mxnet-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Tianqi Chen <tqc...@cs.washington.edu>
Subject Re: Severe legal issues with releases on repository.apache.org
Date Sun, 10 May 2020 05:50:01 GMT
Seems the conclusion so far is only release source through apache and
release the binary builds as third party(as a different community, a
company or individual)

TQ

On Sat, May 9, 2020 at 7:39 PM Lausen, Leonard <lausen@amazon.com.invalid>
wrote:

> They actually statically link some libraries such as libcudnn. But even
> removing
> that won't necessarily help. Compiling with nvcc and including cuda headers
> during compilation incorporates parts of the Cuda SDK into libmxnet.so, and
> makes it per the formulation of Cuda EULA subject to certain
> ASF-incompatible
> limitations.
>
> For more background on licensing of binaries, you can check the FAQ of GCC
> [1]:
>
> > [...] if these libraries were simply distributed only under the terms of
> the
> > GPL, all the object code that GCC produces would have to be distributed
> under
> > the same terms. [...] Therefore, these libraries have always had license
> > exceptions that allow people to distribute the object code GCC produces
> under
> > any license.
>
> Maybe NVidia is willing to grant a similar exception, so that libmxnet.so
> can
> remain Apache Licensed even containing code compiled with nvcc, but
> currently
> there's no such exception.
>
> Best regards
> Leonard
>
> [1]: https://www.gnu.org/licenses/gcc-exception-3.1-faq.html
>
>
> On Fri, 2020-05-08 at 22:48 -0700, Chris Olivier wrote:
> > do the gpu builds actually include the nvidia cuda libraries such as
> > libcudart.so or just link to them and expect them to be on the machine?
> >
> >
> > On Fri, May 8, 2020 at 1:50 PM Lausen, Leonard <lausen@amazon.com.invalid
> >
> > wrote:
> >
> > > Hi all,
> > >
> > > repository.apache.org is an official Apache Software Foundation
> release
> > > channel
> > > and the MXNet project has been publishing convenience binaries via that
> > > channel
> > > since quite a while. Unfortunately it appears that no-one has
> initiated a
> > > license review of these convenience binaries, and unfortunately they
> are
> > > incompatible with the ASF requirements. They should have never been
> > > uploaded.
> > >
> > > I recently reached out to Legal to inquire about this issue [1] and
> Legal
> > > team
> > > recommends to remedy the situation ASAP.
> > >
> > > Two issues, out of the potentially larger set of all issues.
> > >
> > > 1) There are GPU builds (mxnet-full_2.11-linux-x86_64-gpu)
> incorporating
> > > the
> > > CUDA SDK and possibly cuDNN, placing the resulting libmxnet.so under
> the
> > > CUDA
> > > EULA and cuDNN SLA. This EULA and SLA contain many restrictions, making
> > > them
> > > Category-X licenses [1]. No Apache project must under any circumstance
> > > redistribute such binaries.
> > >
> > > 2) All builds redistribute libgfortran.so, which is part of the GNU
> Fortran
> > > compiler, part of GCC and subject to the GPL. The GPL is also a
> Category-X
> > > license and the same restrictions apply.
> > >
> > > I see the following two potential remedies:
> > >
> > > 1) Ask the Infra team to delete all MXNet releases on
> > > repository.apache.org
> > >
> > > 2) Ask the Infra team to delete all MXNet GPU releases on
> > > repository.apache.org
> > > and provide replacement releases without libgfortran.so and other
> > > potentially
> > > Category-X files (I found libmkl_ml.so in one of the JARs..)
> > >
> > > If no-one steps up to do 2) or no-one suggests a better option, I
> > > recommend we
> > > go for option 1). Let's start discussing the options. Once discussion
> has
> > > settled, I'll initiate a lazy consensus or vote session.
> > >
> > > Note that these license rules apply to MXNet as part of the ASF.
> > > Third-parties
> > > (individuals or companies) may redistribute binary builds of MXNet
> > > incorporating
> > > Category-X licenses, IF they are appropriately labeled and no ASF
> > > trademarks or
> > > branding is infringed.
> > >
> > > As for the GPU builds, NVidia or Amazon may be willing to provide
> > > third-party
> > > GPU builds. I opened another ticket with Jira to see if such
> third-parties
> > > could
> > > provide them and what considerations would need to be taken into
> account.
> > > [3]
> > > This is similar to the Pypi releases, are third-party releases and not
> > > performed
> > > by the MXNet project (though also for them some legal questions remain
> > > open; in
> > > particular our Website does not disclaim that these are third-party
> > > releases).
> > >
> > > Best regards
> > > Leonard
> > >
> > > [1]: https://issues.apache.org/jira/browse/LEGAL-516
> > > [2]: https://www.apache.org/legal/resolved.html#category-x
> > > [3]: https://issues.apache.org/jira/browse/LEGAL-515
> > >
>

Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message