL Drupal modules could be considered a separate and independent program from AGPL CiviCRM. But I'd welcome any clarification/correction on this.
it would appear that the
This is very clearly the case.
In regards to to copyright law, the desire of the copyright holder is a primary factor, which is why I object to the implications of some that "it has to be this way" because of the law or the GPL or something else.
Drupal.org user profile
Drupal Micro-blogging: http://twitter.com/matt2000
Pretty important issue
I'm sure many folks using or considering CiviCRM may also want to make their own custom modules specifically for their own site. If AGPL requires making that available for download that would probably have a significant impact on how folks use CiviCRM with Drupal (or if...).
I'm not using CiviCRM at the moment, but perhaps someone who is may want to post this question on the CiviCRM forum.
It is already answered in
It is already answered in the CiviCRM Licensing FAQ:
In this case, the SFLC gave CiviCRM basically the opposite opinion that they gave Drupal. In the case of Drupal Licensing FAQ #11, it is quite ironic that the SFLC instructed Drupal to claim something about CiviCRM that they instructed CiviCRM to not claim.
Drupal.org user profile
Drupal Micro-blogging: http://twitter.com/matt2000
fyi, CiviCRM and Drupal are
fyi, CiviCRM and Drupal are getting legal advice from two different sources that do not agree on legal doctrine.
CiviCRM gets its advice from Larry Rosen (http://rosenlaw.com/) now. We used SFLC a few years back.
Drupal gets its advice from SFLC.
Bottom line: the FAQs on the two projects are clear. Follow them and you will have no problems.
The CiviCRM licensing FAQ
The CiviCRM licensing FAQ says very clearly at the top:
Drupal.org user profile
Drupal Micro-blogging: http://twitter.com/matt2000
Seriously?
Given geilhufe's involvement with and knowledge of CiviCRM, I feel pretty comfortable that he's right on this one.
Also, see http://civicrm.org/licensing -- this page states: "The following guidelines cover project guidelines for licensing and copyright for patches and code contributions to be accepted into the core codebase. They were developed for us by Lawrence Rosen – our project attorney – who specializes in Open Source Software licensing."
The AGPL licensing FAQ page, at http://civicrm.org/node/166, says: "This FAQ has been prepared by our legal counsel, the Software Freedom Law Center, to clarify the implications of the AGPL license."
While there is a difference between what is stated on these two pages, a sincere effort at discourse would have noted both versions, as you did here. For the amount of noise generated on the various threads, more thorough research would be appreciated.
Cheers,
Bill
FunnyMonkey
Tools for Teachers
FunnyMonkey
Yes, seriously.
Response to the question of my sincerity / integrity here:
http://groups.drupal.org/node/12624#comment-41029
These two threads are feeding into each other and evolving at the same time, so I don't feel the need to repeat everything in both places.
Drupal.org user profile
Drupal Micro-blogging: http://twitter.com/matt2000
Geilhufe, If the FAQ page is
Geilhufe,
If the FAQ page is incorrect in it's attribution, could you please clarify and see to it that it is updated?
Kind Regards,
Drupal.org user profile
Drupal Micro-blogging: http://twitter.com/matt2000
Here's a forum post one
Here's a forum post one could add to rather than creating a new one: http://forum.civicrm.org/index.php/topic,3373.0.html But it seems CiviCRM has already stated their (and SFLC's) interpretation; that if your custom code is just using the CiviCRM API and you haven't modified CiviCRM, all you need is the CiviCRM link already appearing in the footer, and your custom code could use whatever license it wants to.
According to http://forum.civicrm.org/index.php/topic,1710.0.html it seems that CiviCRM moved to AGPL 3 just to make it easier for CiviCRM itself to incorporate GPL 3 code, not to make it easier for end users to combine CiviCRM with GPL code; they didn't see any barriers to that in the first place.
Thanks
Thanks everyone for all of your input. While I certainly will recommend legal consultation to the project I'm working on, I personally feel very confident moving forward with a combined Drupal/CiviCRM project understanding that Drupal can remain under GPL. Comments and links from this group and (a lot of) research over the past couple of days have all lead me to the belief that the CiviCRM License FAQ is the more accurate of the two at this time on this particular matter concerning these two pieces of software. Certainly IANAL, but the concept of API usage in the discussion of derivative works is one blurry line that I do see moving into focus by a body of opinion.
According to SFLC
I spoke with our attorney about this subject earlier today.
The AGPL specifically mentions modifications, and that when modifying code you cannot remove any "download this" links. Thus, if you use an unmodified CiviCRM and an unmodified Drupal and Drupal modules, then you're fine and the download requirement applies only to CiviCRM.
If you modify one or the other, then the resulting combined work (Drupal+CiviCRM) has modifications, and therefore the entire thing is subject to the AGPL's download requirements.
Would the whole combined
Would the whole combined work have to be made available for download including any custom modules that had not previously been released/conveyed?
@Crell
Crell, I really appreciate the follow up, as well as all of the effort put forth for this group and the FAQ. While questions have arose in places, the faq and group have been extremely enlightening and educational for me. So, to yourself and everyone else involved, thank you very much for that!
The motivation behind me looking into the legal status of a CiviCRM/Drupal combo is, of course, rooted in a real world project that I'm working on. We had planned to use unmodified CiviCRM, unmodified Drupal core, and a combination of unmodified contrib modules, modified contrib modules, and custom modules. (not an uncommon scenario for projects that would attempt to incorporate CiviCRM, I would imagine.) Some custom modules will happily be given back to the community, in CVS, GPL, etc... Some others, however, will be proprietary. There is no issue with the proprietary modules being GPL, as the client can have control over when/if to distribute them. The issue, for me, is if those custom modules become AGPL and must be available to be downloaded on demand, thus removing the ability of the client to be able to decide if/when that distribution will happen.
I understand that GPL is structured to protect the rights of and give power to the end user. GPL, for better or worse, doesn't consider a web visitor an end user of the software, it sees the website operator as the end user. The site operator is using the software to provide a service to a web visitor. Because of the misalignment of role definitions that can come about in these types of scenarios, the AGPL came about to effectively add the consideration that software as a service pass on the role of end user to the (in this case) web visitor, affording them all of the rights enjoyed by the GPL.
What I was really trying to understand is what was the state of code that is GPL (custom modules) by virtue of being a derivative work of other GPL software (drupal core) when that original work is combined with an AGPL package (CiviCRM). Even if those GPL derivative works (custom modules) don't interact with the AGPL code (CiviCRM). Are they separate, or are they all part of one great big "package". Section 13 of the GNU AGPLv3 just confuses me...
If I understand the AGPL correctly
Since the Drupal Association using civicrm and drupal, they must make all code that interacts in that install available for download.
A) is that correct?
B) do they just have to provide that they changed/modified for civicrm?
C) Do they also have to provide all themes (other then css/images/javascript) and all modules they wrote or modified?
AGPL
I just heard about the AGPL from the Linux Action Show and have to say it sounds pretty awesome. Also, here's another link: http://www.affero.org/oagpl.html