Legal issues with Runtime Exception: Is your codebase is at risk?

[alexjc]

Hi,

I've been working with TBB solidly over the past few months to parallelize game AI, and I think the library is great. There are a couple articles of mine in the pipeline on the subject also -- which are currently undergoing review!

Now, I realize Intel's default policy is to not provide legal advice. However, taking the usual suggestion, I've worked with a legal team to look into the license. (I myself am not a lawyer.) The fact is, if you're using the GPL version and relying on the Runtime Exception, your codebase is at risk. Your proprietary source code that uses TBB can effectively be considered to be under the GPL, and any third-party that has access to the code could re-release it under that license.

The problem is caused by a combination of the wording of the Runtime Exeption (which does not seem to be written by lawyers), and the fact that TBB is not a re-implementation of a C++ standard. Here's why your code is under risk unless Intel clarifies and rewords this Runtime Exception.

1) The runtime exception only covers the binary executable.

Read the Runtime Exception carefully, and you'll notice it does not talk about your source code, only binaries:

"[...] this file does not by itself cause the resulting executable to be covered by the GNU General Public License."

This wording is acceptable for libstdc++ because the actual implementation is standard, so simply typing #include does not create a derivative work of that particular implementation. In the case of libstdc++, what creates a derivative work would be linking against it... However, the runtime exception means the GPL does not infect your binary.

2) Including TBB into your source code makes it a derivative work.

Under the GPL, if you #include for example, then your codebase becomes a derivative work of TBB. This is the case whether or not you release a binary executable.

The difference with the libstdc++ is that there is no standard or other implementation of TBB, so #include can only refer to the GPL version of the code (unless you bought a license). In this case, your code becomes GPL also.

As such, when you release the code to a third-party (not even a binary) and don't have a license, the third party could interpret that code as GPL and re-release it.

3) Other problems with the Runtime Exception wording

As I said, I'm not a lawyer, but the Runtime Exception is a very poorly worded paragraph regardless of the "intent and spirit" of what it says. For instance, if you read it carefully, it only covers free software libraries:

"As a special exception, you may use this file as part of a free software library without restriction."

(This is the first sentence.)

I'm in a position of developing a semi-open project, and the individual licenses wouldn't be an option for my project. I simply want my code not to be GPL, and unfortunately the way the licensing is done for TBB (using the Runtime Exception) is not a sufficient guarantee. I'd have to remove TBB altogether.

I believe this is something Intel's law team needs to address. Using a combination of the LGPL and the Runtime Exception could work for example, however, the wording of that license extension is very dubious at best.

Hopefully there's a solution to this problem!

Regards,

Alex Champandard

[RafSchietekat]

In "1) The runtime exception only covers the binary executable.", why did you remove the first part of the quoted sentence? You have to ask yourself whether the use of the word "Specifically" restricts the previous sentence (is that even allowed?) or merely gives an example that expresses "even if you do this" (that would be my interpretation, but then I'm neither a native speaker nor a lawyer). But even with the latter interpretation it would of course be nice to have some more statements like this, specifically :-) to allay any concerns regarding the use of code that depends on the specifications for the library, unless this is already a given (even purely commercial software seems to be reverse-engineered with legal impunity, so if you don't even have to look at the code, in source or compiled form, how would it have any influence left on the rights related to a derived work?).

How would the LGPL help here? It seems that the runtime restriction is specifically intended to be less invasive than the LGPL (by allowing the distribution of a derived work that does not allow the recipient to substitute his own version of the library).

So it would indeed seem that there are no restrictions. Hmm, how should I formulate that this should not be constituted as legal advice, and that you should seek your own council before deciding whether or not to act upon it? :-)

[alexjc]

Quoting - Raf Schietekat

In "1) The runtime exception only covers the binary executable.", why did you remove the first part of the quoted sentence? You have to ask yourself whether the use of the word "Specifically" restricts the previous sentence (is that even allowed?) or merely gives an example that expresses "even if you do this" (that would be my interpretation, but then I'm neither a native speaker nor a lawyer). But even with the latter interpretation it would of course be nice to have some more statements like this, specifically :-) to allay any concerns regarding the use of code that depends on the specifications for the library, unless this is already a given (even purely commercial software seems to be reverse-engineered with legal impunity, so if you don't even have to look at the code, in source or compiled form, how would it have any influence left on the rights related to a derived work?).

How would the LGPL help here? It seems that the runtime restriction is specifically intended to be less invasive than the LGPL (by allowing the distribution of a derived work that does not allow the recipient to substitute his own version of the library).

So it would indeed seem that there are no restrictions. Hmm, how should I formulate that this should not be constituted as legal advice, and that you should seek your own council before deciding whether or not to act upon it? :-)

The first sentence is equally focused in its scope, as I mentioned in my point 3). It doesn't cover software & source code in general, only "free software libraries." If you're making a proprietary codebase, you're not covered.

Our legal team indeed went over the "Runtime Exception" FAQ, and while the answers of the FAQ try to interpret the "intent and spirit" of the license, they do not explain what is written in that paragraph. Hence our wondering if that was even written by lawyers.

I understand it's the intent of Intel to provide "no restrictions" on the rest of the codebase when you integrate the GPL version of TBB, but that's not what the Runtime Exception text says.

Alex

[RafSchietekat]

"The first sentence is equally focused in its scope, as I mentioned in my point 3). It doesn't cover software & source code in general, only "free software libraries." If you're making a proprietary codebase, you're not covered."
That shouldn't worry you, because that "free software library" would be TBB, not your program.

[alexjc]

Quoting - Raf Schietekat

"The first sentence is equally focused in its scope, as I mentioned in my point 3). It doesn't cover software & source code in general, only "free software libraries." If you're making a proprietary codebase, you're not covered."
That shouldn't worry you, because that "free software library" would be TBB, not your program.

Again, I understand the "intent" of the Runtime Exception, but that's not what the paragraph says -- legally. If you consult a legal team, they'll probably also tell you about the risks.

I'm really keen to find out who came up with that license paragraph, because frankly it's the worst I've ever seen in the history of software licenses.

Alex

[RafSchietekat]

I thought that lawyers were supposed to scare the opponents, not their own clients. :-)

Of course you should mostly try to do your own homework, but I would just assume that this particular exercise has already been done for libstd++ with far larger stakes by far scarier legal teams.

Still, if you find out anything useful, do let us know about it.

(Added) What would be the problem with the commercial license if you have the kind of money that buys legal advice?

[alexjc]

Quoting - Raf Schietekat

Of course you should mostly try to do your own homework, but I would just assume that this particular exercise has already been done for libstd++ with far larger stakes by far scarier legal teams.

(Added) What would be the problem with the commercial license if you have the kind of money that buys legal advice?

Concerning libstdc++, the situation is very different because of the standard -- as I explained. The stakes aren't as large as there's plausible deniability: i.e. we wrote the code against the *BSD implementation.

As I mentioned, I'm running a community project with a semi-open development. So we basically give access to our code to our members. The commercial license is individual only though, so I don't really have the choice but to go for the open-source version.

Alex

[RafSchietekat]

I think I'll limit my own stake here to the two cents I've already put in (if that makes any sense).

"As I mentioned, I'm running a community project with a semi-open development."
Sorry, I forgot about that when I added my remark.

[e4lam]

Quoting - alexjc

The fact is, if you're using the GPL version and relying on the Runtime Exception, your codebase is at risk. Your proprietary source code that uses TBB can effectively be considered to be under the GPL, and any third-party that has access to the code could re-release it under that license.

If I'm understanding this correctly, this only because you're trying to re-release source code that includes headers from TBB? Your strongly worded sentence at first glance seems to imply that any application using the opensource version of TBB will be infected with GPL.

[alexjc]

Quoting - e4lam

If I'm understanding this correctly, this only because you're trying to re-release source code that includes headers from TBB? Your strongly worded sentence at first glance seems to imply that any application using the opensource version of TBB will be infected with GPL.

From our analysis, any codebase that uses TBB is effectively GPL. However, your binaries are exempt via the Runtime Exception, as Intel intends. That said, anyone of your employees or partners that has access to your source code could effectively treat it as GPL, and re-release it under that license -- hence the risk.

Alex

[Dmitry_Vyukov]

Quoting - alexjc

From our analysis, any codebase that uses TBB is effectively GPL. However, your binaries are exempt via the Runtime Exception, as Intel intends. That said, anyone of your employees or partners that has access to your source code could effectively treat it as GPL, and re-release it under that license -- hence the risk.

If I do not have access to the source code, can't I just request it? I always thought that I may request source code of any GPL code base, and owner have to provide it to me in some way (hence Free Software). My understanding may be completely broken, though.

[alexjc]

Quoting - Dmitriy Vyukov

If I do not have access to the source code, can't I just request it? I always thought that I may request source code of any GPL code base, and owner have to provide it to me in some way (hence Free Software). My understanding may be completely broken, though.

Obviously, you can only request the source code if the binary is released under the GPL license. In this case, however, it's not under the GPL because the Runtime Exception is doing its job correctly for the binaries.

If you got access to the source code otherwise, you could legally treat it as GPL for the reasons I outlined above.

Alex

[Dmitry_Vyukov]

Quoting - alexjc

Obviously, you can only request the source code if the binary is released under the GPL license. In this case, however, it's not under the GPL because the Runtime Exception is doing its job correctly for the binaries.

If you got access to the source code otherwise, you could legally treat it as GPL for the reasons I outlined above.

But if I see that the binary uses TBB libraries, I can figure out that the sources are under GPL and request them. No?
If I am wrong, than owner can ignore my request. But if my guess is correct he must give me access to the sources.
What I am missing?

[alexjc]

Quoting - Dmitriy Vyukov

But if I see that the binary uses TBB libraries, I can figure out that the sources are under GPL and request them. No?
If I am wrong, than owner can ignore my request. But if my guess is correct he must give me access to the sources.
What I am missing?

That's not how the GPL works. Just because it's GPL doesn't grant you the right to access it. By default, there's no agreement between you and that company. (In fact, that's the reason companies can sell GPL code.)

You only have the right to request access the code it if the license under which you're given the binary is the GPL. If you were not given the binary, then there's no agreement between you and that company, and the fact that the code is GPL doesn't make any difference to you.

Alex

[Dmitry_Vyukov]

Quoting - alexjc

That's not how the GPL works. Just because it's GPL doesn't grant you the right to access it. By default, there's no agreement between you and that company. (In fact, that's the reason companies can sell GPL code.)

You only have the right to request access the code it if the license under which you're given the binary is the GPL. If you were not given the binary, then there's no agreement between you and that company, and the fact that the code is GPL doesn't make any difference to you.

Alex

Thank you!

[RafSchietekat]

Quoting - Dmitriy Vyukov

Thank you!

What for? Your question was about a program you received, and the answer was about a program that you didn't receive.

[e4lam]

Quoting - alexjc

The difference with the libstdc++ is that there is no standard or other implementation of TBB, so #include can only refer to the GPL version of the code (unless you bought a license). In this case, your code becomes GPL also.

I guess you can only include ppl.h then. I know of at least one other implementation of it. :)

If we're to go by the rules you outlined, I'm not so convinced that it can't be applied to code using libstdc++ as well. Suppose we have (bad) code that uses some internal symbol that only exists in the libstdc++ headers. Then the "plausible deniability" aspect of this would go away, making the source code "at risk" in the same manner.

[alexjc]

Quoting - e4lam

If we're to go by the rules you outlined, I'm not so convinced that it can't be applied to code using libstdc++ as well. Suppose we have (bad) code that uses some internal symbol that only exists in the libstdc++ headers. Then the "plausible deniability" aspect of this would go away, making the source code "at risk" in the same manner.

Yes, true. Though luckily the standard has been thought through well enough to not require this :-)

[Dmitry_Vyukov]

Quoting - Raf Schietekat

What for? Your question was about a program you received, and the answer was about a program that you didn't receive.

The question was about a program I gave over, and the answer was about a program that I didn't.

[alexjc]

Quoting - Dmitriy Vyukov

The question was about a program I gave over, and the answer was about a program that I didn't.

I believe we covered the other case in our discussions already...