Subject: Re: Identifying my version of a GPL program
From: Ben_Tilly@trepp.com
Date: Wed, 20 Dec 2000 13:29:25 -0500


Bernard.Lang@inria.fr wrote:
> This is probably not new, but I do not recall seeing it.
> The problem is real, not invented.
>
> An organization Yoyodyne is producing software. They probably would
> not mind making it free, but they have a problem.
>    For reasons their own, they want to make sure that whoever is using
> that software to collaborate with them is using one of their versions,
> and not a modified variant by someone else.
>   This software is intended to produce very specialized documents to be
> sent to Yoyodyne (the communication is not interactive)
>
>   My question is : can it be achieved in compatibility with the GPL.

IANAL, but I am dubious that this can be easily forced.

>   A proper way of checking which version is being used is simply to
> attach a MD5 checksum of the binary used, computed dynamically at
> execution time, to the documents.

I think that this is appropriate.  In fact they could easily produce
a wrapper program that takes a binary, does an MD5 check, runs it,
then signs the output.  Make that binary proprietary.

>   However this will not prevent someone from replacing it by a fixed,
> precomputed value, and thus cheat the version checker.
>
> I came up with one idea, using trademark.
>
> Yoyodyne publishes its version in such a way that it attaches also a
> trademarked sentence to the documents it produces.  And a comment is
> attached to the Checksum computing code specifying that it is illegal
> to attach that sentence to documents produced with non original
> versions of the code (i.e. versions not issued by Yoyodyne).

This can be done with the wrapper.

>   Now, despite the GPL licence, any cheating on the requirement to use
> Yoyodyne version is willfull trademark infringement (and can be
> sued). No one infringes by accident or thoughtlessness and produces
> acceptable documents.

Let me see.  I notice a problem with your handling of locale-specific
text and add logic to replace input text with escape codes where
needed.  I never look at the checksum code, I have no idea of the
restriction.  Oops...

>   By this does not restrict in any way the use of the code in any
> other context than communicating with Yoyodyne.
>
I think it does.  Section 7 of the GPL says that if you cannot for
some external reason (eg trademark restrictions) satisfy all of the
requirements of the license, then you cannot redistribute.  But in
your case many modifications result in producing documents which tell
you in black and white that they are illegal.  Therefore you are
indeed restricted beyond what the GPL calls acceptable, and thus you
are further restricted to not distributing at all!
>
> well ... sorry if I was complicated ... maybe there is a much simpler
> solution.

Go back to your MD5 checksum.  Have Yoyodyne's agreements with those it
interacts with include a condition that the checksum in the document is
accurate and a condition that they are under no obligation to accept
documents from modified versions of the program.

Sure, it can be beaten.  But anyone who does has broken terms on a
contract...

Cheers,
Ben