All modules and themes published on d.o are gplv2

If the statement attempting to restrict a user's rights under the GPL isn't removed in a week, move the issue to https://www.drupal.org/project/drupal_lwg → and we will take care of it.

We've had dozens of attempts to claim a commercial license is required, but I think this is the first geographic limit someone tried to enforce on a Drupal module or theme.

https://github.com/GouvernementFR/dsfr?tab=License-1-ov-file needs to be updated as well, but I'll open a GitHub issue about that.

@kreynen Thanks. It's even more than a geographic restriction: only official French government agencies are allowed to use the theme.

For the record, there seem to be a number of other related projects with the same restriction claimed.

Standard I am not a lawyer, this is my advice based on general knowledge and years of navigating source compliance::

As the theme has now been published, it is now automatically released inner gplv2 (see https://opensource.org/license/gpl-2-0) and this licence requires no restrictions on use of the software

The D.O. policy makes it a rules violation to publish non-GPL code on D.O., it does not change the license of submitted code (especially if the poster does not have the authority to do so) as D.O. does not own the copyright or receive an assignment of copyright during the upload process.

The most D.O. can do is ban the user and delete the code from its repository.

Implying that it is too late for the user to have the code removed is misleading to both the code owners and others who may consider using the code as a base for other modules.

For the record, there seem to be a number of other related projects with the same restriction claimed.

I even observed one pass D.O. Project Applications review “recently” (sometime in the past 6 months IIRC). IIRC it was for NY State.

The source code that generates the output may be open source yet the use of the output may not. The GPL already maintains the output of a program is not covered under the GPL license.

Not an art law expert however I wonder if an overall design could be copyrighted as a protected work of art?

Could also be a consideration of French Law (which I have zero experiance under) would use of a theme that matches the French Goverment be a criminal offense of any kind(impersonating a Goverment agency)?

We also have Trademark laws, are any of the French icons included in the code covered under French Trademark and thus being unlawful for use without permission? The GPL does not cover Trademark usage. This is another method where a GPL theme could be posted on D.O. but not lawful for use by anyone except an approved group (a derivative theme however might be lawful however at that point you are not us g DSFR you are using a derivative).

Not intending to imply any of the above actually applies in this situation, only pointing out that there are possible scenarios where code may be licensed under the GPL yet not be freely useable.

IANAL either, but I helped write the DA's Drupal.org policies and contributor agreement which were reviewed by DA's lawyers and outside FOSS experts. If a developer doesn't have permission to redistribute the code as GPL, they are violating https://www.drupal.org/docs/develop/git/setting-up-git-for-drupal/drupal... → . Every developer must agree to that before they can push to https://git.drupalcode.org/.

All code submitted to the repository that is a derivative work of Drupal must be and it will automatically be redistributed as GPL-2.0-or-later.

> Implying that it is too late for the user to have the code removed is misleading to both the code owners and others who may consider using the code as a base for other modules.

That's fair. My point was that despite the fact that the project maintainers likely do not have the authority to relicense code that is trying to limit use to one specific company, the project is already being distributed as GPL-2.0 from Drupal.org. Drupal.org policy is not the same as what can be done legally within the requirements of the GPL. We have tried to keep things as simple as possible. I emphasize tried because I know it is not simple. Even doing something like distributing a Drupal module as GPL-3.0 or including code that isn't compatible with GPL-2.0 (only GPL-3.0) isn't allowed on Drupal.org, but is perfectly legal under the "GPL 2 or later" terms Drupal itself uses. I know. Clear as mud.

Part of the reason the LWG and these policies is exists to avoid licensing surprises like this. If someone runs composer require 'drupal/dsfr:^2.1@RC' and then runs composer licenses, they should be able to trust that the report is accurate including...

doctrine/lexer                           2.1.1      MIT              
drupal/core                              10.3.2     GPL-2.0-or-later 
drupal/core-composer-scaffold            10.3.2     GPL-2.0-or-later 
drupal/core-project-message              10.3.2     GPL-2.0-or-later 
drupal/core-recommended                  10.3.2     GPL-2.0-or-later 
drupal/dsfr                              2.1.12-rc1 GPL-2.0-or-later 
drush/drush                              12.5.3     GPL-2.0-or-later 
egulias/email-validator                  4.0.2      MIT              
grasmash/expander                        3.0.0      MIT              
grasmash/yaml-cli                        3.2.1      MIT 

I shared this example of how to achieve what the DSFR is trying to do with Joeri and Rachel on Mastodon, but I'll share it here too. When I managed the University of Colorado Boulder's Drupal as a Service offering, we maintained our Install Profile publically on GitHub, but also maintained https://www.drupal.org/project/express → on Drupal.org. We did this in part to avoid another project injecting a different project into our namespace, but also because Updated Status reported the number of sites we maintained back to Drupal.org. When we did this, there was some concern expressed that we were making it too easy for someone to create a "fake CU site". While sharing the Install Profile could in theory make it easier than trying to reverse engineer the modules we used from the HTML output, installing our Install Profile was still MUCH more complicated than just scraping the already public HTML and editing that.

Using scraped HTML or our Install Profile wouldn't be a violation of the GPL, but it would be an unauthorized use of CU's trademark (and possibly copyright).

There are ways to enforce an "It is strictly forbidden to use logos and branding outside of the French State's websites", but it is NOT be posting a statement like that on the Drupal.org project page of the theme that IS licensed as GPL-2.0 and can be used by anyone, anywhere. It is also NOT by licensing DSFR itself as MIT.

The (hopefully) final thing I'll say about this is that it is trivial to connect GitHub to automatically publish releases to Packagist and distribute custom projects directly from your own namespace. Many universities using Drupal do this; University of Denver, University of Texas, University of Maryland, etc

If someone wants to make statements trying to limit the rights the GPL allows somewhere other than Drupal.org, that would be beyond the scope of the LWG's charter to do anything about it. It still isn't legal to restrict the use of distributed, derivative code that inherits the GPL, but we wouldn't be discussing it.

If a developer doesn't have permission to redistribute the code as GPL, they are violating (D.O.'s GIT Term of Service)

We agree.

the project is already being distributed as GPL-2.0 from Drupal.org

This is a well known flaw inside D.O infrastructure (with interesting discussion room about D.A. liability).

composer licenses, they should be able to trust that the report is accurate including..

This is an interesting one. The composer license field is called out for the 'package license' what that means in this case is an interesting thought experiment for another day given its general irrelevance to D.O. operations.

It is also NOT by licensing DSFR itself as MIT.

Its an interesting choice for sure, I would love to know their backed logic on the decision.

distribute custom projects directly from your own namespace.

Indeed, and logically it likely makes a lot more sense to do so. I know when I saw the other 'limited intended audience' theme my thoughts were very much "Why is this even being published to D.O. why not some internal distribution system that is shared between the organizations"

Indeed, the project description may be badly formulated, there is no intention to restrict the use of our code published on Drupal.org.
Our aim is simply to clarify the scope of the French State Design System.

We are aware that the project description may be confusing.

We're going to clarify it so that it's clear that we don't want to restrict the use of the code, but simply inform people about the primary purpose of the French State Design System.

That’s good news, sali38, and much appreciated!

So there's no legal issue any more, the core DSFR itself is not "taint" by the GPL?

The limitation about using this theme on a non French government website is still valid?

This is the code used to integrate the DSFR library into Drupal. We're not in charge of the DSFR library itself, hence the clarification in the description of our contribution...

Unless I'm missing something, https://github.com/GouvernementFR/dsfr/blob/main/LICENSE.md is licensed as MIT which could be legally relicensed as GPL-2.0, but doesn't have any use restrictions either. The restrictions on how this is used is not coming from how the code is licensed.

The DSFR (French State Design System) is to be used for digital projects within the French State : central administrations, their departments, interministerial delegations, prefectures, embassies and all decentralized services.

IMHO, the updated text walks the line between urging users not to create fake French Government sites that would likely violate the French equivalent of US trademark or fraud laws and implying that someone doesn't have the freedom to do that with the GPL portion of the project as well as anyone could do.

Unless someone else has strong feelings that additional changes need to be made, I'd consider this fixed.

Thank you for this accurate analysis of the DSFR MIT license and its potential use under GPL-2.0. You are right to point out that the license itself does not impose any restrictions on use, and that the concerns are more about the misuse of DSFR to create fake government sites.

Your interpretation of the updated text seems relevant to me. It is a warning designed to dissuade malicious actors, while recognizing the freedom to use the code in accordance with its license.
I agree that this point has been resolved.

Automatically closed - issue fixed for 2 weeks with no activity.