Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have noticed that some groups or organizations convey the GPL software without the source code. Such examples are:

Some of them, that I have asked, said, "we copied it from Debian/other operating system and look for sources there". But that is by my opinion not in accordance with the GPL licenses. For example kernel of GNU operating system, Linux, is licensed by the GNU GPL Version 2 and by reading it, I understand that every distribution of software shall give the source code.

share|improve this question
up vote 13 down vote
+150

but that is [in] my opinion not in accordance with the GPL licences

I agree with you. The GPL has always been pretty clear that you need to supply source if you're propagating binaries, and various authorities have opined that pointing to someone else's repository is not sufficient, eg

companies who redistribute software packaged for them by an upstream vendor cannot merely pass along the offer they received from the vendor; they must provide their own offer or corresponding source to their distributees.

Sadly, it is far from the worst violation of the GPL you'll see out there. Some people make very significant changes to GPL codebases like the Linux kernel and sell the resulting binaries without releasing major parts of their codebase at all.

But the only people who have standing to use the law to rectify this are the copyright holders themselves.

If GPL violations like these trouble you, and you'd like to do something about it, one positive step you can take it to support projects that assist the rights holders in taking legal action to compel compliance. This includes projects like http://gpl-violations.org/ or the Software Freedom Conservancy.

share|improve this answer

Some of them, that I have asked, said, "we copied it from Debian/other operating system and look for sources there".

No, it's PERFECTLY LEGAL. Note that wording changed between GPL v2 and GPL v3 but from 6.b about Conveying Non-Source Forms of GPL v3 license (emphasis is mine):

Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.

They should provide a written link to that repository (license requires an access with a reasonable effort for end-user). Note that when 6b doesn't apply then they are in case described by 6d and same reasoning is valid.

For example kernel of GNU operating system, Linux...

True. Note that kernel is licensed under v2 (exactly 2.0, not any other) and things are little bit different in wording (because v2.0 is an old license when network availability was not so wide. From 3.b you know that:

[source code] to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or...

Note that generic wording "...medium customarily used for software interchange...". Nowadays Internet access is absolutely a medium customarily used for software interchange. Also note that again is required a written note about where you can get source code.


I didn't download those ISOs but I'd guess they include required information. I'd define this behavior sloppy but not criminal (because license violations are criminal acts.)

As final note please do not forget that inside Debian distro there are software distributed with many different licenses (not only [L]GPL), that's a good reason to keep license information (it's pretty important) inside ISO where individual licenses can be addressed correctly. A real-world example of this? If you have an Android device you know...

What I'd suggest is to simply contact them and explain your perplexity about license terms. I think it may be ethical to provide required information in a more prominent place but legally speaking (however note that I'm not a lawyer) they're right.


Next paragraph isn't an answer to your question and it's just my very personal opinion about this topic. I guess it will be unpopular but that's it...

<rant>Open Source licenses are made to protect your rights to access source code, change it and improve your knowledge. To be useful they must be reasonable and compatible with real-world. Sadly there are many serious violations - not always in bona fide - however tilting at windmills doesn't help and it may be counterproductive.</rant>

share|improve this answer
3  
GPLv3 6(b) only applies to physical conveyance of the object code, ie, selling a distro DVD or a widget. For object code made available over the network, such as both the examples the OP quotes, 6(d) applies, and the projects must "maintain clear directions next to the object code saying where to find the Corresponding Source" (my emphasis). Neither project is doing so, and when the question is put to them (as it apparently has been), they should have acted to put it right, not merely told the enquirer to get it elsewhere. – MadHatter Mar 9 at 16:37
    
I would also add that I didn't propose the OP reported anyone to anyone - not least because (s)he doesn't have standing to pursue a licence violation complaint, not being the licensor. I suggested that (s)he, and others, support organisations that help licensors bring such actions - and both those I quoted have very much a policy of constructive engagement first and legal action only as a last resort, as you recommend. – MadHatter Mar 9 at 16:39
2  
Yes; GPLv3 does permit that, but not under section 6(b), which only applies if you "convey the object code in, or embodied in, a physical product (including a physical distribution medium)". Please read what I wrote. – MadHatter Mar 9 at 16:41
1  
If it's not under 6b then it's under 6d (source located on your or 3rd party servers). In both cases you're allowed to keep sources on an accessible internet server (you need only to put somewhere a link back to that server). You're not required to do anything else (no need to distribute sources together with binaries, no need to put sources on your own servers, no need to put them on same server where binaries are located). Spirit of the license is to make source code practically available to anyone who wants it. Nothing more and (obviously) nothing less. – Adriano Repetti Mar 9 at 16:45
2  
Yes, it can, but the requirements of 6(b) apply only to conveyances that are made via physical device. If you also convey via network server, 6(d) applies to those conveyances. You can't just magically exempt your network server conveyances from 6(d) by giving a single DVD to a friend. The Android device issue is probably not relevant to this conversation, as the Linux kernel is not licensed under GPLv3. – MadHatter Mar 9 at 16:52

The GPL does not require you post your distro . You are free to make modifications and use them privately, without ever releasing them. This also applies to organizations (including companies); an organization can make a modified version and use it internally without ever releasing it outside the organization.

But if you release the modified version to the public in any manner, the GPL requires you to make the modified source code available to users, under the GPL.

Thus, the GPL gives permission to release the modified program in certain terms and not in others; but the decision to distribute looking at you.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.