Since the Claws Mail ClamAV™ plugin was dropped there have been several comments made in several places; Naturally enough, people have been confused over the incompatibilities of GPLv3 and GPLv2 — some thought it would be possible to simply release the ClamAV™ plugin under GPLv2, (it's not), some imagined that we were trying to instigate a holy war, (we're not), some thought it could easily be solved by changing the way and place the plugin is executed, (it can't), some surmised that it would be better if GPLv2 and GPLv3 were compatible, (if they were then GPLv3 would be redundant), some thought we were too hasty in changing Claws Mail to GPLv3+, (that's a matter of opinion), some think anti-virus at the user-level is useless on Linux anyway, (they've got a point), and others criticized us for not discovering that libclamav was GPLv2-only in the run-up to Claws Mail changing to GPLV3+, (hmmm!).

Now, a quick recap on what I'm talking about:

• Claws Mail upgraded its license from "GPLv2 or later" to "GPLv3 or later".
• The Claws Mail team were alerted to the licensing problem, (a GPLv3+ app cannot link to a GPLv2-only library), by Debian Bug Report 462963.
• The Claws Mail team implemented what they thought was a possible solution: Making the ClamAV™ plugin a standalone plugin instead of it being part of the main Claws Mail package and downgrading the plugin's license to GPLv2+, (at the agreement of all the authors of the new code that has been added since the change to GPLv3+, which was just Colin).
• In the meantime the Claws Mail team sought confirmation of their solution from the Software Freedom Law Center and were informed that the proposed solution was not legally distributable.
• The Claws Mail team dropped the ClamAV™ plugin.

Some interesting points to note: When the ClamAV™ plugin was first released, libclamav was released under a 'GPLv2 or later' license. The 'or later' clause was first dropped in ClamAV™ version 0.91rc1, (libclamav version 2:4:0), which was released on the 30th May 2007. On the 17th August 2007 it was announced that SourceFire^® had acquired ClamAV™. One can clearly see that there could be a connection here, and imagine that discussions between the ClamAV™ developers and SourceFire^® had been taking place. Then one may recall that Snort^®, the network intrusion detection system, was also acquired by SourceFire^® and it also downgraded its license to GPLv2-only — and not without some controversy; for example, see this post, Snort license changes revisited, on the Inliniac blog.

In my opinion, a license change is an important thing, particularly a downgrade in the licensing of a library, which could impact on several other projects. But, when looking at the NEWS and README files of ClamAV™ version 0.91rc1 there is nothing to be found about the license change, which seems a little strange. Even stranger is that the ChangeLog doesn't mention it either! That's a bizarre oversight by whoever writes those files.

Downgrade Claws Mail? Are you crazy?

A few Claws Mail users, having upgraded without taking the time to read the release notes, and suddenly finding themselves without a ClamAV™ plugin, and panicking, (well, possibly panicking), have asked how to downgrade Claws Mail so that they can get the plugin back.

It is possible to call clamscan, clamd, or clamdscan using Filtering or Actions as an alternative, for example:

Filtering:
Filtering condition: ~test "clamscan --quiet %F"
Action:              move "#mh/Mail/trash"

Action:
Menu Name:    clamscan
Command Line: clamscan -i '%p'

None of these methods are as quick as the plugin however.

The best solution, it seems to me, would be for these users to keep a copy of the ClamAV™ plugin and build it themselves — as long as they do not distribute their copy of the source code they would be within the bounds of the law, as the problem here is only the distribution of source code under incompatible licenses, not in personal use.

Here is a copy of the ClamAV™ plugin source code which has been patched so that it will only build with libclamav version 2:3:0 or earlier, that is, the last version of libclamav to be released with a 'GPLv2 or later' license, making it legal to distribute. There is nothing stopping you from taking this code and patching your own local copy so that the restriction is lifted, the only caveat is that you must not distribute your locally patched copy.

You could use a patch like this and then run ./autogen.sh:

--- configure.ac        2008-02-28 10:19:45.000000000 +0000
+++ configure.ac.orig   2008-02-29 10:41:51.000000000 +0000
@@ -89,7 +89,7 @@
 AC_SUBST(GTK_CFLAGS)
 AC_SUBST(GTK_LIBS)

-PKG_CHECK_MODULES(CLAMAV, libclamav < = 2:3:0)
+PKG_CHECK_MODULES(CLAMAV, libclamav)
 AC_SUBST(CLAMAV_CFLAGS)
 AC_SUBST(CLAMAV_LIBS)

Claws Mail ClamAV™ Plugin version 3.3cvs3: clamav-plugin-3.3cvs3.tar.gz (requires libclamav <= 2:3:0)

 

This entry was posted on Friday, February 29th, 2008 at 12:02 and is filed under Claws Mail, Software.
You can follow any responses to this entry through the RSS 2.0 feed.
You can skip to the end and leave a response.