MuseScore must open source their mobile app

[Xmader]

The MuseScore mobile app uses code (at least libmscore) from the MuseScore desktop software, which is open source under GPL.

Therefore, the MuseScore team (or UltimateGuitar, or wsmgroup.ru actually) must open source it under the same licence as per the requirements of GPL. @danieljray

Although the MuseScore desktop software is under the MuseScore name. You can't just change its licence and use the code into a proprietary app. It's not your code. It is the result of community contribution.

The company does not care about open source and the community at all.

[Xmader]

I can prove this, even without the need to reverse-engineer the app.

These following simple bash commands can reveal the nature of using libmscore in the mobile app.

(Think it another way. Will the MuseScore team write code from zero to process MSCZ files?)

# first download apk from apkpure or somewhere else

# extract the `so` file we need from the `apk` file (every apk is a zip file)
unzip -j MuseScore-v2.6.11.apk lib/arm64-v8a/libXtzAndroid.so

# extract printable strings in that file
strings libXtzAndroid.so | grep MuseScore

Results

MuseScore_General.sf3
MuseScore 0.7.02007-09-10
MuseScore 1.3 symbol id corresponding to <%d> not found
The style file is not compatible with this version of MuseScore.
MuseScore Tab Late Renaiss
MuseScore Phal
MuseScore Tab Modern
MuseScore Tab Sans
MuseScore Tab Serif
MuseScore Tab Italian
MuseScore Tab Renaiss
MuseScore Tab French

Where did the strings come from?

MuseScore 1.3 symbol id corresponding to <%d> not found /libmscore/keysig.cpp#L590 The style file is not compatible with this version of MuseScore. /libmscore/scorefile.cpp#L730 MuseScore Tab Late Renaiss /libmscore/stafftype.cpp#L506

[Xmader]

More example

strings libXtzAndroid.so | grep Score

Score::startCmd(): cmd already active
Score::endCmd(): no cmd active
Score::addChord(): end of score?
Score::addPitch: cr %s
Score::removeExcerpt: excerpt not found
Score to append has %d parts and %d staves, but this score only has %d parts and %d staves.
Score::getProperty: unhandled id
Score::setProperty: unhandled id
Score::readStaff(): missing measure!
Score::readCompressedToBuffer: cannot read zip file
Score::removeSpanner: %s (%p) not found
ScoreFont::load(): open failed <%s>
ScoreFont: open glyph metadata file <%s> failed
ScoreFont <%s> not found in list
ScoreFont: open glyph names file <%s> failed
Score::transposeSemitone: failed
Score::pasteStaff: encountered <endTuplet/> when no tuplet was started
Score::pasteStaff: ended tuplet is empty
Score::readAddConnector is called not in paste mode.
?checkScore: remove empty ChordRest segment
deleteExcerpt: no partScore
read206: readScore(): part cannot have parts
Score::read(): part cannot have parts

Search the code where those strings locate at using https://github.com/musescore/MuseScore/search

[Kaleidosium]

This proves once again, that MuseScore does not give a single damn about their code contributers.

[minhngoc25a]

I have something in mind. Since Musescore is released with the GNU license, why don't we contact GNU for license violations? https://www.gnu.org/licenses/gpl-violation.html

[jeetee]

While I applaud your efforts and persistence, you should at least direct some of that effort to getting your facts straight. The MuseScore code is dual licensed and all contributors sign a CLA which allows MuseScore to keep the mobile apps closed source (a partial requirement from Apple for example to be able to publish in their app store).

[Xmader]

The MuseScore code is dual licensed

The readme and the LICENSE file both state that there is only GPL

all contributors sign a CLA

@jeetee Where can I find it? sign it since 20 years ago?

[jeetee]

musescore.org/cla

[jeetee]

And indeed, everyone since the public launch in 2008 has signed it

[Xmader]

And indeed, everyone since the public launch in 2008 has signed it

The internet has memory: https://web.archive.org/web/20120426185810/musescore.org/cla

[jeetee]

Correct, and it shows you the previous version of the CLA; your point being?

[Xmader]

since 2008? Where is missing 3 years?

[jeetee]

Before github there was sourceforge and a lot smaller team of contributors; all of which have signed the CLA when it came into existence.

[Xmader]

Before github there was sourceforge

I mean the starting year of the CLA. And the readme and the LICENSE file both state that there is only GPL, nothing states that it is dual licensed.

[jeetee]

Of course, because the version made public is the GPL licensed version of the code.. That is how dual licensing works.. If you want to see the other version, feel free to try and setup a license deal with MuseScore; though I doubt they'll be willing to hand you one :-p

[jeetee]

And all of this thus brings me again to my opening statement.

You love telling that MuseScore isn't doing their research on what they can legally enforce of you. But at the same time you fail to do the same research..

[Xmader]

a lot smaller team of contributors; all of which have signed the CLA when it came into existence.

How many? Who are they? Can I see a copy of the CLA before Version 1.0 - April 1st 2011, and how does it differ from version 1.0?

[jeetee]

There is no version prior to 1.0 (nor were there mobile apps). Contributions made before that however are all covered by it when those contributors signed the v1.0 version.

And all contributors that signed it are listed there, right on that CLA page. And all commits are available via soureforge svn history and git history, including the name of all contributors. You could even use a git blame on the current sources to figure out who did what..

[IFoundAnotherUsername]

If you want to see the other version, feel free to try and setup a license deal with MuseScore; though I doubt they'll be willing to hand you one :-p

Why wouldn't they?

[jeetee]

If you want to see the other version, feel free to try and setup a license deal with MuseScore; though I doubt they'll be willing to hand you one :-p

Why wouldn't they?

Why would any company share their closed source software with a random person?

[Xmader]

Why would any company share their closed source software with a random person?

Because the software uses code from a GPL licensed library. it's a requirement per GPL license. They must distribute the source code under the same license.

[jeetee]

Why would any company share their closed source software with a random person?

Because the software uses code from a GPL licensed library. it's a requirement per GPL license. They must distribute the source code under the same license.

Oh please do me the curtesy of at least reading my responses; the closed source applications do not use any GPL licensed code.

It just so happens that the company that owns that closed source code (via the CLA) also chose to provide an open source GPL licensed version of it; and that open source version may or may not be identical to the close source version they use and own.

[ljrk0]

Although I agree in spirit, they should opensource the mobile app, they are truly not legally obliged to do so.

The reason is the CLA -- which is precisely why there was so much backlash against Audacity receiving a CLA as well. The CLA was signed by all people who ever contributed to code to the current state of MuseScore.

The CLA says that the ownership of the code is signed over the Muse Group which then can shell out as many differently licensed versions of the program as they please, since they own the Copyright. The Copyright is a the legal privilege of being able to say who is allowed to use your software, including putting a license on the code for everyone to use. But you are still able to give a different license to those who ask, since you own the Copyright.

[Xmader]

The point is, I don't believe the statement that all people who ever contributed signed the CLA is true.

[ljrk0]

Fair enough, then you need to find a contributor who hasn't signed it.

[jeetee]

The point is, I don't believe the statement that all people who ever contributed signed the CLA is true.

Then prove it; you have been given all the required information to do so. This is exactly my point about calling them out on not doing their copyright research and then doing exactly the same. Don't accuse based on your belief, accuse based on proof.

[Xmader]

But how do you know that everyone has signed it? Are you an employee?

[jeetee]

I am not an employee. I have occasionally contributed to MuseScore and my first PR remained not accepted until I agreed to the CLA.

I completely fail to understand how this is a "god exists argument"; the case in point here is that you claim not everyone that contributed to the current codebase has signed the CLA; all information for you to back up that claim is available (in contrast to god-like discussions).

It would suit you to not deflect the discussion into something else, but use your persistence to actually do you research. This is a discussion about facts; nothing more nothing less. And until you can back up the claim of infringement with facts there is rather little value to your claim.

[Xmader]

Then, I've collected all users who has PR accepted through https://api.github.com/repos/musescore/MuseScore/pulls?state=closed&per_page=100&page={0..80} And asked them (if I can find their email address) whether they have signed the CLA.

If any of them (especially who contributed before 2019 where the PR template was not there) answers no, then yours is absolutely a pointless false claim. However, there is a chance that people left out CLA are in the group of unknown addresses or refuse to answer.

[Xmader]

"god exists argument" means you can't prove all have signed CLA, but I can't effectively show if there is only and only one case who left out the CLA.

[Xmader]

I apologize for my proofless claim about the CLA. However, your argument is only based on your personal experience, no close to the fact either.

[jeetee]

Then, I've collected all users who has PR accepted through https://api.github.com/repos/musescore/MuseScore/pulls?state=closed&per_page=100&page={0..80} And asked them (if I can find their email address) whether they signed the CLA.

If any of them (especially who contributed before 2019) answers no, then yours is absolutely a pointless false claim. However, there is a chance that people left out CLA are in the group of unknown addresses or refused to answer.

Why not just run a git blame on the current sources (as you were advised)? Way less work and actually gives you to overview of everyone that contributed to the current state of the code.

"god exists argument" means you can't prove all have signed CLA, but I can't effectively show if there is only and only one case who left out the CLA.

But you can. You have git blame and the CLA available. No need to go into contacting everyone personally (but knock yourself out if you so choose). Yes, you can back up your claim by finding someone that hasn't signed it and whose code is still actively in use, but it seems a far less automatable job and more labour intensive one than comparing the git blame author list with the CLA.

I apologize for my proofless claim about the CLA. However, your argument is only based on your personal experience, no close to the fact either.

You are again sidestepping the actual argument I had and are deflecting it to my personal experience. So yes, in my experience the first time I contributed I had to sign the CLA or be rejected; it is thus (from experience) a decent assumption that all other contributors have undergone a similar process. I wasn't the one claiming the code is not entirely covered by the CLA; the burden of proof isn't mine to bear. But if you take a moment to sidestep trying to make this about my personal experience (which again, is and was entirely irrelevant to all my responses and action up until the moment you choose to involve them into it) you'd notice that I've been actually helping you out by providing you all the means and pointers into how you can prove your claim.

My argument wasn't that you have no right to claim this, but that you should do your due diligence before making such a claim.

[Xmader]

git blame

I am trying to know whether the CLA is required to get a pull request accepted.

I wasn't the one claiming the code is not entirely covered by the CLA; the burden of proof isn't mine to bear.

You are the one claiming that the code is covered by the CLA. Shouldn't you prove that?

The MuseScore code is dual licensed and all contributors sign a CLA which allows MuseScore to keep the mobile apps closed source

[jeetee]

Straight from the CLA page:

All past and future contributors of non-trivial amounts of code (more than just a line or two) to MuseScore are required to sign the CLA. If somebody is unable to sign the document, their contribution will not be accepted or will be removed from MuseScore.

[jeetee]

As for

You are the one claiming that the code is covered by the CLA. Shouldn't you prove that?

I linked you to the actual CLA and keep pointing you to it multiple times. It exists, you can read it. It's existence is the proof that it.. well.. exists.

[jeetee]

Or another one, here's a link to the git workflow document on their developers handbook: https://musescore.org/en/handbook/developers-handbook/finding-your-way-around/git-workflow#Make_a_Pull_Request_to_send_your_changes_to_MuseScore

Check the Important note at the end of the "Make a Pull Request" chapter (but since you keep showing a lack for following links, I'll quote it here for you):

Important: If you haven't signed the MuseScore CLA yet, do this first as it's a requirement for your pull request to be accepted.

[jeetee]

All of these can be easily found in about 30 mins of browsing the contributor documentation; so again, do your research, get the facts, then come with proof.

[Xmader]

If you just want to teach me how to prove my claims, then thank you for all endless effort in begging me to pick up your statements.

[Xmader]

So, who are you? You keep telling me that you are just a random contributor, however you seem to know every detail of the CLA and every person since 2008.

a lot smaller team of contributors; all of which have signed the CLA when it came into existence.

There is no version prior to 1.0 (nor were there mobile apps).

[Xmader]

All of these can be easily found in about 30 mins of browsing the contributor documentation; so again, do your research, get the facts, then come with proof.

Your only source of proof is the scrappy descriptions on that tiny documentation. Is that verifiable? At least, it says. I am waiting for people's replies ~

[Xmader]

As you said, don't rely on a single claim, come with proof.

[jeetee]

So, who are you?

With regards to my involvement with MuseScore, I'm an active forum member of .org and an occasional contributor. In that role I've had the opportunity to meet the original team during FOSDEM a couple of times and can call them my friends. It is through that friendship that I've gained more information about the history of MuseScore.

What I also am is someone who cares about correct licensing of source code; so if there is a GPL violation ongoing it should be addressed.

Then again, my person is still quite irrelevant to the discussion at hand and the facts to back up a claim of violation.

Your only source of proof is the scrappy descriptions on that tiny documentation. Is that verifiable? At least, it says.

Yes, the CLA is a legally binding document and the documentation refer to it; what more do you expect? Is it verifiable that all the current active code was committed by people that have signed the CLA? YES; again, take the blame of the full sources and compare it with the CLA list

So no, my point is not about a single tiny description (since when does size has a correlation with importance?). It is about all those things combined: the CLA document, the list of those who signed it, the instructions for new developers on how to get their PR accepted, the actual rejection of some PRs due to the author not signing it and the git blame. It's all of those sources combined.

I am waiting for people's replies ~

Again, if you choose this more intensive route of proof, by all means go ahead. But as an aside information: me, being a contributor with active code inside MuseScore at least have not received your email inquiry yet.

[Xmader]

compare it with the CLA list

Please show me the list of people who signed the CLA. It's not on https://musescore.org/en/cla

the actual rejection of some PRs due to the author not signing it

Show me some.

But as an aside information: me, being a contributor with active code inside MuseScore at least have not received your email inquiry yet.

because I know you are here.

By the way, the CLA says the company can do anything on the code. They did -- release it under GPL.

Where did the dual-licence come from? Any indication?

[jeetee]

compare it with the CLA list

Please show me the list of people who signed the CLA. It's not on https://musescore.org/en/cla

It is, if you're logged in with a free account. But since you once again fail to do research yourself:

Contributors who signed the CLA: Thomas • Nicolas • David Bolton • Leon Vinken • its_jon • sbesch • Soerboe • Miwarre • trombonechamp • newsome • emeraldimp • vanferry • chen lung • Jojo-Schmitz • thSoft • Neco • JacobFerrero • Lakrits • Marc Sabatella • jotti • ABL • Gootector • duck57 • joecummings1212 • mokaspar • jr.polaris • joejoe_ • ChurchOrganist • bmhm • さち子 • elerouxx • yufanyufan • Ernest3.14 • cjones_ • Peter Lewis • Gai-Luron • AMDmi3 • Claudio musica • ottmaaten20 • RichHelms • hoffmaje • TonyM-softins • jorgk3 • njvdberg • tkarena • jose.chafino • jono_7 • ericfontainejazz • danfreem • DoMi.com • victorwestmann • postach.com.ua • RLBall • karebear3796 • dianna bradley • Diego Kantush • ArminB • sparta300 • aevancho • Bradley.King • Kori Thomsen • Bertrand Thibaut • kcsonshine100 • Jeff Jetton • noahsdt • lycjoyce88 • rafaelement • PeterDS • bog • picnic • honma • Phillip Couture • Prof Lassen • trumpet120 • Mariamaria19 • tvaz • Stiney • HERMANS • vgStef • jcsid • Bertalan Fodor • dawsonblaze • larryz • Mares79 • flyingninja77 • Tommaso Cucinotta • 1nprayers • NoahC • heuchi • Taknavaz • fyzix • eynstyne • johey • dodotis • kwsmithsr • thuhang • pauline day • lvwarren • wieczorek1990 • kirillmueller • BoT • infojunkie • TromboRafi • RAWKiTSciENTiSTLiVEY3_-. • deya2008 • ivebencrazy • PBRoop • matt1642 • MarkRS • tonyboyangie3 • Isenbarth • cpu90 • becomingnolan • watery • Roger Priddle • lilcomputin • SallyBurtJH • uwei • JouisWalker • matt28 • parinporecha • Simon Falck • spiccato • dan1e1 • zscore • danielgarthur • trig-ger • tinman • __Zwischen__ • Cymbalboy • PenAndCad • 장호영 • hunterallen40 • ellsworthpc • bsdz • rtega • mjszczep • gomesrod • choidaehwan • beauxq • Isensee • jim.newton.562 • peter.frumon • WeswePengu • shoogle • igevorse • shredpub • jpirie • Jon Gadsden • sideways • couicoui • geoff.hacker • bartlomiej_lewandowski • akdor1154 • Carl M Jacobson • AndreiTuicu • tisimst • jpfle • jasonbcox • LucaRood • rickvanderzwet • Laurelin • laetiita212 • hornlover1 • austix • kaled.dabboussi.3 • seanyeh • Estard • feikname • frostpearl • jazzguitarboy • tanmoy • folbo • brecht.simons.581 • CombatCube • exprosic • karan.sanwal • Isaac Weiss • jeremy.slade • sirsoweird • gsagostinho • stevietriesenberg • pgkos • DustyC7 • fbrauchle • Jason Leung • alcinos • michael.cuthbert • evinism • awelch83 • oberon2007 • johnsonge • nidhimj22 • Mike_97 • tobik • NerdyMunchkin • benjaminran • AshBoy • pt-get • Elwin • SlowRabbit • coolguyxp • ajaissle • margus.niitsoo • lagro • 谢致邦 XIE Zhibang • herrwagner • adrianholovaty • MLutz • azmeuk • Propagation • Heslil Inc. • david lupo • emeric • riban • zhangmingjp • AldaronLau • kwertyops • NoahS2003@gmail.com • Parker8283 • 19JoHo66 • LUGTPE • Fyrult • Pierre Colot • Rechi • jeetee • jan.hajic.jr • thomasa88 • Dylan Nicholson1 • Durgesh Choudhary • nezticle • cammyvee • mirabilos • sraduvictor • abhinav_ • luyikai • banjobits • Anson Bastos • WASam • cifka • worldwideweary • adam.spiers • salil K • akhilesh • syrma • hpfmn • Homletmoo • LuiCat • Jon Enquist • ian-ring • Alexandre Joly • ttflee333 • liangchen • myltsev • philhart • andrewyoon • nich-liu • boblucassen • mike320 • BrnVrn • Elizabeth Sherrock • ndiamistrator • izzychns • jurf • Qantas94Heavy • byan61 • SirChregeli • mattmcclinch • blackears • vinayakvivek • mathblitz • divya-urs • raphaelc • d.dewit • lrosenfeld • songchaow • frank.vanbever • Klaus Rettinghaus • dinukadesilva • Rico Arisandy • Emmanuel Vallois • wick.chr.info@gmail.com • Animesh7 • joshwd36 • crispy7 • pthvogt • roxluca • alexander-wilms • Riaan van Niekerk • SolarGranulation • mbrickn • eliaspap • JoshuaBonn1 • aryamanvinchhi • cadams888 • Alex Loranger • Maksim Kubatin • eridal • toy2man • Louis Cloete • matthewkenigsberg • Robbie Matthews • JGreenlee • Daniel • Ludwig van Benteuer • Rohan James • Kovak • Niels Erik Nielsen 2 • iamshreyas • falcojr • Vladimir Buyanov • TheOtherJThistle • notpillipton • rocchio • kuretenmei • Victorzz • Anatoly-os • kartikay.kumar.944 • bmul13 • Finley Lau • Kunda1 • jblang • TTocs2112 • dmitrio95 • David Copperfield • Egahi • Marr11317 • WStites • benkwok • labocho • rcombs • afprado • psss • Enzo Pain • Howard-C • almostimplemented • MrDrProfK • Jeremy Baker • laurentapprentice • Spire42 • mikelam • Gabriel Nehemias • handrok • julianclem • Nico Hoogland • songchao • neGjodsbol • ylink • Barry Ello Zhang • TerLaw • humblediscipu1 • mukeshnithcse1 • tjales • KuribohG • akhilabrahamt • pkjq11 • Brandon Mendez • Startled Bee • Michael Froelich • Asmatzaile • pachulo • Giraffeics • ngg1 • Shubham Kumar • Peter Hieu Vu • allardnaber • glenfordwilliams • AnandHemachandran • Margus Niitsoo • bothorsen • pbrenna • mvolganli • David GEIGER • mmu_man • Noah Whitehouse • Angel.E • davidsg • ankitkarody1 • Awais Chishti • snieb • changhc • quarriedstone1 • vagelisbilios1 • samuelrlee1 • shauryagupta11 • sengi • thecreekninja • Maximilian Konrad • matangover • Minerscale • malaka712 • nikhilgx • Sonny-Kl • jpear1 • pearcemerritt • DLLarson • Manuel Carrasco • emfomy • Matt Montag • Arya Tathe • eduardomourar • saraztang • tcannon686 • Emmanuel Istace • PCChris • dbrinkmann • frostolis17 • davidservias • mcleodnw • michaelscottgregory • deepmajumder2 • chrdoot • ypoissant2 • pereverzev_v • sandrahenry28 • loganjerry • liorkl • ProfeJuanca • ayusdas2000 • Thibaultj • snydez • kevinbroadey • jeromeduval • harries.adam • mpatidar • kfreezen • igor.korsukov • flynndcs1 • martijnvanmee • laturetab • agus.terol • ParamAsAlways • Sergios - Anestis Kefalidis • cainatkinson9 • an-32010 • benhommrich • shrivastavaka • nathanesau1 • Shang-Ling Hsu • eptgen • Philzen • orivej • omerkling • ice6 • pungpearu • DL.eeee.nv • bertrandschmitt • franciscoskro1 • secundaja • alfred22m • eismailzada • dancinggrass • cbjeukendrup • EpicPointer • iveshenry18 • Arbochelli • DrumsandBikes • JYMEN • drebelsky • domocchietti • J_21 • dnovikov • rmacd • 85sid • jominjose14 • omaremaradev • dlinkuaua • deniskhoshaba • Ameer Lubang • aaaeka • qitaoweng • shivanshbaksh1 • haotiangong • MysticSlice • arjuntaneja79 • therealricepu1 • FergalOK • sonalpratik99 • VHilario • ichikawt • LOxyMusic • krisbierma • luvizzz • legendarypotatoe • frasrcl • yamasakijeffr

If you consult that list on the CLA page itself you have the advantage of being able to click through on each on of them, leading straight to their .org profile. If they've not explicitly disabled it in their account preferences, then you'll also find a "contact me" button on there that allows you to send them a message.

the actual rejection of some PRs due to the author not signing it

Show me some.

There aren't that many because well, most people sign the CLA instead. But once again this is something you ought to find out in 1 or 2 hrs of work. Perhaps start from https://github.com/musescore/MuseScore/pulls?page=1&q=is%3Apr+is%3Aclosed+is%3Aunmerged+CLA+in%3Acomments which lists all non-merged PRs where the CLA is mentioned in the comments. You'll easily notice that in most cases this mention is a reviewer asking for signing it, after which in nearly all cases the author did so. This one for example the author chose to close the PR themselves rather than signing the CLA.

By the way, the CLA says the company can do anything on the code. They did -- release it under GPL. Where did the dual-licence come from? Any indication?

The fact that they have an app in the iOS App Store is that indication, as the ToS from the App Store are not compatible with GPL. See for example the VLC article on ZDNet from already quite some time ago and/or this stackoverflow thread discussing the same.

Also note the reply you've been given by @ljrk0 above:

The CLA says that the ownership of the code is signed over the Muse Group which then can shell out as many differently licensed versions of the program as they please, since they own the Copyright. The Copyright is a the legal privilege of being able to say who is allowed to use your software, including putting a license on the code for everyone to use. But you are still able to give a different license to those who ask, since you own the Copyright.

And yet once again, finding all of the above took me about 40 minutes, and it's been almost 7 months since you've been aware of the dual licensing possibility (if you weren't yet before I posted here).

[jeetee]

Where did the dual-licence come from? Any indication?

There's a whole thread on the sourceforge mailing list about the CLA (and when it came into existence): https://sourceforge.net/p/mscore/mailman/mscore-developer/thread/201104011948.15750.ws@wschweer.de/#msg27295415

Just to quote one of the many relevant replies (which in itself is already a quote from the Linux User & Developer Magazine Issue 97), part of a reply given by Werner:

"GPL-licensed projects can, where all the copyright holders are in agreement, use a dual license model to get products into the Apple Store" The CLA is exactly this agreement.

[devshgraphicsprogramming]

@Xmader the only way you can get anything out of this, if you find the one person who hasn't signed the CLA and haid their code accepted under GPL, and had that person sue for violations of GPL (cause everything after that is a derivative work).

Without that one copyright holder who's being harmed, you dont really have a way into the courtroom.

[jeetee]

So... I'm guessing you couldn't find a non-signing contributor?