search

throneless-tech / libsignal-service-javascript

A javascript library for basic interaction with the Signal messaging service, adapted from Signal-Desktop.
GNU General Public License v3.0
57 stars 21 forks source link

License: GPL or AGPL? #16

Closed panzi closed 3 years ago

panzi commented 3 years ago

This project uses GPLv3, but it also claims to contain ported code from Signal-Desktop which uses AGPLv3! I don't think you can change AGPL code to GPL code? Because you can use GPL code in your proprietary server application that you only run on your server and don't distribute, but you can't do that with AGPL code. So that means we couldn't use this library in our proprietary chat bot (that only runs on our machine, but talks with customers)?

panzi commented 3 years ago

I just noticed that the license of Signal-Desktop was changed from GPLv3 to AGPLv3 November 3rd 2020. So if you didn't pull any code from that project after that point its fine, I guess?

jheretic commented 3 years ago

It's currently using code from April 2020, which is the last time the upstream components were pure Javascript (they're Typescript now), and consequently I haven't synced the upstream components since October. I'm planning on continuing to update them, but that's a bit of a larger undertaking since it'll probably be most expedient to re-port it from the Typescript variant. It's a little unclear to me if I have to relicense under the AGPLv3 after I update the upstream code (since there's a specific carve-out for mixed AGPLv3-GPLv3 projects) but I'm inclined to think that I do. Plus I generally want to follow Signal's lead since the backend and the majority of the code is theirs.

Your options are probably to fork the library before I relicense (though I don't recommend this as a long-term solution, since you wouldn't be able to get updates against revisions of Signal's backend API without violating license restrictions, so it would likely stop working eventually), continuing to use the library after relicensing and releasing the source-code of your chatbot under a compatible license (probably most in keeping with the spirit and intent of the AGPLv3), or utilize a separate network service from the proprietary components of your chatbot to communicate with Signal, disclose its use, and distribute any modifications to that service (for instance, I've done some work for the Guardian Project on improving Sigarillo, which uses this library https://gitlab.com/digiresilience/link/sigarillo).

That said, it'll probably be a little while before I get around to a Typescript rewrite, so you've got some time to explore your options.

panzi commented 3 years ago

Reading up on that it seems to me you don't need to explicitly re-license this project, but the parts derived from AGPL code keep of course AGPL and as such the library as a whole has to be used under the AGPL conditions. I guess that means that even if you keep the license of all the other code parts GPL you also need to include an AGPL.txt and make clear that users of this library need to adhere to AGPL.

I'm just a developer at my company and not the copyright holder of the chatbot. Releasing it as open source will not happen, because that would negate our business model. The separate service would probably be the way to go (probably using sigarillo).

Thank you for your quick reply! 😄