Case Study: CoyIM Took Code From Another XMPP Client and Kept Its Licence

CoyIM is a chat client for the XMPP protocol, written in Go, that sets safe and secure options by default. Its README says it is built upon xmpp-client, an earlier XMPP client at github.com/agl/xmpp-client. CoyIM is under GPL-3.0. xmpp-client uses the three-clause BSD licence that Go itself uses, under the line “Copyright (c) 2012 The Go Authors. All rights reserved.” BSD code can go into a GPL-3.0 program, as long as the BSD notice goes with it.

We compared CoyIM 0.4.1 with xmpp-client at commit 3030ad4, the newest in its repository. The reports are in the Remixware repository, and the numbers below come from them.

Remixware’s report on CoyIM 0.4.1: 17 copies of xmpp-client code, all credited by LICENSE.xmpp-client at the project’s top.

17 Copies, All Credited

Remixware found 17 passages of xmpp-client code in 14 of CoyIM’s files, 600 lines in all. Nine sit in its xmpp folder, which holds the protocol code, and the other eight in its configuration, session and user interface code.

CoyIM keeps xmpp-client’s licence in a second licence file at its top, LICENSE.xmpp-client, next to LICENSE, which holds the GPL-3.0. Remixware reads both and gives the project’s licence as BSD-3-Clause AND GPL-3.0-only. All 17 copies come out as attributed, credited by that second file:

ATTRIBUTED           xmpp/tls.go:20-34
                     github.com/agl/xmpp-client 3030ad4, xmpp/xmpp.go:372-386 (BSD-3-Clause), copied as is, 100% match
                     Credited in LICENSE.xmpp-client, kept with the copy. Keep its copyright line
                     and the BSD-3-Clause licence text with your copy, for example in a third-party
                     notices file.

17 findings: 17 attributed.

The Packages CoyIM Vendors

CoyIM also keeps the Go packages it depends on in its vendor folder, 32 of them. Remixware’s index of CoyIM, recorded with the benchmark, found a licence for every one, and each is a permissive licence such as MIT, BSD or Apache-2.0, or GPL-3.0 itself. All of those can go into a GPL-3.0 program.

A scan leaves vendor/ out by default, since a package manager already reports the dependencies it installed. Add --include-deps to scan it as well.

What CoyIM Changed in Remixware

Remixware 0.2.0 looked for credit only in notice files at a project’s top and in the copied file’s own header. LICENSE.xmpp-client isn’t named like a notice file, so it reported all 17 as missing their attribution. Remixware 0.2.1 reads every licence file in the project outside dependency folders. A full copyright line in one of them credits the copy, the same way it does in a notices file.

CoyIM’s way is easy to copy for any project that takes code from somewhere: one licence file per source at the top, named after the source, holding the source’s copyright line and licence text. The reference lists everything Remixware counts as credit.