Misleading License Information for `com.google.ar:core` library

westnordost commented 2 years ago

SPECIFIC ISSUE ENCOUNTERED

According to the POM file published for the Android library com.google.ar:core and according to the LICENSE file in this repository, the library, including all the source files, (i.e. not anything of the ARCore app itself) are published under the Apache License 2.0:

https://github.com/google-ar/arcore-android-sdk/blob/d197af6b38f98d2344bc7f76326c4aa0c4f2fb90/LICENSE#L18-L25

The actual source files are not provided in this repository but are only available via the google maven repository:

https://dl.google.com/dl/android/maven2/com/google/ar/core/1.32.0/core-1.32.0-sources.jar

However, contradictory to the license statement made in the POM and in the LICENSE file in this repository, not all but some of the *.java files contained in the published source JAR contain the following comment at the top:

/*
 * Copyright 2017 Google LLC
 * CONFIDENTIAL. AUTHORIZED USE ONLY. DO NOT REDISTRIBUTE.
 */

, e.g. Trackable.java. Edit: Additionally, many/all? actual implementation has been removed and replaced with comments like // Method contents removed..

Such contradictory information makes this library problematic to use as an open source library as it introduces legal uncertainty. Noone wants to risk legal uncertainty towards Google.

VERSIONS USED

com.google.ar:core:1.32.0 Edit: persists in 1.33.0

SOLUTION

Make sure any contradictory license information is removed and all code in object form is also provided in source form in at least the source JAR published in the maven repository or better even in this git repository.

devbridie commented 2 years ago

Hi, the sources distributed in the sources JAR should be the same license. This is probably a bug in the generation of the source files; please let me take a look. Fair warning, I don't think will be fixed by 1.33.

devbridie commented 2 years ago

FWIW, let me try to clarify ARCore's distribution and the nature of the source,

The ARCore client SDK is currently distributed as a binary blob that ships with apps included with a header file https://github.com/google-ar/arcore-android-sdk/blob/master/libraries/include/arcore_c_api.h. When include 'com.google.ar:core:... in your app, the binary in the maven artifact is shipped with your app. This binary is not open source.
This binary communicates with the Google Play Services for AR APK that is installed on the target device. Google Play Services for AR is also not open source.
The ARCore client SDK comes with Java bindings (the Java SDK) to this blob. There are files shipped in the Maven artifact to facilitate API discoverability for IDEs (includes e.g. javadoc and function parameters names), but no implementation of methods.

westnordost commented 2 years ago

When include 'com.google.ar:core:... in your app, the binary in the maven artifact is shipped with your app. This binary is not open source.

Oh, so the AAR as a whole is not open source / licensed with Apache License 2.0. That is really unfortunate. I recommend updating the LICENSE file and the license mentioned in the POM file to clarify this. If part of the published library are not under the Apache License 2.0, the package as a whole may not be redistributed under the terms of the Apache License 2.0.

In case you/your team wants to reconsider this in the future: I think you lose nothing if you make that part open source too, because the real valuable "magic" of ARCore lies in the separate proprietary Google Play Services for AR APK anyway, not in the communication with that APK. As long as the ARCore client SDK is not open source, it cannot be used in any purely open source project, i.e. any project that is published on F-Droid.

westnordost commented 2 years ago

As it turns out, as long as the com.google.ar:core library is not open source as a whole, it means that this library cannot be used by any copyleft-licensed (e.g. GPL-licensed) project, so this is not an issue with publication on F-Droid but generally. That it communicates with a proprietary application (the ARCore app) is not an issue, on the other hand.

For any current users of this library (like me), it would also be very important to learn as soon as possible whether you intend to

clarify that the Android library is not open source as a whole in the maven publication POM and LICENSE file in this repo, or
if you intend to provide the source code for the part currently only distributed in object form according to your current license claim.

In case of the former, It is important to clarify because currently, open source projects continue to be mislead into that using this library is safe to use. This is causing real damage, in terms of working time invested, as any copyleft licensed code that has been working with ARCore is worthless (now). Imagine having worked half a year on some copyleft AR application trusting the license information given, only to find out that the license claim of a library you based your work on was wrong.

In case you plan to make all parts of the Android library open source, please note that currently many(/all?) of the Java source files contained in the published maven sources JAR have their actual implementation removed (with comments like // Method contents removed.).

ShadowJonathan commented 2 years ago

AINAL, but, while it shouldn't have be said explicitly, there are obvious legal problems with saying and presenting a library as open source, but then not providing any source, at least not in any conventional way the rest of the industry provides it.

Source Available != Open Source, at least in this case, as platforms like F-Droid follow this definition to the letter, requiring all applications to be built from scratch, which requires all sources to be available, referable, and under the same license the whole library was originally published.

EvanCarroll commented 2 years ago

It is very concerning to me as a user and developer of open source software that Google would allow such sloppy misrepresentation. The reality should be very simple, your words:

the sources distributed in the sources JAR should be the same license.

That you've obfuscated this by introducing blobs, sdks, and methods without implementations (APIs) would make me apprehensive of using Google's code in my own projects. You've got developers NOW that have used your code in good faith under the terms you've advertised it only to find out it's not compatible with open source licensing. You've wasted a lot of people's time and deceived them.

Do the right thing and open source the project, the right way. No funny business. Or in 20 years time, like Microsoft today, you'll be spending billions of dollars to buy back the good will you've burned with the community of developers.

mnalis commented 2 years ago

@devbridie would you know if there is an active effort or discussion at Google at this time to address (correct or clarify in github repository) this incorrect ARcore licensing claims?

EvanCarroll commented 2 years ago

May I suggest a courteous,

WARNING: this library is not open source. The use of this library means your program will rely on proprietary code not made available for compilation.

That would be nice anyway.

mnalis commented 2 years ago

westnordost commented 1 year ago

It looks like the ARCore team finally cleared up the misleading license claim in this commit to the LICENSE file, confirming that the ARCore library is indeed not open source: https://github.com/google-ar/arcore-android-sdk/commit/6f887e14366c5737621f91e3d8e29f520016e25d

If no further action is planned, feel free to close this issue.

google-ar / arcore-android-sdk