24

I have a client who sent me his source code for me to review. It was a non-paying job. His source code was clearly a heavy modification from a popular GPL-licensed software which I part-authored. I can see the original code (including GPL license headers) everywhere in the project. We didn't have any contract or agreement, simply email exchanges.

His application is commercial and he charges few dollars per download. However, he never stated his project is GPL, so nobody had asked him for the code.

Q: I have a copy of his application (I'm also his customer). Can I enforce GPL and distribute the application and source code?

NOTE: I'm 100% sure the seller isn't going to acknowledge his GPL commitment. It's a commercial software and he's selling it.

EDIT: I partly owned some of the original code (that was how I recognized the code) but I won't sue anything. It's just a tiny iOS app, I don't have time and money.

11
  • 2
    Are they distributing the source with what they are selling?
    – Honest Abe
    Oct 24, 2016 at 5:27
  • 2
    @HonestAbe No. Just the application, no source, no mention about GPL.
    – SmallChess
    Oct 24, 2016 at 5:28
  • 1
    Side note: I don't believe the GPL requires you to put a download link to the source code next to your app, just to provide the source on request. I could be wrong on that, but I'm not sure.
    – anon
    Oct 25, 2016 at 15:55
  • 3
    @QPaysTaxes They are at least required to tell you of your right to request the source code. It's been stated that they don't even mention the GPL, which is a violation.
    – Honest Abe
    Oct 25, 2016 at 17:05
  • 1
    If you and your co-authors don't seem intent to enforce GPL, I wonder why you would license the software with GPL in the first place. If none of the co-authors want to take this up for this company or any other future companies either, then perhaps, with the approval of your co-authors, you might have wanted to relicense the work with a more liberal license like MIT or BSD. Then you might want to work out a notice to the company to get them formally relicensed.
    – Lie Ryan
    Oct 26, 2016 at 7:20

7 Answers 7

2

I'll be refering to Version 2.0 from here: http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt But it should apply to 3.0 as well.

Following facts things are important here, and my answer is based on those:

  1. Code was sent to the Author on purpose (he didn't gain access to the code illegaly).
  2. The code contains GPL headers.

Regardless if you bought it or not, the important part is that the code was received. Paragraph 1 of GPL clearly states that:

You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty;

Now on top of that:

  • The fact that they broke the GPL does not void your rights (See Paragraph 4).
  • They couldn't even restrict you from redistributing it even if they thought of it! (see paragraph 6).
  • You don't have to buy the GPL code to be bound by the licence, you're bound by GPL every time you download Linux for free. The important part is receiving the code, by any legal means.

So the moment you've received the code (you don't even have to buy it!) you've been granted all the rights given to you by a licence. Congrats.

Now for the rights:

  • Make copies of the application and resell them (Paragraph 1).
  • You can resell your application.
  • Publish the application for free.

So to summarize: yes. You can do anything you want with it. You can publish it for free, you can sell it compile (as long as you keep GPL terms from paragraph 3), it's irrelevant how you've received GPL code, or if you've paid for it.

PS. One last gotcha, and as usual the devil is in the details. As some of the other answers stated the fact that he's breaking GPL does not automatically license his code as GPL. So again it all comes down to: Does the file and/or project have GPL licence/headers. If the project you've received include GPL licence and in README for example it's stated that project (as a whole) is under GPL, then you're good. If it does not it's more tricky. It can be assumed that if the file was modified and in the header there's a GPL licence then the modifications were bound by GPL, however new files without the header, are not, and you cannot redistribute them unless given permission.

7
  • Warning the answer of Marcin Raczkowski is not necessarily true. The code you received could not be under the GPL! The costumer could have put your code together with some third party code, which is incompatible with the GPL. (For example any proprietary code of a third party). Then the code you received will not be under the GPL.
    – user6574
    Oct 27, 2016 at 7:49
  • 2
    That's not because this is the answer you would like that this is the right answer. This answer is assuming that the application that you bought was licensed under GPL. If it did not come with a GPL license notice, which was obviously the case that you described, then the app is not GPL. It is just in breach of the license of the software it is based on.
    – Zimm i48
    Oct 27, 2016 at 11:00
  • I can see the original code (including GPL license headers) If it does include GPL headers, then it's licensed under GPL. Most GPL headers clearly state this code is licensed under GPL and you can get a full copy of licence here-and-here. I was operating under that assumption, and my answer is based on that. Again Paragraph 6 - the fact that The seler broke licence does not mean the licence lost its validity for clients. And again you don't have to buy the code. You just need to receive it as the author did. Oct 27, 2016 at 11:25
  • You are giving a different argument in your comment than in your answer: in your answer you are saying "you are the customer..." AFAIU as the customer, he did not get the code. He did get the code as the "unpaid contractor". That's right that it should allow him to redistribute the source further under normal circumstances. But here, it is clear that this was "accidental licensing". I wouldn't be too sure of what a court would say in such case.
    – Zimm i48
    Oct 27, 2016 at 11:31
  • 1
    @MarcinRaczkowski well it does matter. If the OP were working internally for the company that wouldn't be considered receiving the code. Of course this is not the case and your answer stands because there is no contract between the two parties. Oct 28, 2016 at 10:54
34

I don't think you can distribute the code, but I think you can sue the guy. You're the copyright owner ("you" meaning you and your co-authors), and he's a licensee, under the gpl. He violated his license agreement, and that gives you a civil cause of action against him. But I'm not a lawyer (though my father, brother, ex all are), so you might want to check with the free software foundation about exactly how to go about all that.

And by the way, stop calling the guy your "client". He's an acquaintance for whom you're doing a favor, reviewing his code. For him to be a bona fide client, there must exist a contract between the two of you. And you said he's not paying you. One of the requirements for a contract to exist is called "consideration", an exchange of goods and/or services. But you got nothing in return for your code review service. Hence, no contract and no client, period. And you have no professional obligation to the guy, period.

8
  • 2
    The OP never said they were the copyright owner. And frankly what are the benefits of suing when things could be resolved other ways? Oct 24, 2016 at 15:32
  • 3
    My bad, it is actually mentioned further down in a comment ... this makes the question's answers rather weird for sure. Oct 24, 2016 at 15:35
  • If I don't have professional obligation, that means I can redistribute the modified code without asking for permission?
    – SmallChess
    Oct 25, 2016 at 9:12
  • 2
    @StudentT: No because then you would be infringing on his copyright (the fact that he infringes on your copyright does not give you any legal right on his).
    – Zimm i48
    Oct 25, 2016 at 12:28
  • 1
    So I just looked this up and apparently it can be either, depending on the case (even in the US).
    – user541686
    Oct 27, 2016 at 0:00
26

If he's distributing software derived from GPL code, one of the following must be true:

  1. The derivative work is licensed under the GPL.
  2. He's using the GPL code under some other license from the original author.
  3. He's violating the GPL.

If it's the second or third possibility, then you have no license to redistribute his changes to the project.

Edit: If he's violating the GPL, his violation doesn't automatically put his code under the GPL. But as a copyright holder of the GPL code he modified, you could demand that he either license his version under the GPL, or stop distributing it. Or you could propose licensing the original version to him under different terms, if your co-authors agree.

14
  • 8
    This can't be (2) because I'm one of the original authors and he never asked me. That's why I recognized the code.
    – SmallChess
    Oct 24, 2016 at 5:23
  • 3
    @StudentT Are you also a copyright holder on the original code? (You are by default unless it was a work for hire or you assigned your copyright to someone else.) Oct 24, 2016 at 5:34
  • 1
    I'm the secondary author. I licensed it out the source code with GPL. I partly own the original code, but not the new modification.
    – SmallChess
    Oct 24, 2016 at 5:35
  • 2
    @JamesSnell I believe the point is that code does not become covered by a license "automagically," or "on its own." A license has to be applied to it explicitly. Of course, distributing without having applied the GPL is a suable license breach, but if you receive such a distribution, you have not received it under terms of the GPL and cannot thus use it as such. Oct 25, 2016 at 6:56
  • 2
    @JamesSnell Yes, if you distribute it, you must do so under the GPL, otherwise you're breaching it. But you still can distribute it not under the GPL, just like you can break the law, event though you must not. The distribution act itself does not apply GPL to the code, that's what I meant. Oct 25, 2016 at 9:42
11

I have a client who sent me his source code for me to review.

If I have a "client", then this means I have likely some commercial contractual relationship with this company. And if this client sent me the source code for review, there is likely some trust and strong relationship in place.

Therefore I will consider both the open source aspects and my business relationship in this context.

It was a non-paying job. His source code was clearly a heavy modification from a popular GPL-licensed software. I can see the original code (including GPL license headers) everywhere in the project. We didn't have any contract or agreement, simply email exchanges.

If we did not have any agreement in place either explicit or implied, I am wondering how this could be a client of mine in this context.

His application is commercial and he charges few dollars per download. However, he never stated his project is GPL, so nobody had asked him for the code. Q: I have a copy of his application (I'm also his customer). Can I enforce GPL and distribute the application and source code? NOTE: I'm 100% sure the seller isn't going to acknowledge his GPL commitment. It's a commercial software and he's selling it.

The context is rather unclear: I do not seem to be sure that I am the customer of this business or that this business is my client, or both.

In this context, I can do two things:

  1. Do the right thing: I could advise my client about this possible GPL compliance issues they are likely facing. I would not assume anything about their willingness to comply. I would contact them and alert them to the facts I have noted and tell them I want to ensure that I can use the rights granted my by the GPL. From experience most companies want to do the right thing and are just unaware about the fact there are things to do to be compliant. I would also note that there are no conflicts with the software being sold: this is fully allowed by the GPL.

  2. Do the mean thing: I could ignore anything about any relationship I have with my client and I can use the rights granted to me by the GPL license and redistribute the application and source code. Doing this without a discussion would likely be rather irresponsible though. It is likely to be illegal as pointed by MSalters. This is likely to draw me in unwarranted problems and conflicts and damage my relationship with this client or customer. So unless I have a strong reason to enter such a conflict, I would take the high road and use approach 1.

Now, your question is missing a rather important point that you only mentioned in a comment to another answer so far:

@StudentT Are you also a copyright holder on the original code? (You are by default unless it was a work for hire or you assigned your copyright to someone else.) – Kevin Krumwiede

I'm the secondary author. I licensed it out the source code with GPL. I partly own the original code, but not the new modification

So I am after all the original author or a significant author. If I am the original author, then things are rather different. The first thing I would do is contact the culprit in all cases as explained in 1. above.

Then the other important thing is which version of the GPL is used. With a GPL 2.0, the license terminates immediately with no easy way to reinstate it. With GPL 3.0, there is a bit more flexibility and no immediate termination. What really happens/can happen depends a lot on this.

A third possibility to consider could be that in conjunction with 1. I could thank my client/customer for their contribution back to my GPL-license codebase and say I will integrate this in future releases...

7
  • 1
    "With a GPL 2.0, the license terminates immediately with no easy way to reinstate it." Under what conditions? Are you saying that the OP contacting the company causes the GPL license to terminate?
    – Ajedi32
    Oct 24, 2016 at 18:40
  • 2
    @Ajedi32: A GPL 2.0 license terminates when the distributing party does not obey the terms of the license. Hence, even if the company was a GPL v2 licensee at any point, they no longer were at the moment they first sold the software without acknowledging its origins. (This applies only to the particular work; they might still have a GPL v2 license for e.g. Linux). This is important : the author is one of the co-authors, and cannot reinstate the GPL v2 license on behalf of the other copyright owners. The company has a serious problem.
    – MSalters
    Oct 24, 2016 at 22:48
  • 3
    Option two is illegal, if I understand your proposal correctly. The company is distributing copyrighted content, in violation of national law. Since no contract exists (the GPL v2 license auto-terminated), only the legal violation remains, and only a legal remedy according to national law is possible. And I'm pretty sure the law does not allow option 2.
    – MSalters
    Oct 24, 2016 at 22:54
  • Right, what your propose in option 2, and in your third possibility, is a plain copyright infringement. If the company sued the OP, the OP could counter-sue but their position would be weakened.
    – Zimm i48
    Oct 25, 2016 at 12:32
  • Paragraph 4 of GPL clearly states that violating GPL does not void rights of clients that received the code. Oct 26, 2016 at 17:47
6

If you did not receive his code under the understanding it is licensed under the GPL, you have no right to redistribute it. Period. Not even if you are one of the original copyright holders (as you explain in comments rather than the original question: please update the question).

Your acquaintance has every right to use GPLed software for internal use (including running publicly accessible servers unless we are talking the Affero GPL in particular) without making sources accessible. The point when he is selling or otherwise distributing software to third parties is where the GPL kicks in and demands that he gives the recipients the source code or access to the source code of the whole, modified software under the conditions of the GPL.

As you describe it, he is in breach of this requirement of the license he received the source code under. The only legal consequence of this is that the original license holders (apparently including you) can sue him to cease and desist distributing copies in violation of the license he can avail himself of.

If you were no copyright holder yourself but noticed this, the only option would be to contact one of the copyright holders and inform him of the breach and leave any further action to him. This would be a breach of confidentiality and you'd have to judge what that means for your business.

As you actually are one of the copyright holders, this particular worry does not apply to you.

However, the person in question would be abysmally stupid not to notice your name in the license notices and still ask you for changes, so what is up with that? Are you sure you are an actual copyright holder in a sense that is strong enough to make your legal claim stick well?

At any rate, you don't seem like the sole copyright holder anyway. You might ask the FSF's copyright clerk for some advice on how to proceed: the FSF has particular experience in getting people to comply with the GPL without dragging them to court. This saves time, money, bad blood. And particular in your situation, you might want to get the issue resolved in as professional and amicable manner as possible if there is any chance since it also talks about your professional behavior and how you behave in business matters.

1

As a customer, whatever you got through a purchase may be redistributed per the terms of the GPL. Make sure the seller acknowledges it is GPL licensed before you do so, to ensure you aren't mistaken about it being GPL.

As for redistributing code that you got for review, that is a definite fuzzy ground that isn't a clear answer to, and is beyond the scope of this site's capacity to answer.

6
  • Unfortunately, a commercial seller will never acknowledge GPL. This isn't going to work.
    – SmallChess
    Oct 24, 2016 at 1:11
  • 1
    That's not true. Regardless, if the seller is violating the GPL, then see gnu.org/licenses/gpl-violation.en.html Oct 24, 2016 at 1:18
  • 1
    @StudentT Well they have to either do that, stop selling it, or risk getting sued. Which of those options do you think is best for them? (Actually in practice "risk getting sued" tends to be a good option because most GPL copyright holders can't be bothered to sue them...)
    – user253751
    Oct 24, 2016 at 8:34
  • 1
    @immibis Going to court for GPL only exists in corporations. I don't have time and money to do that.
    – SmallChess
    Oct 24, 2016 at 8:35
  • 2
    @StudentT: A former employer of mine - billion dollar plus turnover - settled a GPL case out of court, which was brought by an individual. It's fundamentally not a very complex lawsuit. The company cannot argue that they have a license (which?), they cannot argue they wrote the software themselves (they sent you your own source code!), so the copyright violation is a given. Getting the ball rolling might take a few letters; once you pay to file a suit you can start to look into recovering legal costs as well (this is a real additional threat; recovery is likely)
    – MSalters
    Oct 24, 2016 at 23:13
0

Note: The OP said in some comment that he does partly own the copy-right of the code questioned.

"NOTE: I'm 100% sure the seller isn't going to acknowledge his GPL commitment. It's a commercial software and he's selling it."

Sorry but this does not make any sense. Note that selling the software this is allowed under GPL https://www.gnu.org/philosophy/selling.html Probably it is worth reading https://www.gnu.org/philosophy/categories.html But it is of course bad style not share the money he is making and moreover, not even paying you for code review.

The question is does he ship his software under the GPL?

You said it is some app. I do not know how this then works. But putting the code (with license) in some online repository (could be only accessible to the paying customer) and linking to it should be allowed. At least I saw this with other GPL'ed apps (although I am no lawyer).

Question, are the GPL licenses headers in every file he sent you?
Is there maybe even the GPL copy right text as a file in it?

If this is both true then I see no problem, the code is under GPL and you can use it. If the license file is missing then this is bad style, but it should still be under the GPL (but again I am no lawyer). Tell him he needs to put license file in. Both of the answers to the last two questions are negative, then he does violate the GPL. You should tell him to get the copy-left right. And then resend you the files.

If he refuses then sue him.

3
  • You miss the point. The seller isn't going to acknowledge it, no matter what GPL license we can get on the Internet. The GPL headers are in some of the files.
    – SmallChess
    Oct 25, 2016 at 11:55
  • I'm not a lawyer, but as far as I know, courts have been pretty reluctant to enforce "accidental licensing". That is to say, even if someone sent you their code with a GPL header attached, and even if the code was a derivative of GPLed code (and so they were legally forbidden from distributing the it except under the GPL), if it wasn't clear that they intended to release it under the GPL, a court would be more likely to find them in breach of copyright (due to violating the GPL) than to find that they had unintentionally GPLed their own code by distributing it. Oct 25, 2016 at 12:38
  • 1
    ... That said, a simple way for the OP to settle that issue would be for them to email the "client" and ask if they really meant to distribute the code under the GPL. The OP might also want to note that, if the answer is "no" and they still keep distributing the app even after having the GPL requirements pointed out to them, that puts them in willful violation of the GPL, and allows the OP to sue them (or, say, assign their copyright to the FSF and let them handle the potential lawsuit) with a fair chance of winning. Oct 25, 2016 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.