The openSUSE legal team indicated that the main kget program is licensed as GPL-2.0+, but that the source files in the /transfer-plugins/mmsthreads/ subdirectory are GPL-3.0+ licensed Please confirm if KGET is now GPL-3.0+ or that the source files in the indicated directory are wrong. Reproducible: Always
I added Ernesto as CC, he is in charge of the mmsthreads plugin! Lukas
*** Bug 330881 has been marked as a duplicate of this bug. ***
The application can be used/modified/distributed under the terms of either the GPLv2 or GPLv3 or future versions. I can choose which one to follow. If I use it together with that GPLv3+ plugin then I can't choose the GPLv2 since they aren't compatible. But *without* the plugin then I can very well choose GPLv2. The presence of the GPL3+ plugin doesn't mean every source file in the application has to be licensed under GPL3+ (and this would be true even if it wasn't a "plugin"). For example, I can be evil and distribute KGet pre-installed in a cryptographically locked-down device (so-called tivoization, which GPLv3 forbids), *as long as I remove mmsthreads*. Or I can take KGet's (say) core/bitset.cpp and copy it into my unrelated GPLv2-only project. Relicensing everything under GPLv3+ would forbid that. Now, are compiled kget binaries GPLv3+? I would say /usr/bin/kget isn't, since it doesn't have any GPLv3+ code, the plugin is built into a separate binary. Only the plugin .so is v3+. But if it makes things simpler, you *can* say all the binaries or the whole distribution package are GPLv3+. If KGet authors say "you can distribute this under v2 or v3 or later", then they're letting you distribute under "v3 or later". Think of what you would do if the whole application was GPLv3+ except for one little file borrowed from another project that is GPLv2+. But IANAL, etc. Of course there's still the possibility of contacting the author(s) of mmsthreads and have them relicense under GPLv2+. And using SPDX would make all this much clearer and auditable, we should look into that...