#357 Possible GPL-2.0-or-later code in backend code

[stefan6419846]

In https://sourceforge.net/p/zint/code/ci/master/tree/backend/dmatrix.c, there are references to external code, where a search (thanks to https://github.com/rdoeffinger/iec16022/blob/main/CREDITS) reveals that the original files are available from https://web.archive.org/web/20070529010717/http://aa.gg/free/

For the specific libzint file, the origin seems to be https://web.archive.org/web/20060211011559/http://aa.gg/free/iec16022ecc200.c The corresponding header states GPL-2.0-or-later, which leads to the backend/library being under the "viral" GPL license as well.

[Git Lost]

Hi Stefan, great detective work!

I think "dmatrix.c" is ok, as the only remnants of "iec16022ecc200.c" left are the placement routines, but these are line-for-line the same, apart from variable renaming, as the code published in Annex F of ISO/IEC 16022:2006, so are covered by ISO copyright requirements, not GPL.

"reedsol.c" though would seem to be an issue, as it does differ a fair bit from the routine published in Annex E of the standard.

One way out of this would be to contact Andrews & Arnold Ltd. and see if they would agree to a licensing change from GPL to BSD. Also it seems that the code as brought into zint came second-hand from https://web.archive.org/web/20080611142656/http://datenfreihafen.org/projects/iec16022.html, so Stefan Schmidt would need to be contacted also.

Failing that, I think only "reedsol.c" needs to be replaced.

I'm working on getting the font stuff done so it may be a couple of weeks before I get back to this.

Thanks very much for pointing this out, regards, Martin

[Git Lost]

Good news!

Contacted Andrews & Arnold Ltd. and they (the Rev Adrian Kennard) very promptly and kindly agreed to additionally re-license their contributions under BSD-3-clause (see commit [78a70f]).

So I think everything's good now (the only difference between the datenfreihafen.org versions and the originals is whitespace/formatting so this intermediation can be ignored).

Thanks again Stefan, regards, Martin

[Harald Oehlmann]

To my knowledge, Robin had contacted all authors to change the licence.
He forgot perhaps just to edit the file.
Harald

[Git Lost]

Hi Harald, yes, most were contacted judging from the mail archive but I don't think Andrews & Arnold were. Anyway, that's solved.

The only other one not contacted that I know of is the Grandzebu (see ticket #147), which has still to be resolved. Judging from his website he looks to be a GPL advocate so probably not amenable to a licence change but I may try anyway.

(Edit: fix ticket #147 link)

[stefan6419846]

Thanks for the quick reply. I think I stopped the in-depth review after stumbling upon the first two possible GPL issues, especially in datamatrix.c and the pdf417.c files.

It seems like compared to the copy I have reviewed (as part of zxing-cpp), the Unicode license for the encodings has been added in the meantime.

Besides this, the following aspects might be worth to consider as well:

• raster.c has the method draw_mp_circle, which is attributed as GFDL-1.2. Having a documentation license used for source code can be problematic.
• raster.c has the method plot_hexline, which is attributed as CC-BY-SA-3.0. This can be problematic for source code as well. With the references given by Wikipedia it seems like the original source is https://zingl.github.io/bresenham.html, leading to https://github.com/zingl/Bresenham under MIT license.

[Git Lost]

Thanks Stefan, fixed the plot_hexline() attribution to be as you say, and also changed draw_mp_circle() to use code from the same source and same attribution (so the GFDL-1.2 attribution is gone), with commit [92e940].

The file "debian/copyright" is my attempt at a comprehensive list of licences and attributions used in Zint (based on the Debian upstream one). This was done (see ticket #147) after the release of the zint 2.16.0 version used by zxing-cpp, and involved various additions and fixes. It was also when the "pdf417.c" GPL2.0 issue was discovered.

Whether there is an issue with "pdf417.c" is debatable, given the amount of modifications that have taken place. However to be safe I probably will rewrite that stuff, but not for a couple of weeks.

Any reports of futher issues you find if you continue your in-depth review would be most welcome, thanks.