unrar: licensing issue on redistribution

[Aleksanaa]

Intention

A discussion about whether unrar should be unfree or unfreeRedistributable arose in #415776 (comment). This involves the interpretation of the unrar license: whether we should declare agreement of the license in order to redistribute the software.

Currently packages with unfreeRedistributable is not built in Hydra and thus not served in our cache, so we don't get any trouble no matter which attribute we set, but things could change if NixOS/rfcs#185 is merged.

According to https://www.rarlab.com/feedback.htm, I sent this licensing issue to sales@win-rar.com, and got a reply shortly after.

My email

Hi RARLAB team,

I’m a maintainer for NixOS. In addition to distinguishing non‑free licensing, we also consider whether the license permits redistribution, since our build servers may compile and distribute non-free but redistributable software.

I’m writing to request clarification regarding certain aspects of the UnRAR license text, particularly around redistribution and the clauses:

• “Installing and using the UnRAR utility signifies acceptance of these terms and conditions of the license”

• “If you don’t agree with terms of the license you must remove UnRAR files from your storage devices”

In our community, two interpretations arise:

1. Redistribution‑allowed interpretation
   The license text clearly permits redistribution, and our process of distributing via cache/binaries does not violate any terms—so redistributing should be acceptable.

2. Install‑only acceptance interpretation
   Fedora’s position (https://fedoraproject.org/wiki/Licensing:Unrar) takes the opposite view: because we haven’t made explicit “agreement/acceptance”, we therefore lack the right to store or serve UnRAR from our cache servers—making redistribution impermissible.

Could you please provide a legal perspective on whether:

• Providing UnRAR binaries or source (for optional later installation) requires each recipient to have explicitly “agreed” to the license terms beforehand?

• Or, is redistribution via build caches or mirrors legally allowed even if recipients have not yet installed or formally “accepted” the license?

Our aim is to respect the intention and letter of your license while supporting users who need UnRAR. I may quote your response within our community discussions to aid transparency.

Thank you in advance for taking the time to help clarify this matter!

Their reply

Hello Alexsana,

Thank you for contacting WinRAR!

Regarding the UnRAR license, we’re happy to provide some clarification around redistribution and the acceptance clauses you referenced.
On Redistribution

The UnRAR license does not prohibit redistribution of the UnRAR source code or binaries, provided that the license terms remain intact and are distributed along with the software.

This includes redistribution via build caches or mirrors, as long as you are not modifying the binary or misrepresenting its origin.

The license’s core restrictions are primarily directed toward:

• Prohibiting the creation of a RAR compressor based on the UnRAR source.

• Ensuring users are informed of the license terms when they use the software.

On License Acceptance

The clauses you referenced:

• “Installing and using the UnRAR utility signifies acceptance...”
• “If you don’t agree... you must remove UnRAR files...”

…are standard "clickwrap"-style license terms, where acceptance is only triggered upon use or installation, not upon mere possession or redistribution.

Therefore, redistribution via caches or mirrors does not require recipients to have explicitly agreed to the license beforehand.

It is the act of using or installing UnRAR that signals acceptance.
Conclusion

From our perspective:

• You may redistribute UnRAR binaries or source code, even to users who have not explicitly agreed to the license, as long as the license is preserved.

• The obligation to accept the license arises at the point of use/installation, not at the point of distribution.

We hope this provides clarity and supports your continued efforts to maintain compliance while serving your user base.

You are welcome to quote this response in your community discussions.

Please let us know if you need further assistance.

Kind Regards,
Louise Cusworth
WinRAR Sales & Support Team

www.win-rar.com (website)
sales@win-rar.com (e-mail)

Conclusion

The license of unrar code should be unfreeRedistributable, while the link to the license or the original text should be provided. We sincerely appreciate the RARLAB team's prompt and accurate response, as well as their genuine commitment to the community.

[acid-bong]

So, Hydra can build and cache it, but users will still have to enable nixpkgs.config.unrar.acceptLicense, right?

[Aleksanaa]

More questions

1. Do we have to remove all unrar packages if we accidentally add a package violating the license?
2. Do we have to declare acceptance of the license to use the software, like in hydra?

My email

Thank you again for your timely responses—they’ve been extremely helpful. I still have a couple more questions to clarify our understanding and ensure we address all concerns fully.

Suppose a popular archiving application internally incorporates UnRAR code in a way that violates the license (e.g., using it to implement compression rather than just extraction). Imagine it gets added to Nixpkgs without rigorous review, is subsequently built by Hydra, and distributed. Once this improper inclusion is discovered, our best option would be to promptly remove the package from Nixpkgs source to stop generating new builds, and with some efforts we can probably remove all previous builds from our caching server (s3), but there is no precedent in this regard.

However, the UnRAR license states:

"If you don’t agree with terms of the license you must remove UnRAR files from your storage devices and cease to use the utility."

This implies we must not only remove the offending package, but also all builds of UnRAR and any others embedding UnRAR internally. Practically, this is unmanageable for us. How would you recommend we explain or approach this situation in compliance with the license?

Another nuance is that once we mark a package as redistributable, it may also be used within our CI system (Hydra) as a build tool, if other packages reference it. That means we might be using it internally, even if not distributing it ourselves. In that context, are we considered to have “accepted” the license simply by not violating it, even if we cannot formally declare acceptance?
I apologize for my repeated questioning—I want to ensure we iron out all related compliance issues now so that we won’t need to revisit them endlessly. I also hope the outcome of this discussion could benefit other developers and Linux distribution maintainers.

Best regards,
Aleksana

Their reply

Hello Aleksana,

Thank you for your thoughtful follow-up questions — we appreciate your attention to compliance and your efforts to ensure clarity for the broader open-source packaging and distribution ecosystem.

1. On Accidental License Violations and Retrospective Removal

You're correct that the UnRAR license states:

"If you don’t agree with terms of the license you must remove UnRAR files from your storage devices and cease to use the utility."

This clause is meant to cover intentional use of UnRAR without accepting the license — particularly relevant in individual or organizational use cases where users are aware of the license but do not agree to it.

However, in the scenario you described — where a third-party package misuses UnRAR code (e.g., for compression) without detection and is later removed — the intent of the UnRAR license is not to impose punitive, retroactive enforcement in such edge cases, particularly where:

• The violation was unintentional.

• Immediate remediation (removal from Nixpkgs and cache) is pursued in good faith once discovered.

• The original UnRAR binaries or sources you distribute remain unaltered and separately licensed.

In other words, while complete retroactive purging of all build artifacts is ideal, we recognize that it may not always be technically or practically feasible in large, automated ecosystems.

The core expectation is that known violations are not perpetuated, not that you erase all traces of misuse beyond reason.

We recommend:

• Removing any offending builds from your distribution systems when possible.

• Documenting the corrective steps taken for internal and public transparency.

• Reaffirming license acceptance for future builds of UnRAR and packages that reference it.

This approach aligns with the spirit of the license, which is focused on preventing abuse of UnRAR code (e.g., using it to create competing RAR compressors) rather than enforcing strict liability for accidental downstream misuse.

2. On Use in CI Systems and Implicit License Acceptance

Regarding use within CI/build systems like Hydra: yes, using UnRAR as a tool in your build environment (e.g., for extraction) — even if not explicitly declared as “accepted” — is considered implicit acceptance of the license, provided the license terms are not violated.

Formal “click-through” or user prompts are not required.

The license assumes that if you're using UnRAR, you're doing so under the terms provided — whether manually or via automation. In practical terms:

• Using UnRAR to extract files during CI builds is permitted, and this does not require separate legal declarations.

• You are considered to have accepted the license as long as you respect its limitations (e.g., not using it for compression, not modifying and misrepresenting the source, etc.).

Final Thoughts

We understand that automated build systems and distributed packaging environments introduce complex dynamics.

Our goal is to enable responsible redistribution and usage of UnRAR, not to create undue legal or technical burdens for community maintainers who act in good faith.

Your questions are valuable and help improve understanding across the open-source world.

Please feel free to quote this response in your community discussions or documentation.

We're always happy to provide further clarification if needed.

Kind Regards,
Louise Cusworth
WinRAR Sales & Support Team

[06kellyjac]

Firstly I'm glad you've reached out to ask the WinRAR team for clarification. I'm also very appreciative with how well they've structured their responses and how quickly they've responded. Also their understanding/flexibility in point 1 of your 2nd response is nice.

disclaimer: not a lawyer

My problem is still around the "at installation" part in section 5. And probably more so with removal of files for disagreement in section 6.

A basic reading would be ok, if it's in /opt/unrar/bin or /usr/local/bin etc but how does that differ to having it in a directory off the PATH?

If I have /im_totally_just_storing_for_distribution/unrar/bin/unrar on my machine is it installed or not? I can simply just run /im_totally_just_storing_for_distribution/unrar/bin/unrar with no issues. Maybe you can consider the point at which I execute unrar as important but just running unrar without moving it isn't itself, in my estimation, the action of installing.

This is also very important to nixos because in many cases you don't have "unrar" installed in a traditional unix/linux FHS sense. If I have installed package-a which has a wrapper prepending PATH pointing to /nix/store/xyz-unrar-x.x.x/bin/. It's not in my system PATH, it's not in the usual places software is installed, but it is explicitly required and used by software I've "installed".

There's the case of making unrar available for compilation during a build, maybe that doesn't count as installation because the source is just on the machine and pointed to at build time.

There's the case of unrar being referenced and executed during a build. If I'm building package-b and it executes unrar to unpack something does that not count as installation because it was only in the context of the build?
This'd fit point "2. On Use in CI Systems and Implicit License Acceptance".

With section 6, lets say I've not installed unrar, maybe I only even have source files in a tar gz or a NAR, but I also completely and explicitly disagree with the unrar terms. Even if I don't trigger section 5 or some other section, I don't see how I'm protected from section 6. Surely just by disagreeing with the terms you're required by section 6 to never have any unrar source files on your machine.
If section 6 specified that it was post acceptance or post implicit acceptance after installation/execution it wouldn't be a problem but it's a stand-alone term IMO.
Even if the WinRAR team send an email explaining that's not how they view it IDK if that alone is enough if this did go to a court. (I'm aware many software licensing issues are purely discussed at a theoretical level and don't typically get tested in court)

---

For me this boils down to: does the license unfreeRedistributable currently block the execution of unrar without nixpkgs.config.unrar.acceptLicense? If it doesn't we should not use unfreeRedistributable because that means the hydra machines are all implicitly agreed. Anyone doing source rebuilds of software executing unrar is implicitly agreed.

If we do block execution until the license is explicitly accepted, maybe we can use unfreeRedistributable but I still think the whole angle of installation and implicit acceptance and the entirety of section 6 is very dangerous and a lot of pain for little reward IMO.
& IDK how setting a different value in nixpkgs.config.unrar.acceptLicense of hydra builds vs the default of nixpkgs itself would work for cache hits or misses.

Edit:

Hmm. It looks like unfreeRedistributable isn't built on hydra anyway? I'm curious what the point of the distinction is. Is it just a useful bit of data to filter on when populating caches generally?