[ANSWERED] Legal rammifications of proprietary software in the AUR

ectospasm · 2023-11-30 02:01:12

ANSWER: So AUR packages (PKGBUILDs) are recipes (scripts) for installing software in Arch Linux; they would only infringe on copyright if they employ an unauthorized method to install a package, violating its official license. And any kind of extra disclaimer would not indemnify the Arch Linux community if there was an AUR package which infringed on a software developer's copyright in this way; we could remove said PKGBUILD, and prevent its upload in the future.

Someone posted a prospective PKGBUILD of proprietary software, and it has a strict, custom proprietary license. In the thread I raised the question of the Arch Linux community's liability in such circumstances. I am definitely not an attorney, but I began asking the question if the copyright holders of these packages wanted to take legal action against the Arch community, what could happen? It became off-topic (completely my fault), so this topic is an attempt to move the discussion to the proper place.

Of course, there is plenty of proprietary software installable from the AUR and no entity has taken legal action thus far. And honestly, if one ever did the extent of it would likely be a cease and desist letter and nothing more; the Arch staff would simply remove the PKGBUILD and move on. Many of these packages are frontends to subscription services, so I'd imagine the more platforms the software is on the stronger their revenue stream can be.

My worry is if a copyright holder decides to take further action, beyond a cease and desist letter. What happens if the Arch staff takes too long to remove the PKGBUILD, or the maintainer of the PKGBUILD (or other Arch volunteer) makes an inappropriate comment towards the copyright holder and they decide to take further action, out of spite or simply to make an example of the Arch community?

It's been mentioned the AUR disclaimer should be enough. But the way I read it is, content in the AUR is not vetted for performance or security issues, users install PKGBUILDs at their own risk. This could imply that the Arch community is not responsible for it, but without explicitly building that into the disclaimer I fear could lead to a copyright holder decidely not taking that as an implication, and taking legal action.

I'm probably overthinking this way too much. There doesn't seem to be any precedent for this kind of legal action. And typically these kinds of suits are brought because the defendant(s) have deep pockets, which I doubt characterizes the Arch community as a whole.
But I love the Arch community, and I wouldn't want something stupid like this jeopardizing the whole project.

Last edited by ectospasm (2023-12-03 15:03:44)

Trilby · 2023-11-30 02:34:13

This is all a moot point. Technically anyone can sue anyone for any reason at any time - the question is whether there'd be any grounds for which the court to take the suit seriously, and here there isn't. As noted in the other thread, the license prohibits redistribution, but no redistribution is happening. So what's the concern?

ectospasm · 2023-11-30 03:15:08

Yeah, I guess you're right. If an entity wanted to file suit, the onus is on them to demonstrate that Arch is redistributing software against the license, which they cannot do under these circumstances. Unless the package moves into extra, which I thought someone mentioned is the case for Discord and Spotify, among others.

But those services would likely benefit from their software being on as many platforms as possible, so they have a vested interest in not stopping the redistribution. And copyright is not the same as trademark; you don't lose copyright if you fail to defend it like you do if you fail to defend trademark, at least is my understanding.

Head_on_a_Stick · 2023-11-30 05:56:43

Surely any legal action would be directed towards the Maintainer?

seth · 2023-11-30 07:49:33

If we spin this nonsense on, no. The AUR could be legally forced to remove the PKGBUILD and prevent any re-upload, in doubt to ban the uploader.
And there might be a legal requirement to provide identifying data about the maintainer (login details, IP adresses and access timestamps)

But as was pointed out multiple times: there's no grounds for that. Nothing is redistributed. The AUR is like a hyperspecific search-engine with a special protocol for the results.
A real problem could eg. be licence keys or (more flimsily) "secret" urls in the PKGBUILD etc. but that's not the case here.

Awebb · 2023-11-30 09:10:28

One could argue that the AUR is just a collection of installation instructions written in a universally understood language (BASH).

Lone_Wolf · 2023-11-30 10:39:25

Another question any court will have to deal with is : does this court have jurisdiction to rule on this case ?

Archlinux founder judd vinet is a canadian citizen, Aaron Griffin probably a USA citizen while current leader Levente Polyak seems to be a hungarian that lives in germany.

Archlinux finances are dealt with by a US company, while AUR is hosted in germany .

Which laws would apply ?

c00ter · 2023-11-30 14:12:03

That reminds one of the old joke, "if a plane crashed at the Canada/U.S. border, where would they bury the survivors?"

It's a specious argument.

Trilby · 2023-11-30 14:31:39

I was about to note in regards to the discord comment, that I have never been aware of an attempt of arch devs / packagers to think they could "get away with" small infractions and therefore go ahead with them. If a package's license would not allow redistribution, then it should certainly not be in our repos - regardless of whether anyone thought it was likely for a violation to result in legal issues.

However, I just glanced at discord's license and it does seem to indicate that redistribution is not allowed. I'd not be too surprised if the packager had been in contact with someone at discord and were given additional permission beyond what is documented in the license. But 1) this could be worth confirming if you are so inclined, and 2) that special permission should be documented in the package (i.e., an additional LICENSE file). So from a roughly 1 minute exploration, you may have grounds for concern with discord being in the repos - but that's a completely different situation than an AUR package.

Or another way of saying this - if you feel our community may be violating any laws, by all means raise every red flag you can. I'm a stickler for copyright protections and I've been the squeeky wheel about a package that occasionally comes back to the AUR as it's sole purpose was to be used in violating the copyright of other content. I was adamant that the likelihood of getting "caught" was not relevant, but rather that we as a community have it as part of our code(s) of conduct that we will not allow / endorse illegal activity.

So I would never minimize an illegal use of software based on the likelihood of getting caught or of the copyright owner taking any action. If it's illegal, it's illegal. But then if it's not, it's not: and that is the case for the AUR packages in this discussion.

(edit: I've been writing too many reports lately. I just used latex instead of bbcode tags)

Last edited by Trilby (2023-11-30 14:37:40)

mpan · 2023-11-30 14:50:46

The Arch Linux discord package is licensed with additional permission.

As for AUR, we may imagine many hypothetical scenarios. But the subject of the current situation has been exhausted already:

Nothing is being redistributed in AUR.
AUR entries are not made by the Arch project.

AUR is like a forum, at which users post their opinions on building pacman-compatible packages. These opinions are expressed in a format, which can be automatically processed, but that doesn’t really change their nature. If I told you here, how you can install program ProprietaryNonredistributable-4.5, would I infringe the license regarding redistribution?

V1del · 2023-11-30 20:45:54

Moving to AUR discussions

ectospasm · 2023-12-01 02:55:49

All of these are very good points. And I think the matter is settled, at least in my mind, except for one thing: I am still concerned that the AUR disclaimer doesn't explicitly say that the Arch Linux project/community is not responsible for submissions to the AUR. It's implied, but not explicit. It wouldn't have to be a long paragraph, or page of legalese; just a simple short sentence stating that Arch is not responsible for any of the content in the AUR.

Trilby · 2023-12-01 03:13:54

ectospasm wrote:

the AUR disclaimer doesn't explicitly say that the Arch Linux project/community is not responsible for submissions to the AUR.

Do you have any reason to believe any such "disclaimer" would have any legal meaning? Publishing a claim that one is not responsible changes nothing of their liability. If the "community" could be held responsible for some legal infraction, no get out of jail free card would be honored just because it was published on the website.

mpan · 2023-12-01 03:37:59

ectospasm wrote:

(…) the AUR disclaimer doesn't explicitly say that the Arch Linux project/community is not responsible for submissions to the AUR (…)

It is plaintiff’s task to prove they should receive a judgement against the defendant, not the opposite.

seth · 2023-12-01 08:19:09

And to cite recent precedence:

The clown wrote:

I have a clause in there that says, ‘Don’t believe the statement. Go out and do your own work.’ This statement is ‘worthless.’ It means nothing, … you’re supposed to pay no credence to what we say whatsoever.

The judge wrote:

The ‘worthless clause’ does not say what defendants say it says, does not rise to the level of an enforceable disclaimer, and cannot be used to insulate fraud … the defendants’ reliance on these ‘worthless’ disclaimers is worthless.

Trilby · 2023-12-01 14:29:32

BTW, I just got a bumper sticker that says "The driver is not responsible for the speed of this vehicle". Let's see if that gets me out of any speeding tickets. Surely, police officers would be able to read that before they pulled me over. It's pretty big ... hard to miss.

Joking aside, superficially similar disclaimers (to what was proposed in an earlier post) can have meaning when they are part of a terms of service or privacy policy or the like and the potential plaintiffs in a future proceeding agree to the terms of the disclaimer (as a condition of using a site or service). But one party cannot unilaterally just place a statement on their website absolving them of any future wrong-doing.

Last edited by Trilby (2023-12-01 14:39:37)

ectospasm · 2023-12-01 14:43:47

This is the kind of question I would ask of my legal counsel, if I had one in this domain. Is there anything that would indemnify the community if a copyright holder wanted to take legal action against Arch for something in the AUR?

Trilby · 2023-12-01 14:55:31

ectospasm wrote:

Is there anything that would indemnify the community if a copyright holder wanted to take legal action against Arch for something in the AUR?

No more than there is anything that would indemnify the community if a victim of a hate crime wanted to take legal action against Arch for something than an arch user did online. There is simply no grounds for a case against "Arch".

A PKGBUILD is a recipe. Recipe's are not subject to copyright. Period.

The only concern would be if instead of submitting a PKGBUILD to the AUR, someone posted the binary executable of software that was not licensed for redistribution. Technically, the owner(s) of the aur server could be liable for that violation. But no disclaimer would affect that in any way. And realistically, a lawsuit would not go anywhere unless the owner(s) of the server were informed of the issue and took no action to remedy it. But still, a disclaimer on the wiki will still have no meaning.

And this later concern is not just for the AUR, but any site on which users can post content. This forum is a good example.

Last edited by Trilby (2023-12-01 14:56:19)

mpan · 2023-12-02 02:01:52

Note added: this was addressed to ectospasm.

The legal interpretation has been nudged in the past in that direction. First making sharing links to or information about unauthorized copies equal to copyright infringement, then merely facilitating exchange of such information. Anybody may sue any other party for anything they wish and, unless the court finds the plaintiff has no standing or (depending on jurisdiction) it’s a frivolous litigation, they have a chance of making the change. That includes claiming that, by hosting a PKGBUILD, the Arch project is infringing their intellectual property.

But you must be aware, that words “may” in this context is the same as in that I may initiate a lawsuit against the Arch project for “letting you write on the forum, because word ‘ectospasm’ promotes demonic cults”. And people may, and did, sue imaginary entities — like gods — too.

Last edited by mpan (2023-12-02 15:49:27)

Trilby · 2023-12-02 02:34:20

Okay, I would like to see the forum disclaimer:

forum disclaimer wrote:

The Arch Linux community is not responsible for any demonic possession of yourself, your family, or your pets that may result from you reading the names of other users. The aforementioned disclaimer applies not only to reading such names quietly or aloud, but also extends to the reading of the names multiple times in rapid succession while looking in a mirror.

And as they say, (demon) possession is nine tenths of the law.

Last edited by Trilby (2023-12-02 02:34:52)

mpan · 2023-12-02 15:48:36

Just to be clear: that was addressed to ectospasm. I added a note, so nobody is confused.

Last edited by mpan (2023-12-02 15:49:37)

ectospasm · 2023-12-03 14:56:38

Heheheh, OK. So AUR packages (PKGBUILDs) are recipes (scripts) for installing software in Arch Linux; they would only infringe on copyright if they employ an unauthorized method to install a package, violating its official license. And any kind of extra disclaimer would not indemnify the Arch Linux community if there was an AUR package which infringed on a software developer's copyright in this way; we could remove said PKGBUILD, and prevent its upload in the future.

I always read my nickname as relating to ghosts, not demons. If my wife thought it were associated with demons, she'd likely have me change it. (-;

Arch Linux

#1 2023-11-30 02:01:12

[ANSWERED] Legal rammifications of proprietary software in the AUR

#2 2023-11-30 02:34:13

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#3 2023-11-30 03:15:08

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#4 2023-11-30 05:56:43

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#5 2023-11-30 07:49:33

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#6 2023-11-30 09:10:28

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#7 2023-11-30 10:39:25

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#8 2023-11-30 14:12:03

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#9 2023-11-30 14:31:39

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#10 2023-11-30 14:50:46

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#11 2023-11-30 20:45:54

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#12 2023-12-01 02:55:49

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#13 2023-12-01 03:13:54

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#14 2023-12-01 03:37:59

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#15 2023-12-01 08:19:09

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#16 2023-12-01 14:29:32

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#17 2023-12-01 14:43:47

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#18 2023-12-01 14:55:31

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#19 2023-12-02 02:01:52

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#20 2023-12-02 02:34:20

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#21 2023-12-02 15:48:36

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

#22 2023-12-03 14:56:38

Re: [ANSWERED] Legal rammifications of proprietary software in the AUR

Board footer