SDL 1.2 license violations in Dungeons of Dredmor?

Folks,

I have spend a bit of time tonight looking at LGPL 2.1, LGPL FAQ
entries, and Wikipedia to try and work out whether or not a commercial
game – Dungeons of Dredmor from Gaslamp Games (herein referred to as
"DoD") – is in fact in violation of the LGPL.

Based on what I’ve read (and I will provide references to the material),
it appears that they’re in violation, but I need folks here to help
clarify/determine.

I also want to state up front that my intention here is not to get
Gaslamp Games into any trouble. This investigation came about privately
between a colleague of mine (who’s a game programmer) and myself, when
talking about licenses and the SDL. This game was cited as a reference
point, and that lead to this investigation. There is no malice here.

I should also note I personally use the 2-clause and 3-clause BSD
licenses for my software, but that has no bearing on this issue; I state
it simply because as a software author myself I’m familiar with some
licenses.

So let’s get to it:

  1. DoD, as of this writing, distributed via Steam, does not include any
    source for anything – itself, any libraries, etc… Not within any .zip
    files or other means either.

You’re going to have to trust me on this. Obviously I cannot tar/zip up
the contents of the installation directory and make it available on the
Internet, given copyright infringement, etc… for folks to review.

  1. The game includes SDL.dll (in the installation directory), and the
    version of the DLL is 1.2.15.0 (taken from DLL headers). DoD therefore
    dynamically links to SDL (this matters; keep reading).

  2. SDL 1.2 was released under the LGPL 2.1 license:

http://www.libsdl.org/license.php
http://www.libsdl.org/license-lgpl.php

  1. The SDL 1.2 license summary page states clearly:

“To comply with this license, you must give prominent notice that you use
the Simple DirectMedia Layer library, and that it is included under the
terms of the LGPL license. You must provide a copy of the LGPL license.”

No where stated within DoD or within the installation (in a file or
otherwise, that I can find) is there mention that SDL is used, that it
is included under the terms of LGPL 2.1, nor is there a copy of the LGPL
provided anywhere. Even the “Credits” screen in-game makes no mention
of any of this, the Title screen, nor any Exit/Quit screen.

Since it’s a game, the best I could do would be to provide screenshots
of the Credits screens).

  1. Furthermore, the SDL 1.2 license summary page states clearly:

“If you include the SDL library in binary form, you should also make
available the source code to the version you provide, including any
customizations you have made. If you link to a standard version of the
library, simply referring to the SDL website is sufficient.”

Yet, as I stated in #1 above, there is no source code provided with DoD
for the SDL DLL used. And even if its the stock SDL DLL, as stated in
#4 above, there is absolutely no mention of www.libsdl.org anywhere –
including on the DoD website or Gaslamp Games’ website:

http://www.dungeonsofdredmor.com/
http://www.gaslampgames.com/

  1. Back in July 2011 the author of DoD posted to the SDL mailing list,
    talking about SDL 1.3, and stated that he used a modified version of SDL
    1.2 – at least in the past:

http://lists.libsdl.org/pipermail/sdl-libsdl.org/2011-July/081550.html

This relates directly to #5 above, given the possibility that
modifications were made (again, at least in the past). Determining this
is difficult; a binary file compare won’t necessarily prove anything,
for example, given compile differences, optimisation flags, etc…

  1. There is also this thread, unrelated to DoD, where LGPL licensing
    came into question for commercial games. I used this as reference
    material as well:

http://lists.libsdl.org/pipermail/sdl-libsdl.org/2000-August/010849.html
http://lists.libsdl.org/pipermail/sdl-libsdl.org/2000-August/thread.html#10849

Please be sure to read all the replies in the thread, not just that one
post.

  1. Finally, I reviewed LGPL vs. GPL differences per Wikipedia, and it
    seemed quite clear (in the same way that the SDL 1.2 license summary
    page is):

http://en.wikipedia.org/wiki/GNU_Lesser_General_Public_License#Differences_from_the_GPL

DoD is a non-LGPL-licensed program (thus proprietary), thus “not a
derivative work”; it’s an executable that dynamically links to SDL.dll.
No static linking is done (to SDL anyway).

Thoughts/comments/concerns/corrections?–
| Jeremy Chadwick @Jeremy_Chadwick |
| UNIX Systems Administrator http://jdc.koitsu.org/ |
| Mountain View, CA, US |
| Making life hard for others since 1977. PGP 4BD6C0CB |

Hi Jeremy,

It would appear, at this stage, that the only violation they have made
is the lack of notice regarding the LGPL and SDL. I suspect this is
most likely an oversight. The source code requirement does not require
them to make the source available on their website, or in the archive
that you download containing the binaries. It just means that if you
contact them , they have to provide it. They may even charge you for
this, assuming the charge is simply for the administrative overhead of
it (such as the shipping of a CD). It should also be noted that there
is no requirement for them to make this source available to anyone who
asks - only people to whom they have distributed binaries can demand
the code.

So technically, you’re probably right, they’ve violated the license by
not mentioning SDL/LGPL, however (in my eyes) it is a very minor
violation, and an email to their support team would probably result in
this being quickly fixed in a readme, or on the website. If nobody has
asked them for the source, then I don’t think you can say that they’ve
violated that portion of the license at this stage.

Please take what I’ve said with a grain of salt - I develop with GPL &
LGPL software in a commercial environment, but have not gone through
all of the legal details.

Regards,
Andre

Well, huh. You’re right.

In order of objections raised:

  1. We actually had the requisite documentation in the credits. I just
    checked, and in fact the reason it’s not showing up is because I forgot to
    increment the total # of pages in the credits page after we released our
    new expansion pack last week… and, of course, nobody thought to check
    this. I’ll get it fixed for the next release.

So yeah, I don’t know what to say to this other than “oops!” and “good
catch.”

  1. All of the code that was in our custom SDL was actually merged to the
    SDL head by Ryan; I’m sure that Mr. Gordon can point you to the changelog
    if you want, but you’ll find it’s a bunch of issues related to audio and
    thread safety. At this point, if memory serves, we are now running stock
    SDL 1.2 thanks to the new maintenance release (which was the only reason
    we were running a custom build in the first place; nobody had released a
    new SDL in… awhile.)

That said:

  1. A simple e-mail sent to our contact address would have been just fine,
    you know. Having been a contributor to, and a supporter of, SDL for over
    12 years (since the days of Loki Software), and having done stuff on the
    library so ancient that Sam is probably the only person who remembers it -
    such as working on the original OpenGL implemenation with Michael Vance
    and crew - I would hope that my sins of omission could be handled via a
    gentle “hey, you broke your credits screen!” instead of immediately
    jumping on me on a public forum. I think the most evil thing I’ve ever
    done on the list is flame somebody who wanted a slate of rotational
    blitters. Cut me a little slack!

More generally, there are better ways to resolve this sort of thing; one
would hope that we could try diplomacy in future instead of immediately
being accused of Great and Malingering Evil. I don’t think this sort of
bludgeoning approach to dealing with what, in this case, is a pretty silly
screw-up on my part, encourages anybody else thinking about using SDL in a
commercial product to give it a go.

Regardless, I’ll sort out the licensing issues during the next forthcoming
maintenance release, and thanks for bringing it to my attention.

  • Nicholas @ Gaslamp Games

(Two posts this year on the SDL mailing list? It’s the end of times.)On Tue, 12 Jun 2012, Jeremy Chadwick wrote:

Folks,

I have spend a bit of time tonight looking at LGPL 2.1, LGPL FAQ
entries, and Wikipedia to try and work out whether or not a commercial
game – Dungeons of Dredmor from Gaslamp Games (herein referred to as
"DoD") – is in fact in violation of the LGPL.

Based on what I’ve read (and I will provide references to the material),
it appears that they’re in violation, but I need folks here to help
clarify/determine.

I also want to state up front that my intention here is not to get
Gaslamp Games into any trouble. This investigation came about privately
between a colleague of mine (who’s a game programmer) and myself, when
talking about licenses and the SDL. This game was cited as a reference
point, and that lead to this investigation. There is no malice here.

I should also note I personally use the 2-clause and 3-clause BSD
licenses for my software, but that has no bearing on this issue; I state
it simply because as a software author myself I’m familiar with some
licenses.

So let’s get to it:

  1. DoD, as of this writing, distributed via Steam, does not include any
    source for anything – itself, any libraries, etc… Not within any .zip
    files or other means either.

You’re going to have to trust me on this. Obviously I cannot tar/zip up
the contents of the installation directory and make it available on the
Internet, given copyright infringement, etc… for folks to review.

  1. The game includes SDL.dll (in the installation directory), and the
    version of the DLL is 1.2.15.0 (taken from DLL headers). DoD therefore
    dynamically links to SDL (this matters; keep reading).

  2. SDL 1.2 was released under the LGPL 2.1 license:

http://www.libsdl.org/license.php
http://www.libsdl.org/license-lgpl.php

  1. The SDL 1.2 license summary page states clearly:

“To comply with this license, you must give prominent notice that you use
the Simple DirectMedia Layer library, and that it is included under the
terms of the LGPL license. You must provide a copy of the LGPL license.”

No where stated within DoD or within the installation (in a file or
otherwise, that I can find) is there mention that SDL is used, that it
is included under the terms of LGPL 2.1, nor is there a copy of the LGPL
provided anywhere. Even the “Credits” screen in-game makes no mention
of any of this, the Title screen, nor any Exit/Quit screen.

Since it’s a game, the best I could do would be to provide screenshots
of the Credits screens).

  1. Furthermore, the SDL 1.2 license summary page states clearly:

“If you include the SDL library in binary form, you should also make
available the source code to the version you provide, including any
customizations you have made. If you link to a standard version of the
library, simply referring to the SDL website is sufficient.”

Yet, as I stated in #1 above, there is no source code provided with DoD
for the SDL DLL used. And even if its the stock SDL DLL, as stated in
#4 above, there is absolutely no mention of www.libsdl.org anywhere –
including on the DoD website or Gaslamp Games’ website:

http://www.dungeonsofdredmor.com/
http://www.gaslampgames.com/

  1. Back in July 2011 the author of DoD posted to the SDL mailing list,
    talking about SDL 1.3, and stated that he used a modified version of SDL
    1.2 – at least in the past:

http://lists.libsdl.org/pipermail/sdl-libsdl.org/2011-July/081550.html

This relates directly to #5 above, given the possibility that
modifications were made (again, at least in the past). Determining this
is difficult; a binary file compare won’t necessarily prove anything,
for example, given compile differences, optimisation flags, etc…

  1. There is also this thread, unrelated to DoD, where LGPL licensing
    came into question for commercial games. I used this as reference
    material as well:

http://lists.libsdl.org/pipermail/sdl-libsdl.org/2000-August/010849.html
http://lists.libsdl.org/pipermail/sdl-libsdl.org/2000-August/thread.html#10849

Please be sure to read all the replies in the thread, not just that one
post.

  1. Finally, I reviewed LGPL vs. GPL differences per Wikipedia, and it
    seemed quite clear (in the same way that the SDL 1.2 license summary
    page is):

http://en.wikipedia.org/wiki/GNU_Lesser_General_Public_License#Differences_from_the_GPL

DoD is a non-LGPL-licensed program (thus proprietary), thus “not a
derivative work”; it’s an executable that dynamically links to SDL.dll.
No static linking is done (to SDL anyway).

Thoughts/comments/concerns/corrections?


| Jeremy Chadwick jdc at koitsu.org |
| UNIX Systems Administrator http://jdc.koitsu.org/ |
| Mountain View, CA, US |
| Making life hard for others since 1977. PGP 4BD6C0CB |


SDL mailing list
SDL at lists.libsdl.org
http://lists.libsdl.org/listinfo.cgi/sdl-libsdl.org

Nicholas et al,

My responses are in-line below:

Well, huh. You’re right.

In order of objections raised:

  1. We actually had the requisite documentation in the credits. I
    just checked, and in fact the reason it’s not showing up is because
    I forgot to increment the total # of pages in the credits page after
    we released our new expansion pack last week… and, of course,
    nobody thought to check this. I’ll get it fixed for the next
    release.

So yeah, I don’t know what to say to this other than “oops!” and
"good catch."

No problem. Yep, mistakes happen, I understand. DoD has been around
for quite some time, so I’m a littles surprised nobody (especially the
Valve folks, actually; for some reason I thought they did legal review
of software (licensing specifically) which was put on their service)
caught it until now, but that’s really neither here nor there at this
point. The important thing is that its being rectified, which makes
everyone happy, I hope! :slight_smile:

  1. All of the code that was in our custom SDL was actually merged to
    the SDL head by Ryan; I’m sure that Mr. Gordon can point you to the
    changelog if you want, but you’ll find it’s a bunch of issues
    related to audio and thread safety. At this point, if memory serves,
    we are now running stock SDL 1.2 thanks to the new maintenance
    release (which was the only reason we were running a custom build in
    the first place; nobody had released a new SDL in… awhile.)

Cool – then that addresses the requirement of including the source
code. No need for that; only thing needed would be the inclusion of the
LGPL 2.1 license (for SDL) and mention of use of SDL (put this wherever
you’d like, although a general readme.txt and mention in Credits would
be reasonable I think).

That said:

  1. A simple e-mail sent to our contact address would have been just
    fine, you know. Having been a contributor to, and a supporter of,
    SDL for over 12 years (since the days of Loki Software), and having
    done stuff on the library so ancient that Sam is probably the only
    person who remembers it -
    such as working on the original OpenGL implemenation with Michael Vance
    and crew - I would hope that my sins of omission could be handled
    via a gentle “hey, you broke your credits screen!” instead of
    immediately jumping on me on a public forum. I think the most evil
    thing I’ve ever done on the list is flame somebody who wanted a
    slate of rotational blitters. Cut me a little slack!

I understand your concern/view, and its legitimate. This isn’t a
rebuttal in the least, but me providing some insight to the decision I
made to mail the SDL mailing list rather than contact at gaslampgames.com
first:

The problem with mailing game companies (corporate vs. indie, big vs.
small, has absolutely no bearing – I’ve worked for both types) is that
a lot of the time the mail either goes to /dev/null, or if it does reach
a human being, such issues immediately get sent to a legal department
with no further communication permitted sans with Legal. Even in the
case of single-person companies or DBAs this can happen (the Email
immediately gets forwarded to their lawyer, chaos begins).

Worse, in some cases (and yes I have personally experienced this with a
company), communication with Legal then becomes limited to two mediums:
fax or written/typed letters. In some cases, Legal immediately involves
lawyers, and all sorts of behind-the-scenes statements and threats
begin, with the issue at hand never actually getting solved.

Given that I’ve been through the latter (yes really), I opted to choose
mailing the SDL folks first. But there was no “centralised place” for
me to ask someone privately about the SDL 1.2 license; the best I could
find was the mailing list. I really did go looking for an individual to
mail about the SDL 1.2 license but I wasn’t able to discern who I should
talk to. Thus I chose the list.

My intention was to ask if I was truly understanding their licensing
requirements were and if this was in fact a violation based on that
understanding. That’s the tricky thing about the GPL and LGPL – they
don’t read easily (compared to licenses like the 2/3-clause BSD license
and things like the WTFPL) – so how people interpret them is often
different.

More generally, there are better ways to resolve this sort of thing;
one would hope that we could try diplomacy in future instead of
immediately being accused of Great and Malingering Evil. I don’t
think this sort of bludgeoning approach to dealing with what, in
this case, is a pretty silly screw-up on my part, encourages anybody
else thinking about using SDL in a commercial product to give it a
go.

I hope I did not give the impression that there was a form of “Great and
Malingering Evil” being done; that was sincerely not my intention! I
did preface my original mail to the list with the explanation that I was
not trying to demonise or bring wrath down upon Gaslamp Games in any
way. I specifically wrote that preface to (hopefully) show that my
intentions were respectful and sincere/honest. I’m well aware of how
the Internet can resort to a mob mentality when it comes to certain
topics (e.g. Slashdot getting wind of stuff like this can cause major
problems) and I wrote that paragraph to stifle that.

Obviously that wasn’t enough, probably because I’m a very direct/blunt
and very verbose person by nature. I itemised things to make them
easier for readers to understand, and so people could address each item
separately (especially if I was incorrect in my understanding of the
violations). This usually resorts in a negative association with
something I’ve written; I’m used to it by now, so I’m not too surprised
by that reaction. :slight_smile:

Regardless, I’ll sort out the licensing issues during the next
forthcoming maintenance release, and thanks for bringing it to my
attention.

  • Nicholas @ Gaslamp Games

(Two posts this year on the SDL mailing list? It’s the end of times.)

Thank you – it is truly appreciated. And thank you for your time and
response!On Wed, Jun 13, 2012 at 01:27:41AM -0400, Nicholas Vining wrote:


| Jeremy Chadwick @Jeremy_Chadwick |
| UNIX Systems Administrator http://jdc.koitsu.org/ |
| Mountain View, CA, US |
| Making life hard for others since 1977. PGP 4BD6C0CB |

  1. All of the code that was in our custom SDL was actually merged to the
    SDL head by Ryan; I’m sure that Mr. Gordon can point you to the changelog
    if you want, but you’ll find it’s a bunch of issues related to audio and
    thread safety.

The SDL that shipped with Dredmor is a stock build of 1.2.15 (after
being some frankenstein version for many years of development).

There used to be a custom SDL_mixer in there for the first few releases,
but we ripped it out and replaced it with OpenAL…in any case, those
SDL_mixer changes were pushed upstream before Dredmor shipped.

As Nicholas said, the credits screen prominently (whatever that means)
mentioned SDL and provided a link to libsdl.org; this was accidentally
hidden in the last patch, and will return when Nicholas increments this
line:

 int numScreens = 5;

I don’t think this sort of bludgeoning approach to dealing with what,
in this case, is a pretty silly screw-up on my part, encourages anybody
else thinking about using SDL in a commercial product to give it a go.

This is part of why we moved to the zlib license.

–ryan.

About those rotational blitters… :stuck_out_tongue: