298916 - check that MoFo can redistribute VC7/VC7.1 libs with product releases

Status: RESOLVED INVALID

(Firefox Build System :: General, defect)

Description

[Chase Phillips]

Breaking this requirement out of bug 298066 so it has greater visibility as a
dependency of that bug.  In it, Gerv says:

  And apart from that issue, we still need to check we can redistribute the VC7
  libs at all. I will try and do that soon; anyone else's views (and links to the
  relevant EULAs) would also be appreciated.

Comment 1

[Gervase Markham [:gerv]]

Am I correct in thinking that VC 7 comes in Visual Studio .NET 2002, and VC 7.1
comes in Visual Studio .NET 2003?

Microsoft EULAs are always hard to find on the net. It would be ideal if someone
with a copy of VC 6 and VC 7 were to go Googling and try and find a page with
text which matched the EULA they have as part of their installation or package.

This looks like it may be the VC 7 EULA:
http://lab.msdn.microsoft.com/vs2005/eula.aspx?id=B3F2A268-E286-4abf-A0C7-5474914F1FFF

If it is, it means we can't redistribute the VC 7 libs. 

We can't distribute "MS Samples" (which seems an odd term to use) in conjection
with "Identified Software". Identified Software includes any software that
requires as a condition of its use, modification and/or distribution, that any
other software incorporated into, derived from or distributed with such software
must also be (1) disclosed or distributed in source code form; (2) licensed for
the purpose of making derivative works; or (3) redistributable at no charge.

Extracting clauses from the above to produce an example, the MPL requires that
other software derived from itself be licensed for the purpose of making
(further) derivative works. Therefore, it is Identified Software, and the VC 7
libs cannot be distributed with it.

In other words, Microsoft has poisoned the well for free software on Windows.

Gerv

Comment 2

[Gervase Markham [:gerv]]

Comment #1 might not be correct - I may have found the wrong EULA. I'm gathering
them up and analysing them all - see
http://weblogs.mozillazine.org/gerv/archives/008472.html

Gerv

Comment 3

[Gervase Markham [:gerv]]

OK. There's still a small amount of confusion here. And note that this is all
barrack-room legal analysis; I am not a lawyer.

Points of confusion:

a) It seems that the EULA and redist.txt files from VC 7 and VC 7.1 are
identical, even down to redist.txt saying msvcr70.dll instead of msvcr71.dll.
This seems a bit odd. Can anyone confirm or deny this?

b) The original bug report said msvc7[01].dll, but there is no such file listed
in redist.txt - only msvcr70.dll, msvci70.dll and msvcp70.dll (i.e. with an 'r',
an 'i' or a 'p').

If I am in fact looking at the right documents, then we can redistribute the VC
7.1 or VC 7 lib msvcr70.dll under the Firefox EULA if we do the following:

- Redistribute it as the VC_CRT.msm merge module and not in any other way (2.3)

- Tweak the Firefox EULA to make it clear that we are distributing them only for
use on Windows platforms - because of 3.1 a) iii)'s requirements applying to 3.1
a) ii). (I'm not completely sure about this one; it's hard to say what 3.1 a)
ii) actually requires.)

In saying this, I am defining a "distributor" in 3.1 a) as anyone who
distributes Firefox, and an end-user customer as anyone who doesn't. :-)

However, post-relicensing, it would not be possible to distribute Firefox
binaries licensed under the GPL with these libs bundled. This is because of 3.1
b) ii), which forbids their distribution with code which would bring them under
its licence, and the fact that the GPL as applied to mozilla.org code doesn't
have a linking exception for the MS C libraries. As we are distributing the
modules, it's fairly clear that we can't take advantage of the GPL's "normally
shipped with the OS" clause.

It's also not possible to distribute binaries licensed completely under the LGPL
or the MPL (as our nightlies are, or have been in the past) with these libs
bundled, for similar reasons. The C runtime licence requires them to be
distributed under a EULA equally or more restrictive than that of the C runtimes
(3.1 a) iii); I suspect the MPL and LGPL don't meet that criteria. The binaries
would have to be partly licensed under the LGPL or MPL, and partly licensed
under another EULA which met the conditions. For the MPL, you'd probably end up
just using the "alternative binary licence" clause to save hassle; for the LGPL,
you'd need some sort of explanation of which licenses covered which bits of
shipped code. <sigh>

The situation for the VC 6 libs we are currently using is, by some readings,
actually worse. :-(

Which versions of MSVCx.dll come with which versions of Windows?

Gerv

Comment 4

[Daniel Veditz [:dveditz]]

Attachment: The msvs 2003 English EULA

Comment 5

[Daniel Veditz [:dveditz]]

Attachment: redist.txt from msvs 2003

Comment 6

[Daniel Veditz [:dveditz]]

I don't see the problem given the EULA on the binary versions of Firefox. the
VC71 versions actually look better to me: vc6 says you can't allow end users to
redistribute full stop, this one says your end users can further redistribute if
it's done so as part of your licensed software.

We can't cause the redistributed bits to come under an "Excluded License", but
we don't. If someone takes firefox source and wants to recompile and ship under
the GPL they can't unless they get a different compiler, but that doesn't have
anything to do with our binary distributions.

Comment 7

[Gervase Markham [:gerv]]

dveditz: is this still a live issue?

Gerv

Comment 8

[Benjamin Smedberg]

We got legal signoff on the VC8 redist, and we're not using VC7 in production anywhere.