What sort of requirements apply to (A)GPL software on an SSH server?

Question

I'm trying to better understand the GNU AGPL. The only thing the AGPL is concerned with beyond the GPL is remote interaction:

if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version

Let's assume someone writes a shell (akin to bash) and licenses it under the AGPL. I then modify the shell and run the modified version on a server that other people have e.g. SSH access to. (I think this example is general enough to apply to other scenarios, such as a GUI app over VNC.)

The GPL FAQ appears to suggest my modified version need not make any offer of source in this case:

If a program is not expressly designed to interact with a user through a network, but is being run in an environment where it happens to do so, then it does not fall into this category. For example, an application is not required to provide source merely because the user is running it over SSH, or a remote X session.

So it seems my modified version is not required to offer up its source code by the "remote interaction" clause alone. However, there are other copyleft requirements of the AGPL, which take effect when I convey the modified version.

To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy.

To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.

You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: [copyleft provisions about releasing source etc.]

It seems that if I allow users to get a copy of my modified version (through e.g. scp), I have "conveyed" the modified version to them, and the various copyleft obligations of doing so now apply. In short:

• That users can technically use the program over the network means little, since the program is not designed as such.
• If I permit users to obtain a copy, then I have "conveyed" the work to them, and the copyleft provisions of section 5 apply.
• If I don't permit users to obtain a copy, it seems I haven't "conveyed" the work and would be safe from section 5 at least. (Interaction over a network alone explicitly does not constitute "conveying" a work. I may have propagated it, but this seems to have fewer strings attached.)

Is this understanding correct? Am I only obligated to offer source (and other such copyleft provisions) when I allow users to obtain a copy of the AGPL software in this type of scenario?

Related:

• a_guest's series of questions on an image converter that could become part of a web service. I believe this is a different problem - a_guest is worried about protecting their own program from becoming a component of a larger proprietary work, whereas this question deals with AGPL software available over a network in a sense not covered by section 13 of the AGPL.

Answer 1

After careful thought, I find I cannot agree with my colleague's answer. It is certainly true, as you show, that the GPL FAQ says that AGPLv3 s13 doesn't apply if "a program is not expressly designed to interact with a user through a network, but is [merely] being run in an environment where it happens to do so".

My problem is that s13 doesn't include that language. It says only, as you also note, that "your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version". Note the difference between "expressly designed to interact through a network" and "supporting interaction through a network". The latter is clearly a broader test; arguably, much broader.

Were this to go to trial, the FSF might reasonably be expected to file an amicus brief propounding their interpretation of their licence. The problem there is that courts sometimes reject such briefs. Courts sometimes feel that a licence should be interpreted based on what the licence says, not what its authors later say about it; a "four corners" interpretation, as the linked order puts it. So there's no guarantee that the FSF's viewpoint would even be admissible, much less persuasive.

And without that you're back to the test in AGPLv3 s13. One could argue that coding an application specifically to run on an OS that is globally-known to support network interaction out of the box, then hosting it on an internetworked example of such an OS, while failing to add tests to prevent non-local users from invoking it, was sufficient to "support interaction through a network". I don't say that such an argument would be persuasive, but it could certainly be made.

So my feeling is that if you modify AGPL software, and you host it in such a way that it's possible for someone to use it who isn't seated in front of the hosting system at the time, then you should be prominently advertising source availability to your users, and ready to satisfy requests for it. It's just easier and safer all round, and I'm glad to hear that you would do exactly that.

Answer 2

• That users can technically use the program over the network means little, since the program is not designed as such.

Yes. If we can believe the GPL FAQ, then if the program itself is not aware that the user is on the other end of a network connection, clause 13 of the AGPL does not trigger and you are not required to offer the source code based on that clause.

• If I permit users to obtain a copy, then I have "conveyed" the work to them, and the copyleft provisions of section 5 apply.

Yes. The normal GPL provisions apply in that case.

• If I don't permit users to obtain a copy, it seems I haven't "conveyed" the work and would be safe from section 5 at least. (Interaction over a network alone explicitly does not constitute "conveying" a work. I may have propagated it, but this seems to have fewer strings attached.)

If your users can only interact with the program over an SSH connection, but not copy the binaries to their own machine, then you have neither conveyed nor propagated the program. You have no obligation to provide the source code to anyone.