[llvm-dev] RFC #2: Improving license & patent issues in the LLVM community

[David Chisnall via llvm-dev]

On 3 Nov 2016, at 14:50, Daniel Berlin <dberlin at dberlin.org> wrote:
>> In particular, various corporate lawyers were worried about this scenario that neuters defensive patents):
>  Lawyers see risk everywhere, so i'll just go with "various corporate lawyers are concerned about everything, ever".
> Clearly, for the majority, the prediction that those concerns would not outweigh the desire to use the software came true.

Without a CLA, I don’t see anything in the Apache 2 license that prevents this scenario.  If I want to use an Apple or Google patent, is it enough for me to commit some code that infringes it to LLVM and watch them lose their license to distribute LLVM if they try to sue me?  If not, what prevents this?

>> I’m also not completely convinced that the exemption to 4.d actually does what we’d need with respect to libc++.  In FreeBSD, we compile most packages with clang, but a few with gcc (and all with gcc on a couple of architectures).  We use libc++ for all C++ code, irrespective of how it was compiled.  When we are not compiling with clang[1], we’d still be covered by 4.d and so every package that uses C++ (a few thousand) would need to include the attribution.  Updating all of this and ensuring compliance would probably block us from updating libc++ for about a year after the license switch.  At the very least, I think this exemption needs a lot more explicit clarification. 
> 
> FWIW, the consensus on the open source legal counsel mailing lists i belong to, when they saw it (IE on the public mailing lists), was basically that it looked great and others want to use it.
> 
> Not a single person (and the list includes many zealous people of all kinds) mentioned they believed there were any serious issues achieving it's goals, or that it needed further clarifications.

For clarification: Is my interpretation incorrect?  If I compile code with GCC, which uses templates from libc++ headers and therefore results in libc++ code being inserted into the resulting binary, am I required to abide by clause 4 of the Apache license and include the libc++ attribution?

I’m willing to accept that I’m wrong here if you can point out why, but if I’m not then this is going to require that we audit around 30,000 software packages that we distribute, which is going to cause a lot of pain and suffering for us (to the extent that it would probably mean that we’d start actively looking for an alternative to libc++).

David