Debian Kicks Jörg Schilling

An anonymous reader writes "Debian's cdrecord maintainers announced that they have had enough of Jörg Schilling and kicked his program suite cdrtools out of Debian, introducing a free fork of his no longer free cdrtools." I've put the message below, along with some other links.

So, why the fork? CD/DVD burning is a complicated business that needs a lot of knowledge, so forking such a big collection isn't a step to be taken lightly. It requires a lot of development effort that could be put to better use elsewhere.

In the past, we, the Debian maintainers of cdrtools, had a good and mutually cooperative relationship with Jörg Schilling. He even commented on Debian bug reports, which is one of the best things an upstream maintainer can do. Naturally, there were occasionally disagreements, but this is normal.

Unfortunately Sun then developed the CDDL and Jörg Schilling released parts of recent versions of cdrtools under this license. The CDDL is incompatible with the GPL. The FSF itself says that this is the case as do people who helped draft the CDDL. One current and one former Sun employee visited the annual Debian conference in Mexico in 2006. Danese Cooper clearly stated there that the CDDL was intentionally modelled on the MPL in order to make it GPL- incompatible. For everyone who wants to hear this first-hand, we have video from that talk available.

Here is the FSF position about the CDDL. This thread contains statements on the issue made by Debian people; for more context also see the other mails in that thread. In short -- the CDDL has extra restrictions, which the GPL does not allow. Jörg has a different opinion about this and has repeatedly stated that the CDDL is not incompatible, interpreting a facial expression in the above-mentioned video, calling us liars and generally appearing unwilling to consider our concerns (he never replied to the parts where we explained why it is incompatible). As he has basically ignored what we have said, we have no choice but to fork. While the CDDL *may* be a free license, we never questioned if it is free or not, as it is not our place to decide this as the Debian cdrtools maintainers. However, having been approved by OSI doesn't mean it's ok for any usage, as Jörg unfortunately seems to assume. There are several OSI-approved licenses that are GPL-incompatible and CDDL is one of them. That is and always was our point.

For our fork we used the last GPL-licensed version of the program code and killed the incompatibly licensed build system. It is now replaced by a cmake system, and the whole source we distribute should be free of other incompatibilities, as to the best of our current knowledge.

Anyone who wants to help with this fork, particularly developers of other distributions, is welcome to join our efforts. You can contact us on IRC, server irc.oftc.net, channel #debburn, or via mail at [e-mail]. Here is our svn repository.

I believe

[by Anonymous Coward]

They told him to fork off.

Ouch

[by Anonymous Coward]

I understand dropping his package, but kicking him? Man, I don't want to upset the Debian team.

Re:Ouch

[by Anonymous Coward]

Better than kicking his package. Ouch!

I've wondered about Debian

[Bombcar (16057)]

Won't the GPLv3 be incompatible with the GPL?

Re:I've wondered about Debian

[Curtman (556920)]

if even 1 package (ie: the kernel) doesn't say that, then the whole distro can forget it.

Can forget what? Every distro that I know of contains software with many different licenses. The only thing it prevents is taking code from a GPL v2 (without the 'any later version' clause) and putting it in a GPL v3 package. It doesn't say anything about running GPL3 apps on a GPL2 kernel, or CDDL apps on a GPL2 kernel, or BSD apps on a GPL2 kernel.

Re:I've wondered about Debian

[sydb (176695)]

There are some software that say or 'gpl v2 or any later version' but if even 1 package (ie: the kernel) doesn't say that, then the whole distro can forget it.

What are you talking about? A distro is "mere aggregation" which is allowed by the GPL. Debian includes software with GPL-incompatible licenses, such as Apache.

Re:I've wondered about Debian

[cduffy (652)]

Combining previously contributed 3rd-party GPLed code with your own (recently-relicensed-to) CCDL code is quite certainly a way to end up with a combined product which isn't legally redistributable.

Re:I've wondered about Debian

[jZnat (793348)]

As of now, Sun's Common Development and Distribution License [wikipedia.org] is not accepted under the Debian Free Software Guidelines [wikipedia.org].

Re:I've wondered about Debian

[julesh (229690)]

And Debian is based on releasing only GPL'd or GPL-compatibly-licensed softwares.

Er, no. Debian is based on releasing only software which conforms to the debian free-software guidelines [debian.org]. Says nothing about the GPL in there, other than that the GPL conforms to these guidelines. They also release software under the artistic license, which isn't even free software, according to the FSF's definition, let alone GPL-compatible.

CDDL

[mrsam (12205)]

Anyone who kept track of Joerg Schilling, and his prominent ego, was able to clearly see the inevitable fork from quite a distance away. Schilling was another one of those types -- like the dude who was running some obscure piece of code known as xfree86 -- whose success and prominence as the author of a popular free software package went completely into his head.

No, this should not be suprising news to anyone who's been following LKML. You could've predicted this a long time ago. What is really interesting here is the revelation that Sun explicitly made CDDL intentionally incompatible with GPL. That is, what I think, the newsworthy fact, and should be a wake up call to all the Sun fan club who've been slobbering all over themselves on the account of Sun's promises of releasing Java as free software.

Reading this just underscores the fact that you just can't trust Sun, and nobody should hold their breath on account of Java.

Re:CDDL

[krmt (91422)]

t's funny because when the Apache Software Foundation has a license that is incompatible with the GPL, no one gave them grief, but SUN moves to one and suddenly they're evil...

Debian actually quietly engaged the Apache Foundation about their license too and worked to resolve issues there as well.

Re:CDDL

[r00t (33219)]

"If that's all it was, then why has no one else been able to create an equivalent tool to Joerg's? You make it sound like Joerg was all hot air, and not a extremely technically cable person."

Who said anything about technical capability?

Well, I will: Joerg is moderately capable. His advantage is that he personally owns many expensive and out-of-production burners, and that his employer (the lovely MP3 patent holders) he has an unusual ability to get vendors to cooperate in giving out hardware information under NDA.

Joerg is a stubborn bone-headed idiot when it comes to user interface, hardware abstractions, and portability. He has the gall to claim that users actually like to specify all burners by a 1980s-style set of three numbers, and that users actually like running the -scanbus option instead of just using /dev/burner (or /dev/white-sony-drive, etc.) for the name. See the linux-kernel mailing list for some great flamewars, many involving Linus and many which lead to somebody catching Joerg in a lie.

So... are you Joerg, or are you his buddy the xcdroast author? That program too is a piece of shit. I've seen the code. It has buffer overflows. It doesn't abstract out the interface to the burner program. All over the code one can find ugly little bits of buggy cdrecord output parsing code, mixed right in with the GUI widgets. That's not how competant people write programs, excepting throw-away hacks.

Re:CDDL

[belmolis (702863)]

This doesn't surprise me in light of my experience with some of his other projects. On several occasions I've come upon one of his projects on Freshmeat and been interested enough to try to build it. This has generally been problematic. He has his own configuration and build system. It isn't necessarily bad - it may even have some advantages - but it is idiosyncratic and in my experience a pain to use. When I've examined the specifics of his project I usually find that the differences between it and the more standard version (several of his projects are variants of standard utilities, e.g. his count [freshmeat.net] is a variant of wc) aren't sufficiently interesting to me to make the hassle of his build system worthwhile, or that they lack features of other variants that are important for my purposes. (His count, for example, is said to be faster than GNU wc, but doesn't understand Unicode.)

None of this means that he is evil or incompetant, but it does give the impression of someone who is insistently idiosyncratic. I can easily imagine that he'd be difficult to deal with.

Re:CDDL

[Wolfrider (856)]

> Linux 2.6 doesn't need cdrecord

--I beg to differ. Cdrecord has the ability to:

o Access remote SCSI devices
o Blank CDRW media
o Write "cloned" images created from ' readcd -clone '
o Write multi-session CDs
o Write Audio CDs
o Write using "burnfree" buffer-underrun technology
o Set different Write speeds
o Overburn

What about dvdrtools?

[grandmofftarkin (49366)]

I thought that someone already forked this long ago because of problems with Joerg Schilling mucking around with the license? Read the wikipedia entry on dvdrtools [wikipedia.org]. In fact, dvdrtools is already a debian package [debian.org]. Why did they need another fork?

about time

[by Anonymous Coward]

Some of us grew tired of his rantings about:
  - why scsi emulation was better than native atapi/ide support
  - why the dvd patches were unofficial, and dangerous and you should buy his dvd modifications instead.
  - his insistance of clearly marking "unofficial" versions with warnings that tell you to use or buy his version
  - his sections of code that were not to be modified because he was afraid of answering questions about others instable patches.
  - his license change
  - ...

cdrtools is dead. long live cdrkit.

Re:Storm meet teacup

[Amazing Quantum Man (458715)]

Because most of the thousands of OSS cd tools are merely front-ends to cdrecord.

Re:Is the MPL the Mozilla Public License?

[OmegaBlac (752432)]

Yes it is the Mozilla Public License. From the "GPL-Incompatible, Free Software Licenses" section of one of the links posted in the summary/article:

Mozilla Public License (MPL)

This is a free software license which is not a strong copyleft; unlike the X11 license, it has some complex restrictions that make it incompatible with the GNU GPL. That is, a module covered by the GPL and a module covered by the MPL cannot legally be linked together. We urge you not to use the MPL for this reason.

However, MPL 1.1 has a provision (section 13) that allows a program (or parts of it) to offer a choice of another license as well. If part of a program allows the GNU GPL as an alternate choice, or any other GPL-compatible license as an alternate choice, that part of the program has a GPL-compatible license.

Re:GPL incompatable now means not free?

[drnlm (533500)]

GPL-incompatible means GPL incompatible, not non-free. This is really not hard to understand.

Combing GPL code with a GPL-incompatible license produces code that cannot be distributed. The GPL v2 specifies, you cannot add further restrictions, so if I combine this with code with a license that adds further restrictions, the code can no longer be distributed under the GPL. If I don't have permission from all the GPL contributers to relicense their code, I cannot legally redistribute the combined work. This is pretty much the entire point of copyleft.

Since the latest cdrtools packages look to be a combination of GPL'd code and incompatibly licensed code, Debian is removing crtools (not shunting it to non-free), because they feel they can no longer distribute the work.

Re:What Danese Cooper says is wrong

[rhizome (115711)]

I appreciate your comments explaining another perspective on this issue. It's always good to have as many angles represented on contentious issues. However, your points are not really germane to the story.

What Danese Cooper says is wrong. I and many other members of the OpenSolaris project know for certain that SUN did not create the CDDL to be purposefully incompatible with the GPL.

This does not contradict the stance holding that the CDDL is incompatible with the GPL.

In addition, what the maintainers have failed to mention is that they have repatedly introduced patches to the codebase that have broken or otherwise caused problems in the cdrtools codebase.

This has nothing to do with the license.

In addition, there are currently problems with Debian's Free Software Guidelines. Notably that the project does not consistently enforce them because many rules are not explicitly written, instead each software is judged on a case-by-case interpretation making it difficult for upstream developers to comply and those interpretations themselves are not always consistent.

In light of this, it would be an act in the name of consistency to further exclude other CDDL projects. It seems you are arguing for the inconsistency to be applied to cdrtools rather than fighting for greater consistency. A predictable reaction to the situation you describe could be to acknowledge the problems between the CDDL and the GPL and frame the controversy in this way, but when projects with incompatible licenses point to other problems in Debians inclusion choices in order to slip themselves through the gate it just poisons the well further rather than attempting to help satisfy Debian's goals.

Re:Good for Jorg...

[frogstar_robot (926792)]

Good for Jorg to stick to his guns. He can choose whatever license he wants to release his code under.

Of course he is. This freedom extends to releasing code that nobody else can legally use. A CDDL build system+GPL codebase isn't legal for anyone else but Jorg to distribute. More power to him.

most kernel developers strongly disagree

[r00t (33219)]

Back in the 1980s, the SCSI command protocol and the old-style SCSI bus were a matched pair. Devices had ID numbers that you could set with jumpers. Devices didn't move around. There was no hot-plug or plug-and-play.

Now we run the SCSI protocol over USB, FireWire, SerialATA, TCP/IP, and numerous other transports. You can't address all the devices on the Internet with a 3-bit number. Devices come and go. If you plug in a CD burner, it usually shouldn't matter which USB port you use.

The Linux solution is UDEV. We can also use D-BUS and HAL. Device names in /dev are now set by the user. UDEV matches various things (serial number, manufacturer, location, etc.) to identify the device. Device numbers are dynamic and essentially random. The names are stable. Normal apps open devices by name.

Joerg wants to use an obsolete backdoor. He doesn't use the normal device names or the normal CD/DVD driver. He uses the /dev/sg* devices, which are intended for screwball devices that don't have normal drivers. It is similar to a modem program bypassing the /dev/tty* devices by calling iopl() and then directly controlling the hardware.

Suppose you have two USB burners. If you yank out your USB cable and then put it back, the device numbers may change. The device names can remain the same, thanks to UDEV. Joerg's defective program will be unaware of this. It will just use the wrong burner.

Re:MPL not allowed in Debian?

[squiggleslash (241428)]

But as someone pointed out elsewhere in this thread, Debian includes other non-GPL compatible licensed software in its distribution like Apache, openssl, PHP for a few examples. Why be so specific about CDDL incompatibilty? Or is this just an issue about a clash of personalities?

Reread the parent. He said that a project that has both code licensed only under the GPL and code only licensed with {a license incompatible with the GPL} cannot be in Debian, because it would be illegal to distribute.

This isn't about putting Apache and GNU C in the same distribution. It's about putting filemanager.c and documentview.c in the same binary when filemanager.c is licensed under the XGL, and documentview.c is licensed under the XGL-incompatible YGL. That's the core of the problem here.

Re:But it belongs to Schilling, does it not?

[Bitsy Boffin (110334)]

The problem is that he has wrapped parts of his software package in two different, incompatible licences... if you like to continue the chicken suit analogy

1. You may distribute this software only if you wear a chicken suit
and 2. You may distribute this software only if you do not wear a chicken suit

so Jorg says you cannot distribute the software unless you both do, and do not, at the same time, wear a chicken suit. Fairly obviously, in this universe, distributing software under those conditions would be somewhat impossible.

The deb maintainers have tried to show Jorg this problem, but he is unwilling to change the situation, and as a result the only way that deb can legitimately distribute this software is to fork it from before the second licence was imposed and continue development themselves.

Basically, they've given Jorg every opportunity to correct the problem so he can continue to have his package legally distributed by debian, he's refused for whatever reason, and so debian has NO CHOICE but to fork it, drop it, or distribute it illegally. They chose rightly to fork it.

Re:Still squabbling I guess

[avenj (673782)]

It works like this: The CDDL is incompatible with the GPL. Schilling doesn't want to believe it is, but both the CDDL and GPL writers (and anyone with half a brain) say otherwise. So while he's perfectly within his rights to distribute source code that combines CDDL & GPL code (as he is doing now), as soon as you build that source code and distribute the result (as any binary distribution does), you've just violated the GPL's 'no additional restrictions' clause.