Replace MarchingSquaresJS in turf-isolines and turf-isobands to eliminate license ambiguities

[alynn-coefficient]

Version: 7.1.0

turf-isolines depends on marchingsquares, which is licensed under the GNU Affero General Public License. As a derivative work, turf-isolines itself must be compatibly licensed under the GPL or AGPL by the terms of the marchingsquares license – currently it purports to be under the MIT license.

Either it should be relicensed under GPL or AGPL, or the dependency on marchingsquares should be removed and replaced by something permissively licensed.

The same applies to turf-isobands.

[smallsaucepan]

Thanks for pointing this out @alynn-coefficient. It wasn't something I was familiar with. Looking at the license packaged with marchingsquares, it includes the following paragraph:

As additional permission under GNU Affero General Public License version 3
section 7, third-party projects (personal or commercial) may distribute,
include, or link against UNMODIFIED VERSIONS of MarchingSquaresJS without the
requirement that said third-party project for that reason alone becomes
subject to any requirement of the GNU Affero General Public License version 3.
Any modifications to MarchingSquaresJS, however, must be shared with the public
and made available.

And then further down restates this a different way:

allows you to distribute UNMODIFIED VERSIONS of MarchingSquaresJS under any license as long as this license notice is included

That reads to me (admittedly not a lawyer) like marchingsquares is specifically excusing third party projects from having to also be bound by the GPL. Would you interpret that a different way?

[smallsaucepan]

Haven't heard back on this so will close. If anyone has a counterpoint or more detail on actions we need to take please reopen. Appreciate the effort put in to making sure Turf is doing the right thing.

[Cynaeon]

I don't really have a solution or know much about license stuff, but just voicing my concern that our client is very strict about licenses in our apps and this issue is preventing us from updating from turf 6 to 7. The issue being that we are not allowed to use packages that use "AGPL" license.

[nicorikken]

@smallsaucepan the AGPL forbids modifying the license text, so an additional clause by MarchingSquaresJS cannot be accepted. Modification of the license text is limited in scope, see section 7.

As it stands MarchingSquaresJS is still bound by the terms of the AGPL, therefore so is turf-isolines.

Please arrange a different license or use a different library. As it stands we consider Turfjs to be AGPL.

[smallsaucepan]

Thanks for running through that @nicorikken. From our point of view we've taken the license on in good faith, and are adhering to the intent of the author.

Unfortunately for everyone, they chose to express that intent with a license that is at best ambiguous. In hindsight the LGPL (for example) might have achieved the same outcome with fewer steps, and fewer unintended consequences.

What's undeniable is that no one seems very fond of the AGPL, and it's likely holding people back from adopting Turf. And adopting Turf is something we very much want to support.

With that in mind, we are going to make it a priority to replace the MarchingSquaresJS code with something that can be inarguably published under Turf's existing MIT license.

If that can't be done in a timely manner, we'll consider more drastic action such as temporarily removing the isolines and isobands modules from Turf until it can be. That seems to be the most balanced path forward for the project, our users, and the community.

I'll reopen this issue, and reframe it as an effort to remove confusingly licensed code that's presenting a barrier to Turf adoption.

[nicorikken]

@smallsaucepan Thanks for clarifying. I can elaborate a bit more. The terms additional terms clarify the situation where MarchinSquaresJS is used as part of turf-isolines and isn't modified. One might discuss interpretation of these terms, but that is not my main concern. The moment MarchinQuaresJS is modified, AGPL applies to it and to the corresponding source of the covered work in AGPL terms which would also include the turf-isolines code. So it seems compatible with MIT when using, but not when modifying.

[httpete-broadcom]

Also interested in this - it came up in our scans.

[RaumZeit]

@smallsaucepan Thanks for clarifying. I can elaborate a bit more. The terms additional terms clarify the situation where MarchinSquaresJS is used as part of turf-isolines and isn't modified. One might discuss interpretation of these terms, but that is not my main concern. The moment MarchinQuaresJS is modified, AGPL applies to it and to the corresponding source of the covered work in AGPL terms which would also include the turf-isolines code. So it seems compatible with MIT when using, but not when modifying.

Hi all,
this last interpretation is correct! This is exactly what AGPL section 7 allows for. Since my additions under section 7 are pure permissions, they are acceptable and compatible with AGPL. (Only further restrictions are forbidden here).

So the main problem for any third-party using turf would be if they were to modify the isobands/isolines code. Then the corresponding modifications would need to be made public and probably fall under AGPL.

I'll try to have some more thoughts about this within the next week, maybe the additional permission can be adapted, such that modifications will not trigger AGPL but only require open-sourcing the modifications... But my initial intentions to put the code under AGPL still hold (any modifications of the code must be made available to the public), while I'm always willing to grant permissions to include and use the available code in any (differently licensed) project.

[smallsaucepan]

Thanks @nicorikken and @RaumZeit.

Between everyone here I think we understand Turf isn't modifying MarchinSquaresJS so shouldn't have to take on AGPL, per the author's wishes. However it sounds like whatever scanning tools are being used bluntly flag Turf as "AGPL dependent" and cause management to panic. Sadly, I don't think that's avoidable unless we move away from MarchinSquaresJS altogether 🤷

[RaumZeit]

I see your point, and fully understand that the license of MarchingSquaresJS may hinder whatever development third-parties have in mind with turf. So, please feel free to do whatever means necessary to not block your project in such a way!

I've given the entire thing more thoughts, though, and I believe that I could also dual-license the latest version of MarchingSquaresJS under AGPL and MIT. The code is around for almost 10 years now and I hardly find the time to develop it further myself anyway. Although, this gives me a slight stomach ache ;)
If I'm not mistaken, you could then include the version licensed under MIT and fully merge it into your repository. Any upcoming/future developments of MarchingSquaresJS would then stay under AGPL and turf would, therefore, not benefit from any such developments on my side...

Anyhow, just think and discuss about it. I'm open to discussions!

Cheers,
Ronny

[smallsaucepan]

@RaumZeit have you ever considered LGPL instead of AGPL? It sounds like a better fit to your intent - modifications to your library still need to be released, though using it unmodified wouldn't require the user also take on the GPL. It gives the same effect as AGPL+section 7, except out of the box and (hopefully) not as likely to set off any scanning tools.

@alynn-coefficient @Cynaeon @httpete-broadcom Would your clients or the tools you're using to validate licenses respond any differently if MarchingSquaresJS was dual licensed with MIT? Or LGPL?

[httpete-broadcom]

l will check with our legal folks on Monday - I know MIT is fine. LGPL I will look into. Thank you very much for looking in and caring to help out. It's great that software is still being used to help people - but these legal things are sneaky.