Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I create a closed source application which uses some GPL licensed libraries but don't actually distribute the software, only its output, can I keep the software closed sourced?

Specifically, I am talking about a biological data analysis pipeline. Internally, our software will be using some GPL libraries to generate its output. However, the software itself will not be distributed. Users will either receive a virtual machine with the pipeline set up which they can run locally, or submit their input data to us and access their results from a web interface.

In other words, the product distributed is not really the software itself but its output. If the software is calling dynamically linked, GPL licensed libraries, will I need to make the entire project GPL?

I have read the GPL FAQ and I think that this one may apply:

A company is running a modified version of a GPL'ed program on a web site. Does the GPL say they must release their modified sources? (#UnreleasedMods)

The GPL permits anyone to make a modified version and use it without ever distributing it to others. What this company is doing is a special case of that. Therefore, the company does not have to release the modified sources.

It is essential for people to have the freedom to make modifications and use them privately, without ever publishing those modifications. However, putting the program on a server machine for the public to talk to is hardly “private” use, so it would be legitimate to require release of the source code in that special case. Developers who wish to address this might want to use the GNU Affero GPL for programs designed for network server use.

If I understand the above correctly, that means that using it internally to produce the data served by the web portal would be OK. If so, how about when I distribute the VM with the software set up? Would that constitute "distribution" of the software?

share|improve this question
8  
"Users will either receive a virtual machine with the pipeline set up which they can run locally" - ah, so you are distributing the software? – immibis Jan 13 at 21:35
4  
VM image is no different from a zip file when it comes to software distribution. Binaries can certainly be extracted from it, so you have to provide the source code. – Dmitry Grigoryev Jan 14 at 11:16
    
Are you sure the libraries are GPL and not LGPL? – pjc50 Jan 14 at 19:01
    
@pjc50 yes, lgpl allows dynamic linking which is all we would be doing. – terdon Jan 14 at 19:02
1  
@DmitryGrigoryev, that the executables can be "extracted" is irrelevant, I get binaries as a par of the VM image, thus they are distributed to me. – vonbrand Jan 27 at 0:30
up vote 27 down vote accepted

If it helps, the abstract point of GPL is full ownership of your own computer. If someone else can say "hey, you can't peek inside of this code on your computer!" then that stands as a barrier to your full ownership. That's what the GPL's vision of free software is fundamentally about: I have this computer with programs that I have bought, I should be able to modify those programs so that my computer does exactly what I want it to do. Of course, most computers these days have some corner which is not free in this sense. But that's what GPL is trying to provide: "this corner of the executable code is something which you legitimately, fully own -- it's not on loan from some mega-corporation, this chunk of code, you can do whatever you want, up to and including debugging it, printing it onto underwear, giving it to a friend, incrementing all the bytes by 1, or playing it as a symphony." You fully own that part of your computer. (There is a tiny legal corner which you can't own, which is the ability to strip the copyright and software from their lawful owners, but that is pretty much endemic to the system and kind of a non-starter.)

So, software licenses will either get in the way of this full ownership (as proprietary ones often do) or facilitate full ownership (as open-source ones often do). If they facilitate, they might try to also facilitate other peoples' full ownership of copies (as copyleft ones like GPL do) or just your full ownership (as non-copyleft ones like BSD, MIT, LGPL do). Non-copyleft licenses basically say, "here is this stuff, we hold the copyright, it is a condition of this license that you promise not to sue us for anything, and we promise not to sue you for anything either." Very simple. Copyleft ones are more complicated.

This is why GPL does not say "anyone who modifies the source code must release their modifications for free to the public" -- which before GitHub was an awful barrier to controlling your own computer, since most people didn't have a reliable place to publish software, and it is still a barrier. (It's just not quite so awful these days but it would still suck, if every modification required a publication. That would be a barrier to controlling your own computer.)

Instead the GPL says "if you hand this program with your modifications to someone else, you have to give them (and only them!) access to the source code under this license, so that they can fully own their computers just the same as you could." That's less onerous: it's not public publishing but just, "hey, man, do you want me to include the source files? I might have introduced a bug with my modifications..." that you're responsible for. The source code is only free-as-in-beer because the financial cost of releasing the source to this other person is expected to be covered by the amount they paid you for you to hand them the program in the first place.

Therefore: If this program runs on your server, nobody else's, and other people only interact with the program by sending packets to your server? No source code release is needed. That's your computer, nobody else's. Since your code doesn't execute on anyone else's machine, they cannot demand to see the source for the running program. On the flip side: you give these people a computer program (a virtual machine) which contains your modifications to the GPL'ed program, so that they can run it? BZZT, GPL violation -- unless you keep ownership of the computers too and insist on a dominant-subordinate relationship, "we own and administrate the computers, we're giving you permission to use them, we expressly forbid you from copying the software on this computer to your own machine." Because if they are running your modifications as executed instructions on their own computers, then the GPL says that whenever you "conveyed" this software to them, you must also "convey" the source code so that they may have full ownership of their copy of the software on their computer.

share|improve this answer
2  
That's a useful explanation. Welcome to OS! – ArtOfCode Jan 13 at 18:16
    
@ArtOfCode Thanks! – CR Drost Jan 13 at 18:18
2  
Wonderful explanation. I always wondered how the free software movement is different from open source, and I can see that now. – Prashanth Chandra Jan 14 at 12:38
1  
Great answer. I would suggest that you include a bit at the bottom on how licences like AGPL may differ when run on your server if you allow users to "interact" with it.. – Bob Jan 14 at 15:28
3  
Do note that it would be perfectly valid to sell them the VM image which includes the source to your new application with the caveat that, while they're legally allowed to modify and redistribute your application, if you find out they've done it that will be grounds for terminating their support contract with no refund and never selling them a new version ever again. There are a number of groups that have adopted this business model since virtually all code requires updates, so unless your code would be easy for some other group to pick up and maintain it's a pretty good deterrent. – Perkins Jan 14 at 23:14

Generally yes, the output is not covered by the license. However you say you will redistribute the virtual machine with the pipeline setup.

Nope, providing the virtual machine with executable binaries is the distribution of the executable binaries so please source code on the table. Just wrapping the virtual machine around does not change anything.

share|improve this answer

Distributing the Virtual Machine with the GPL-including-Software and not providing the sources (and/or the possibility to download/receive them) along with a GPL License notice is clearly a violation of the GPL itself.

Furthermore and if the Virtual Machine is based on a Linux distibution, distributing the Virtual Machine without the GPL'ed sources, i.e.: kernel and others (and/or the possibility to download/receive them) and a GPL notice would also constitute a violation of the GPL.

And the chaintool to recreate the binaries (you may provide your own proprietary barts as binary blobs) in the distribution must also be provided.

A real life example which covers this case

  • An ADSL router manufacturer provides only a "Box" which takes input and produces output. The manufacturer is forced to release the sources (given almost all of the routers are Linux based) and the chaintool to recreate the firmware image. Of course some manufacturers attempt to forego the obligation, with some of them having been successfully sued.

P.D. Yes, Tivo is also a device manufacturer and found a loophole in the GPLv2 to avoid loading modified firmwares and hence the GPLv3 special provisions to close that loophole.

share|improve this answer

There is an exact duplicate of this question here on Programmers.SE.

Yes, your understanding is correct. According to GPL, having a program run entirely on a server and accessing its output from a networked client doesn't constitute distribution (or in GPLv3 language, conveyance) to the client. Obviously this seems like a loophole given the philosophical goals of GPL, which is why the AGPL was created, to ensure that the copyleft clauses apply even in this scenario.

This is also why companies like GitHub (which uses git, GPLv2) or StackExchange (which uses Wordpress, GPLv2) don't have to open source their code, as interacting with their websites doesn't constitute distribution according to the GPL.

Just be wary of the language used in the GPL FAQ; saying "it would be legitimate to require release of the source code" doesn't mean you have to release source code, only that in GNU's opinion, this would be in the spirit of GPL.

share|improve this answer
    
Thank you, your answer and the one on Programmers address the web portal but how about the case where I would provide a client with a virtual machine where the pipeline is set up? Would that constitute distribution? – terdon Jan 13 at 13:04
6  
@terdon IANAL but I can't see how distributing SW on a VM can not be distributing software... the user ends up with a copy of the software, I wouldn't have thought it mattered whether it's as discrete files, a ZIP/tar file or an MSI etc. – TripeHound Jan 13 at 13:45
1  
@terdon you don't seem to get it, yes without any shadow of a doubt it is distributing. How dare you give (me say) something DERIVED from GPL things without (being willing to give me) the source code too. This is the point of the license. – Alec Teal Jan 13 at 20:11
    
@AlecTeal I have been using foss software pretty much exclusively for the past 20 years and have been a staunch supporter of open source in general and the GPL in particular for just as long. Every project I have ever worked on has been released under the GPL. I "get it" just fine, thank you, and there's no call for you to take that tone with me. This question is about a future project of someone I am collaborating with and who, for various reasons, cannot take the foss route. – terdon Jan 13 at 22:22
1  
@terdon then why are you asking this question? Your question asked "can I distribute a VM with GPL derived stuff on it" in 20 years you didn't pick any of that sort of logic up? Also calm down, it's not like someone's taken your GPL work and given out a binary without giving you credit or anything! – Alec Teal Jan 13 at 22:48

Be careful. Some uses of a program or library include parts of it in the result. Quite unlikely for a library, but a tool like e.g.bison writes a program that contains pieces of the source. In fact, bison is under GPLv3 with a special exception. Also, a compiler like GCC does something similar, and has also a similar exception to it's license.

share|improve this answer
    
Thanks, good to know. Any idea whether distributing a VM with the software installed constitutes distribution of the software? – terdon Jan 13 at 13:11
1  
@terdon, that is another question. And, even to me as a complete non-lawyer, it is distribution unless you stay in complete control of the VM on which it runs at all time (like it was a physical machine you lend with your program). And in that case I'm not completely sure it isn't distribution... – vonbrand Jan 13 at 13:13
1  
That's the question I was actually asking. Perhaps I didn't make it clear enough. OK, thanks. – terdon Jan 13 at 13:23
    
@terdon: Yes you have to release your source code if you distribute the VM. But note, you don't have to release it to the world. Only to the person you sold/gave the VM to. And only if he ask. This is the gentlemanly unspoken agreement in the utilities industry. Lots of vendors use GPL software and must provide the source to the client. But your telco/power utility/water utility provider will also not want that source to be exposed to the public for fear of hacking. So the public don't get the code. – slebetman Jan 14 at 9:27
1  
@vonbrand: Renting out a machine, physical or virtual, with GPL software on it? That's a "consult your lawyer" case. I'm inclined to treat it as a distribution, if only because a 99 year lease is de facto a sale. – MSalters Jan 14 at 16:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.