mxnet-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Lausen, Leonard" <lau...@amazon.com.INVALID>
Subject Re: Severe legal issues with releases on repository.apache.org
Date Sun, 10 May 2020 02:39:06 GMT
They actually statically link some libraries such as libcudnn. But even removing
that won't necessarily help. Compiling with nvcc and including cuda headers
during compilation incorporates parts of the Cuda SDK into libmxnet.so, and
makes it per the formulation of Cuda EULA subject to certain ASF-incompatible
limitations.

For more background on licensing of binaries, you can check the FAQ of GCC [1]:

> [...] if these libraries were simply distributed only under the terms of the 
> GPL, all the object code that GCC produces would have to be distributed under 
> the same terms. [...] Therefore, these libraries have always had license 
> exceptions that allow people to distribute the object code GCC produces under 
> any license. 

Maybe NVidia is willing to grant a similar exception, so that libmxnet.so can
remain Apache Licensed even containing code compiled with nvcc, but currently
there's no such exception.

Best regards
Leonard

[1]: https://www.gnu.org/licenses/gcc-exception-3.1-faq.html


On Fri, 2020-05-08 at 22:48 -0700, Chris Olivier wrote:
> do the gpu builds actually include the nvidia cuda libraries such as
> libcudart.so or just link to them and expect them to be on the machine?
> 
> 
> On Fri, May 8, 2020 at 1:50 PM Lausen, Leonard <lausen@amazon.com.invalid>
> wrote:
> 
> > Hi all,
> > 
> > repository.apache.org is an official Apache Software Foundation release
> > channel
> > and the MXNet project has been publishing convenience binaries via that
> > channel
> > since quite a while. Unfortunately it appears that no-one has initiated a
> > license review of these convenience binaries, and unfortunately they are
> > incompatible with the ASF requirements. They should have never been
> > uploaded.
> > 
> > I recently reached out to Legal to inquire about this issue [1] and Legal
> > team
> > recommends to remedy the situation ASAP.
> > 
> > Two issues, out of the potentially larger set of all issues.
> > 
> > 1) There are GPU builds (mxnet-full_2.11-linux-x86_64-gpu) incorporating
> > the
> > CUDA SDK and possibly cuDNN, placing the resulting libmxnet.so under the
> > CUDA
> > EULA and cuDNN SLA. This EULA and SLA contain many restrictions, making
> > them
> > Category-X licenses [1]. No Apache project must under any circumstance
> > redistribute such binaries.
> > 
> > 2) All builds redistribute libgfortran.so, which is part of the GNU Fortran
> > compiler, part of GCC and subject to the GPL. The GPL is also a Category-X
> > license and the same restrictions apply.
> > 
> > I see the following two potential remedies:
> > 
> > 1) Ask the Infra team to delete all MXNet releases on
> > repository.apache.org
> > 
> > 2) Ask the Infra team to delete all MXNet GPU releases on
> > repository.apache.org
> > and provide replacement releases without libgfortran.so and other
> > potentially
> > Category-X files (I found libmkl_ml.so in one of the JARs..)
> > 
> > If no-one steps up to do 2) or no-one suggests a better option, I
> > recommend we
> > go for option 1). Let's start discussing the options. Once discussion has
> > settled, I'll initiate a lazy consensus or vote session.
> > 
> > Note that these license rules apply to MXNet as part of the ASF.
> > Third-parties
> > (individuals or companies) may redistribute binary builds of MXNet
> > incorporating
> > Category-X licenses, IF they are appropriately labeled and no ASF
> > trademarks or
> > branding is infringed.
> > 
> > As for the GPU builds, NVidia or Amazon may be willing to provide
> > third-party
> > GPU builds. I opened another ticket with Jira to see if such third-parties
> > could
> > provide them and what considerations would need to be taken into account.
> > [3]
> > This is similar to the Pypi releases, are third-party releases and not
> > performed
> > by the MXNet project (though also for them some legal questions remain
> > open; in
> > particular our Website does not disclaim that these are third-party
> > releases).
> > 
> > Best regards
> > Leonard
> > 
> > [1]: https://issues.apache.org/jira/browse/LEGAL-516
> > [2]: https://www.apache.org/legal/resolved.html#category-x
> > [3]: https://issues.apache.org/jira/browse/LEGAL-515
> > 
Mime
View raw message