libsignal-protocol-java is AGPLv3+ licensed.

[rubdos]

head java/src/main/java/org/whispersystems/signalservice/internal/contacts/entities/RemoteAttestationRequest.java

/*
 * Copyright (C) 2017 Open Whisper Systems
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.

$ rg AGPL
README.md
120:Licensed under the AGPLv3: https://www.gnu.org/licenses/agpl-3.0.html

Given that I'm building very much parallel to that library, and I'm using the .proto files (those could be argued under regular GPLv3+), I think this repo might have to be AGPLv3+ too. I'd have to look into the implications to the project that I am building (I'm rewriting an application by @aebruno that's under GPLv3), but I better get this conversation going, I suppose.

[Michael-F-Bryan]

I think it's reasonable enough to make this project GPLv3/AGPLv3.

Most people would consider this a derived project, seeing as we're using their *.proto files and using a lot of constructs/concepts from the Java version.

[rubdos]

Shouldn't a derived project fall under AGPLv3(+) then, instead of GPLv3/AGPLv3?

[Michael-F-Bryan]

Sorry, when I wrote "GPLv3/AGPLv3" I meant "GPLv3 or AGPLv3, whichever is most applicable"... I probably should have been clearer there 😛

That said, the libsignal-service-java repository as a whole is licensed as GPLv3, so shouldn't we use that? What's the normal course of action when the one of the files your work is derived from has a different license to the rest of the repository?

[rubdos]

That said, the libsignal-service-java repository as a whole is licensed as GPLv3

I don't think so. Look in the README, all the way down at # License. In general, the LICENSE file does not necessarily reflect the license for all files in the repo... Should I create an issue back there, for clarification?

Also, if you grep through their repository for "Affero", there are more matches:

rsmet on nas in libsignal-service-java on  master [📝] via ☕ v1.8.0
❯ rg Affero                                                                                                                                Fri 10 Jul 2020 07:54:01 AM UTC
LICENSE
552:  13. Use with the GNU Affero General Public License.
556:under version 3 of the GNU Affero General Public License into a single
559:but the special requirements of the GNU Affero General Public License,

java/src/main/java/org/whispersystems/signalservice/internal/contacts/entities/DiscoveryResponse.java
5: * it under the terms of the GNU Affero General Public License as published by
12: * GNU Affero General Public License for more details.
14: * You should have received a copy of the GNU Affero General Public License

java/src/main/java/org/whispersystems/signalservice/internal/contacts/entities/RemoteAttestationRequest.java
5: * it under the terms of the GNU Affero General Public License as published by
12: * GNU Affero General Public License for more details.
14: * You should have received a copy of the GNU Affero General Public License

java/src/main/java/org/whispersystems/signalservice/internal/contacts/entities/DiscoveryRequest.java
5: * it under the terms of the GNU Affero General Public License as published by
12: * GNU Affero General Public License for more details.
14: * You should have received a copy of the GNU Affero General Public License

java/src/main/java/org/whispersystems/signalservice/internal/contacts/entities/RemoteAttestationResponse.java
5: * it under the terms of the GNU Affero General Public License as published by
12: * GNU Affero General Public License for more details.
14: * You should have received a copy of the GNU Affero General Public License

I have not used any of the above files. Their README claims however that the whole repo is AGPLv3(+). Maybe this needs some clarification at their side.

What's the normal course of action when the one of the files your work is derived from has a different license to the rest of the repository?

Depends on the way you use it. I think, but IANAL, that we make a derived work from them in most senses of that statement. Assuming (and that's disputable, as you correctly point out) that the .proto's are AGPLv3+, and we pull them through protobuf, I think we technically may be "linking" against a binary version?

If we fall under "derived work", the whole should be under AGPLv3(+). If we don't, it's possibly disputable, but the most safe option would be AGPLv3(+) too, I guess.

[rubdos]

Ah look, we're not alone: signalapp/libsignal-service-java#42

I've taken a precaution in Whisperfish itself, and started licensing that as combined work under AGPLv3+ as of 0.6.0-alpha.1... That shouldn't influence the decision here though.

[gferon]

Since our project has been re-licensed, I'll go ahead and close this issue!

[rubdos]

Maybe then actually close it :-D