Possible GPL violation in Avantis Content Cache servers

[Tony Whitmore]

Malcolm Bain wrote:
> Hi Tony
> 
> Interesting analysis - just a couple of quick "off the cuff" comments on
> a Monday morning...

Thanks for taking the time to read it.

> -- you say "/As wget is used as the mirroring and pre-caching system, it
> is an integral part of the appliance. It cannot be used separately from
> the rest of the product (as there is no command line interface)wget is
> an integral part of the appliance" / If this is so,  this would seem to
> oblige Avantis to distribute all the package (in so far as any part
> cannot be considered a "separate independent work") under the GPL. The
> same may apply for Setacl - though I don't know the system architecture.

That's one possible interpretation, certainly, although I understood
that the GPL only required linked software to be released under the GPL.
 (Although I also understand that this is also an area of much debate
wrt the GPL.)

Is it the case that other appliances using GPL software require the
whole thing to be released under the GPL? It this the case for other
appliances like Tivo or TomTom?

Certainly the access presented to users is solely the web interface, and
the system administrator only has access to a small amount of further
functionality, mainly for resetting passwords and configuring backups.
There's no means within the presented interface to use the wget tool
separately.

The setacl tool is called during the installation process, although
could be called by other processes too.

> -- It is not a question of whether wget or setacl work as independent
> programs from ContentCache - it is the other way round: if ContentCache
> doesn't work without these two programs (or other GPL software), there
> would be strong arguments to say that they are not independent and
> therefore should all fall under the GPL...

Well, the wget program is used for pre-caching and off-line mirroring of
sites and this is one of the main features of the system. It would be
missing a large part of its functionality (and would fail to meet the
Becta specification) if the wget binaries were removed.

As mentioned above, the setacl tool is used during installation of the
system. I don't know whether its removal would impair the functionality
of an installed system, but it is reasonable to assume the program
performs an important function during the installation process.

(The installation is an automated Windows Server 2003 installation,
along with the Content Cache software. It is not possible to install
either item separately using the distributed recovery media.)

> -- if I remember correctly, the OpenSSL license and the GPL are 
> incompatible (publicity obligations of the OPenSSL - I think it is under
> the old BSD)  (and I think they say/said so on their FAQ page and so
> soes FSF - I haven't looked recently) (PS. Is OpenSSL distributed as
> part of the operating system? Doesn't sound like it ..., otherwise they
> may fall under that exception)

I don't believe that OpenSSL is shipped with Windows Server 2003, so it
must be installed as part of the Content Cache software. The links on my
analysis page say that the SSL files provide the SSL support for the
wget binary.

Having said that, it's impossible to differentiate between the Windows
OS, the Microsoft ISA Server elements and Avantis' software both during
the installation process and normal system operation.

> -- Do you have legal access to the software and right to republish the
> manual (you don't want to get into any "illegal/legal"  decompiling  /
> redistribution arguments)?

I have legal access to the software as the systems were distributed by
the LEA (Local Education Authority) to schools. As explained in the
page, the User Agent string put me onto the problem, the rest was done
by booting from a Knoppix CD and investigating the contents of the hard
disk.

> There are probably more issues, but these are just some preliminary
> thoughts. The issue that the whole "appliance" may have to be under the
> GPL may be more "damaging" or worrying for them that smaller (?) issues
> of not publishing source code and licenses for free software component
> parts.

To be honest, I'd not considered the implications of the whole appliance
being considered a single piece of software. Given that it's based on
Microsoft software but seems to use GPL (and other Open Source licensed)
software in the software claimed to be written by Avantis there are a
number of potential interpretations. I'll await further advice and see
if a consensus opinion can be reached.

Regards,

Tony
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 256 bytes
Desc: OpenPGP digital signature
Url : http://lists.gnumonks.org/pipermail/tech/attachments/20060220/da31d9c1/signature.pgp