4

Assume somebody writes software and distributes it to customers. Since any dependency under a copyleft license (such as the GPL) would require putting the whole software under a copyleft license, those are carefully avoided by checking license statements of all dependencies and (fully recursively) their dependencies.

Now imagine the following scenario: Dependency A is used, and according to the license statement, it is published under a permissive license (such as MIT, BSD or Apache). Now a contributor C writes some kind of new feature and puts a comment in the source code: "This feature is licensed under the GPL." The main author / maintainer M of dependency A overlooks the comment and approves the pull request. Also, there is no contributor's agreement explicitly stating that all contributions must be put under the license that already applies to A.

Questions

  • Am I correct to assume that while most of dependency A is under a permissive license, the new feature is under the GPL? This would imply that any software using A must meet all requirements of the GPL?
  • For anybody using dependency A, is there a practical way to check for subtleties like this?
Improve this question
1
  • Is it only a comment in the source code? "This feature is licensed under the GPL"? According to the GPL requirements themselves, if it's only a statement like that, it's not yet enough to license something under the GPL. One must actually include the GPL license text itself somewhere in the software distribution. Typically a file called COPYING or COPYING.GPL is used, but there's no rule that it must be in a separate file like that.
    – Brandin
    Commented Oct 4, 2022 at 6:30

1 Answer 1

Reset to default
4

As I understand it, A is likely some kind of library, currently permissively licensed. C has added a feature, which A's author has accepted, but C has made it clear his/her contribution is under GPL.

It is not enough for A to release the new version of the library as a sort of chimera, with different parts under different licences. (S)he must release the library in its entirety under GPL, which is generally thought to mean that software using it must also be under GPL (though as we make clear in two other questions, this is not yet known to be true). It you don't want to risk having to do that, don't use the new, relicensed version of A with your code.

In my opinion, A is currently not something you can safely use. A's author's failure to relicense should raise a big red flag that (s)he doesn't actually understand the ins and outs of free licenses, which should worry you because of your second question. When you use this - or any other - library, you're relying on its author and distributor to correctly track the licensing requirements of everything that went into it, and to correctly express that in the license of the library. Evidence that A's author doesn't fully understand free licensing is good reason to be worried that (s)he has not correctly tracked and expressed these.

Improve this answer
6
  • Thanks a lot! I thought more of a scenario where the new feature is created by somebody else than then original author (not necessarily using preexisting GPL code) - I have adjusted this in my question, but the consequences should be the same: Whenever you are using libraries developed by somebody else, you have to a) fully trust that the maintainer is correctly tracking license requirements or b) check all requirements yourself. Obviously, this is a tedious task and probably few people do it - but if you don't do it, are at risk of violating copyleft licenses.
    – otessa
    Commented Oct 1, 2022 at 9:09
  • @otessa I have amended my answer to better fit your edits. If you're happy with it, local etiquette is that you accept it by clicking the "tick" outline next to it, which puts the question to bed. If not, it would help if you clarified what question(s) remain unanswered, perhaps in a comment below your original question. Please accept my apologies if you already know all this!
    – MadHatter ♦
    Commented Oct 1, 2022 at 9:12
  • Thank you for the kind hint! I am happy to accept your answer. Apparently, I need more reputation to vote for it though.
    – otessa
    Commented Oct 1, 2022 at 9:20
  • 2
    I support MadHatter's answer. When scanning projects, specialized Open Source License Compliance software would likely find and highlight the comment in the source code "This feature is licensed under the GPL." If the question was an actual issue and not just an hypothetical question, then it would be nice of you to write to the maintainer M of the project and highlight the issue. B.t.w., you cannot license 'a feature' under GPL, you can only license actual code, therefore it would be necessary to take a close look at the way how contributor C has implemented and submitted it to the project.
    – Martin_in_AUT
    Commented Oct 2, 2022 at 10:17
  • Thank you for the additional explanations. No, this is a hypothetical question - fortunately, I have not seen this issue in a project yet. But I am still worried that this might happen and all license scan tools I know only check for license files included in the dependencies and not all of their source code. Of course, one could write a script to search for critical keywords such as "GPL" and "General Public License", but if some code component has a custom license, this will fail. Do you have any specific recommendations on how to avoid this problem as a consumer of dependencies?
    – otessa
    Commented Oct 3, 2022 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.