MinIO claims WEKA was wrong in its response to MiniO’s accusations of open-source license infringements.
Open-source object software producer MinIO licensed its software originally under the Apache v2 scheme and then moved to GNU’s AGPL v3 license. It has alleged that both Nutanix and WEKA use its software without correctly and publicly acknowledging that it is MinIO open-source SW. WEKA previously brushed off the accusation when CPO Nilesh Patel told us last month:
“Weka’s software only uses MinIO open source software licensed under Apache 2.0. All code forked by Weka was derived exclusively from Apache 2.0 licensed code – no MinIO code subject to the AGPL v3 license is being used in Weka’s software.”
MinIO COO Garima Kapoor has now published a blog which states: “Weka made three assertions in their post:
- They were compliant with the Apache v2 notice and attribution requirements.
- We don’t have the right to revoke Weka’s Apache v2 license.
- They only use MinIO open source software licensed under Apache v2. Which is to say they don’t use any GNU AGPL v3 code.
“They are wrong in all three of the assertions.”
Regarding Apache v2 compliance: “Weka claims that there was a disclosure file on their website. … We could not find the MinIO copyright notice and LICENSE file in their binary distribution and their website.” Kapoor then claims that after MiniIO’s initial blog about infringement was published the license acknowledgement appeared, according to her searches on the Wayback machine.
“It shows up AFTER our blog came out. Hidden disclosures are not in compliance with the FOSS license requirements and completely defeats its purpose. We could not find any LICENSE notices in their binary distribution either. The claim that they were compliant simply isn’t supported by the evidence.
License revocation
A previous blog by Weka’s Patel’s states: “In the Grant of Copyright License (Section 2 in the license terms), each open-source contributor grants a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.”
In his view: “The written terms of the Apache 2.0 license agreement are clear: MinIO cannot revoke WEKA’s license.”
Kapoor disagrees, claiming: “An open source license is a type of contract. By releasing code under the Apache v2 license, we offer a contract to anyone who agrees to our terms. The way they accept that contract is by complying with the terms of the license. However, if they don’t uphold their part of the bargain, including by not providing us attribution, they haven’t accepted our terms. That means they haven’t entered into the contract that allows them to use our code. This is established law, and is the reason why violating open source license conditions constitutes copyright infringement and contract breach.”
She does include a MinIO correction: “Regarding revocation, our language may have suggested that Apache v2 licensors can unilaterally and permanently withdraw a company’s right to use the code. We don’t believe they can. If, and when, a company complies with the license, it may use the code. We apologize if we conveyed a different message.”
However Kapoor insists MinIO can revoke WEKA’s license to use its code: “We had terminated the license due Weka’s years-long non-compliance. Weka may regain the ability to use our software if they come into compliance.” Customers are okay in this regard though as: “termination only applies to Weka and not their customers.”
This area seems legally complex and lawyers will need to examine the relevant texts and say who can and cannot revoke licenses, and what constitutes a contract breach that means a license doesn’t apply.
MinIO AGPL v 3 code use
Patel’s post says: “We can confirm that all code forked by WEKA has been derived exclusively from Apache 2.0 licensed code – no MinIO code subject to the AGPL v3 license has ever been used in WEKA’s software. Therefore, only the terms of the Apache 2.0 license apply.”
Kapoor disagrees again, claiming Weka had included “MinIO WARP performance benchmarking utility in their MinIO bundle (along with the Server and Client).” She adds that “WARP has ALWAYS been licensed under AGPL v3.” A screenshot, included in MinIO’s first blog post, was included as a supposed demonstration of WEKA’s WARP use. B&F cannot confirm its veracity.
Not about money
There has been comment that MinIO is coupling its AGPL v3 licensing with trying to sell 7-figure sum support services or other deals to system SW suppliers such as Nutanix and WEKA.
Garima Kapoor told B&F in a Zoom session that this was wrong: “There is absolutely no money involved from our side.”
She said WEKA wants to ensure that “whoever is using my product … to make sure that they respect our licences and that’s pretty much it… the compliance is what we are after.”
Comment
MinIO believes WEKA hasn’t fully complied with the terms of its Apache and AGPL v3 licenses and it seems as though the spat will run for some time yet, with neither side admitting defeat.
The company told WEKA it was using AGPL v3-licensed code, the WARP software, and yet WEKA’s Patel, its chief product officer, said it was not using any AGPL v3-licensed code from MinIO.
An issue with the AGPL v3 license is that it aims to ensure “modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server.” The intent is that modified open source code is made available to the open source community and does not become proprietary.
What is “modified source code”? MInIO says: “Creating combined or derivative works of MinIO requires all such works to be released under the same license. If MinIO source code is included in the same executable file, they are definitely combined in one program. If modules are designed to run linked together in a shared address space, that almost surely means combining them into one program.”
But “pipes, sockets, RESTful APIs, and command-line arguments are communication mechanisms normally used between two separate programs. So when they are used for communication, the modules normally are separate programs. But if the semantics of the communication are intimate enough, exchanging complex internal data structures, that too could be a basis to consider the two parts as combined into a larger program.”
There is much scope for detailed legal analysis here.
A WEKA spokesperson told us: “MinIO has, once again, made public allegations about WEKA on its blog without first communicating with us or giving us an opportunity to address their claims in private. Their decision to force a dispute in the public domain without corroborating their statements as factual is reckless and, frankly, unethical.”
“We reviewed their latest statement, and nothing cited changes WEKA’s original position. Therefore, we maintain that their allegations are patently false and unfounded. The only part of MinIO’s post we agree with is that WEKA’s customers and partners can continue to use the software:”
“Weka’s customers are most certainly able to continue to use MinIO software as long as they comply with the Apache License v2 and GNU AGPL v3 licenses.”
