License compatibility with dual licensed software.

[emgucv]

I am the maintaner of the Emgu CV project. We have received a pull request from a contributor to add CodeQL to our build pipeline:
emgucv/emgucv#502

Before merging the pull request, I have read the codeql license terms:
https://securitylab.github.com/tools/codeql/license/

Your license terms mention that:

Here's what you may also do with the Software, but only with an Open Source Codebase and subject to the License Restrictions provisions below:

Perform analysis on the Open Source Codebase.

If the Open Source Codebase is hosted and maintained on GitHub.com, generate CodeQL databases for or during automated analysis, CI, or CD.

What about dual license software like Emgu CV? Our software is licensed under either GPL v3 or a custom commercial license. This is similar to MySql, where both Open Source and commercial license is available. Our full license terms can be found here:
https://github.com/emgucv/emgucv/blob/master/LICENSE

The github repoisitory is used to build both our open source and commercial release. In this case, are we allowed to integrate CodeQL into our CI pipeline?

Thanks for the clarification.

[smowton]

I’m afraid we can’t offer legal advice: you should consult your own legal people to check whether they believe you’re in compliance with the license.

[emgucv]

Will it be possible, to consider, in the future, add clarifications to your license terms regarding dual licensed software? The lack of the mention for dual license software in the license terms is what stopping us from using it.

e.g. Is it possible to add CodeQL into build pipeline for dual licensed software like MySql, Qt etc?

Without that clarification, I will have to reject the pull request to add CodeQL into build pipeline from our contributor.

[p0]

We would be happy to clarify language in the CodeQL license that is unclear -- indeed we have previously done so based on community feedback.

The license in its current form contains the following definitions:

In these Terms:

"OSI-approved License" means an Open Source Initiative (OSI)-approved open source software license.

"Open Source Codebase" means a codebase that is released under an OSI-approved License.

The GPL is currently listed as an OSI-approved license, and as such codebases that are released under the GPL fall under the "Open Source Codebase" definition in the terms.

If you have a concrete proposal on what improvements we can make to the language of the license, I'd be happy to take it to GitHub legal.

[emgucv]

Our software is licensed under both GPL v3 and commercial license.

I understand that CodeQL is compatible with software licensed under ONLY GPL v3, but not for close source commerical licensed software.

My questions is, what about dual licensed software? Can we intergrate CodeQL into build pipeline when our software can be licensed under EITHER GPL v3 and a commercial license, both are built from the same repository? Both licenses are open sourced, both only one of the license is "OSI-approved License". Other open sourced software projects such as MySQL and QT also used the same dual license model, we are not alone.

If your license terms says, for dual license software, as long as one of the license is compatible with "OSI-approved License", we are allowed to integrate CodeQL into the build pipeline, then we will be good.

It is not clear to me, for a dual license software, does it required both licensed to be compatible, or just one license out of two to be compatible, in order to use CodeQL.

[p0]

For what it's worth, my personal reading is that if the codebase in question is licensed under an OSI-approved license, you're good to go. The fact that it's dual-licensed shouldn't matter, unless the second license somehow overrides the first. The CodeQL license's definition of "Open Source Codebase" does not exclude dual-licensed codebases.

[emgucv]

Thanks a lot for the clarification.