8 ms·

isn't this just malicious compliance? not clear how this would violate GPLv2?

by spydum 28d ago

osmsucks 28d ago
Yeah, I agree. While this is a terrible move IMHO, from my superficial reading of the GPLv2 it doesn't really constitute a violation: the license imposes that the source be distributed to anyone who asks, potentially even charge a fee to cover its distribution costs, but it doesn't require that development happen in the open.
- shevy-java 28d ago
  I mean, the only way to test this is to require of Google here to release the source code. And then look at how a court will evaluate it. For instance, what if Google never sends the source code? What if they claim that no request made it in? Though I guess this can be ensured, e. g. via letter that is registered being sent and then looking at Google's response to it. So right now I think we all probably do not know. Google MIGHT refuse to release the source code, but it could release it - we don't know yet. Someone has to test that.
  - osmsucks 28d ago
    > For instance, what if Google never sends the source code? What if they claim that no request made it in? That would be a violation of the license terms. All Google has done so far is, apparently, to make it hella annoying to access the source code (but not impossible).
- grapheneos 28d ago
  GPL not defining a time limit to comply also doesn't mean there isn't a reasonable limit on compliance time. Google is more than capable of quickly complying. It comes down to whether a judge would think what they're doing is reasonable and we don't think they would. The software also isn't in the preferred form for modification. The build system which runs Git commands and doesn't work as intended without it. You have to make a Git repository for it to work and there's meant to be a separate one for each separate component. It spews out errors.
gruez 28d ago
My guess is that all their code is in their monorepo (google3), and they don't want to set up a tool to sync it to a public git repo, so the easiest way is just to have someone create a tarball on demand.
- thayne 28d ago
  But google already built a tool to do exactly that: https://github.com/google/copybara https://github.com/google/copybara

isn't this just malicious compliance? not clear how this would violate GPLv2?

by spydum 28d ago

isn't this just malicious compliance? not clear how this would violate GPLv2?

Yeah, I agree. While this is a terrible move IMHO, from my superficial reading of the GPLv2 it doesn't really constitute a violation: the license imposes that the source be distributed to anyone who asks, potentially even charge a fee to cover its distribution costs, but it doesn't require that development happen in the open.

shevy-java 28d ago
I mean, the only way to test this is to require of Google here to release the source code. And then look at how a court will evaluate it. For instance, what if Google never sends the source code? What if they claim that no request made it in? Though I guess this can be ensured, e. g. via letter that is registered being sent and then looking at Google's response to it. So right now I think we all probably do not know. Google MIGHT refuse to release the source code, but it could release it - we don't know yet. Someone has to test that.
- osmsucks 28d ago
  > For instance, what if Google never sends the source code? What if they claim that no request made it in? That would be a violation of the license terms. All Google has done so far is, apparently, to make it hella annoying to access the source code (but not impossible).
grapheneos 28d ago
GPL not defining a time limit to comply also doesn't mean there isn't a reasonable limit on compliance time. Google is more than capable of quickly complying. It comes down to whether a judge would think what they're doing is reasonable and we don't think they would. The software also isn't in the preferred form for modification. The build system which runs Git commands and doesn't work as intended without it. You have to make a Git repository for it to work and there's meant to be a separate one for each separate component. It spews out errors.

gruez 28d ago

My guess is that all their code is in their monorepo (google3), and they don't want to set up a tool to sync it to a public git repo, so the easiest way is just to have someone create a tarball on demand.

thayne 28d ago
But google already built a tool to do exactly that: https://github.com/google/copybara https://github.com/google/copybara