runbox / runbox7

Runbox 7 web app
Other
127 stars 24 forks source link

Unclear licensing #1521

Open qrpnxz opened 9 months ago

qrpnxz commented 9 months ago

I've submitted this project to the Free Software Directory. We surmise that the software is free (as in freedom) being licensed under GPL-3.0-or-later going by the package.json, (we recommend also specifying "or later" in the README,) but we have concerns about the files in src/assets. There is no additional licensing information for these, and in particular we have doubts about the fonts, that you have rights to license these under GPL.

This has not quite prevented the program from being listed, as it appears that the fonts may be substituted without issue, but it poses a problem for distribution.

Please clear up the licensing of the assets.

gtandersen commented 8 months ago

@qrpnxz Thank you for submitting the project to the Free Software Directory and for the licensing recommendations.

We are currently updating the README and LICENSE files, and after discussing the matter we have concluded that a single license file at the root of the repository that includes asset-specific information should suffice.

Regarding the assets we are trying to discover whether licensing details for each individual file is required or whether the files can be grouped. If the latter is sufficient the following license might be acceptable:

Copyright (C) Runbox Solutions AS (runbox.com).

This file is part of the webmail application Runbox 7.

Runbox 7 is free software: You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

The software includes source code programmed in the Angular web application framework. Additionally it includes a number of optional and replaceable font face and graphic assets with the following proprietary licenses:

- Avenir-Next TTF and OTF files: [Avenir Next WebFont EULA](https://www.myfonts.com/pages/license-agreement?id=eula_2267&eula_lang=eula_en)
- All PNG files: Copyright (C) Runbox Solutions AS, all rights reserved.

Runbox 7 is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the [GNU General Public License](https://www.gnu.org/licenses/) for more details.

Any further recommendations or comments you might have would be most welcome.

qrpnxz commented 8 months ago

Thanks for considering the issue. I have some further comments and recommendations.

PNG Files

I noticed that intend to reserve all rights on the PNG files. That's no license at all. Since part of those rights is distribution, we would not be allowed to copy the project. Would you consider licensing those assets under the Creative Commons Attribution 4.0 free license, or dedicate them to the public domain? I see several of the pictures are logos; CC legal codes do not license trademarks (if you have any), but would allow people to otherwise copy the project to run and share without issue. If you wished to do so, the above would read as:

- All PNG files are licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/)

or

- All PNG files are dedicated to the public domain according to [CC0 1.0](https://creativecommons.org/publicdomain/zero/1.0/)

Font license

I read the EULA for the fonts, and I am confident they cannot be part of this project at all.

These are all the license grants:

  1. "install the Font Software on a Server, solely to generate content on a Website for up to the number of Page Views indicated in your Account or transaction documentation such as a quotation or an invoice;" [Doesn't sound GPL compatible. I suppose runbox.com has the necessary rights to use it, but the typical user could not freely run it.]
  2. "allow users of your Website to type text on that website through Use of the Font Software (e.g. in form fields, customer feedback etc.) solely for transactional or marketing purposes; and" [Narrow downstream use rights.]
  3. "make backup copies of the Font Software, provided that such copies are for your internal back up purposes only and remain in your exclusive control. Any copies that you are expressly permitted to make pursuant to this Agreement must contain the same copyright, trademark, and other proprietary notices that appear on or in the Font Software." [This repo certainly is not for internal back up purposes only, and is lacking notices.]

That's all the rights granted. Based on that alone, I don't see that it is allowed to be here. But there's more explicit restrictions on Use; "You may not:"

“Publicly Available Software” means a) any software that contains, or is derived in any manner (in whole or in part) from, any software that is distributed as free software, open source software (e.g. Linux) or similar licensing or distribution models; and (b) any software that requires as a condition of use, modification and/or distribution of such software that such software or other software incorporated into, derived from or distributed with such software (i) be disclosed or distributed in source code form, (ii) be licensed for the purpose of making Derivative Works, or (iii) be redistributable at no charge.

Pretty explicitly a no-go. Perhaps Runbox would consider a free font?

Word-wrapped version

I made a word-wrapped version of your proposed text, and fixed the GPL link.

Copyright (C) Runbox Solutions AS (runbox.com).

This file is part of the webmail application Runbox 7.

Runbox 7 is free software: You can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

The software includes source code programmed in the Angular web
application framework. Additionally it includes a number of optional
and replaceable font face and graphic assets with the following
proprietary licenses:

- Avenir-Next TTF and OTF files: [Avenir Next WebFont
  EULA](https://www.myfonts.com/pages/license-agreement?id=eula_2267&eula_lang=eula_en)
- All PNG files: Copyright (C) Runbox Solutions AS, all rights
  reserved.

Runbox 7 is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
[GNU General Public License](https://www.gnu.org/licenses/gpl)
for more details.
gtandersen commented 7 months ago

Thank you once again for the extensive comments and suggestions.

After reviewing these in the context of increasing trends in website impersonations, phishing, and other forms of email service abuse it has become clearer that Runbox to a greater extent needs to protect its assets and source code.

On this basis it is likely that Runbox will need to transition away from the GPL license of Runbox 7 and instead copyright its source code, which will however remain open source.