Is the process to set up, install, and implement GPL-3.0-only software considered proprietary?

Question

I've arranged for a software provider to install a free and open-source application on a server. The application is licensed under GPL-3.0-only.

The software provider has installed the software onto the server (the installation took a couple of days).

The software provider claims that the process to setup, install, configure, and implement the application is proprietary.

They consider the implementation process as copyrighted original creative work. They've also stated that their installation includes proprietary copyrighted components belonging to them.

They won't allow me to use a third party to backup the server as it will breach the copyright of their work/install. They would like to provide a server backup and charge a fee for doing this.

Does the GPL-3.0 license allow them to place this restriction?

Answer 1

They consider the implementation process as copyrighted original creative work.

I don't know how faithfully you've reported their exact words/meaning, but a process is not copyrightable. All copyrightable works consist of some sort of fixed tangible expression (text, video, sound, images). Furthermore, U.S. law (e.g., case law such as Baker v. Selden) makes clear that the copyrightable expression of a system offers no monopoly on outside implementations or descriptions of the system itself. Other jurisdictions probably have similar rules but I can't say for sure.

They've also stated that their installation includes proprietary copyrighted components belonging to them.

This begins to approach plausibility. However, any work of theirs that is legally a derivative of the original GPL work can only be offered to you under the GPL.

If their installation process makes use of (1) material of their original copyrightable authorship that (2) isn't a derivative work of the GPL software (for example, perhaps some proprietary general-purpose software of theirs, used to replicate execution of programs across multiple machines), then they may forbid you from distributing that completely-separate piece of software.

Even if this is the case, copyright can't prevent you from sharing not-copyrightable output of their tools. Trade secret law might enable them to forbid you from distributing the output of their own tools that exist independent of any GPL software, but (at least in the U.S.), this would require having you sign NDAs prior to letting you see anything they wish to claim is protected. Anything they wish to claim protection for under trade secret law could not be a derivative of any GPL work (at least, not without them being in violation of the GPL work's author's license terms and leaving them liable for copyright infringement). Additionally, I don't see how a privately-held backup would be problematic from an NDA perspective (in that you don't actually disclose it to a third party) but I also have low familiarity in this field of law.

I don't know to what degree their installation process actually integrates with the GPL software. I can envision installation systems that are strongly derivative of the software, and other orchestration systems that operate agnostic to what specific software they install, and some types that exist somewhere in between. If their installation system is legally a derivative, under copyright law, then I see no legal way they can make it (or its byproducts) available to you under any terms beyond the GPL itself.

The fact that they claim their "process" is copyrighted, despite this statement being a category error (processes are not copyrightable) suggests to me they do not have a rigorous theory of law in mind when trying to forbid you from performing backups.

Answer 2

I've arranged for a software provider to install a free and open-source application on a server. The application is licensed under GPL-3.0-only.

[...]

They've also stated that their installation includes proprietary copyrighted components belonging to them.

So,

• you hired them to install a GPL-3.0 application on your server, but

• instead they installed the GPL-3.0 application plus some proprietary component without your permission.

IANAL (and you should double-check your contract first to make sure you really hired them only to install the GPL-3.0 application), but if we take your question at face value, they abused access to your server to install stuff you did not allow them to install. This sounds (at least) like a breach of contract (again, if we take the wording in your question at face value) and (at worst) like something borderline illegal (depending on your jurisdiction).

If you're generous, you might want to give them a chance to remove their crap and install (only) what you hired them to install. If you're not, lawyer up.

Answer 3

Heavily revised.

Disclaimer: I am not a lawyer, much less your lawyer, and this answer does not provide competent legal advice.

The software provider claims that the process to setup/install/configure/implement the application is proprietary.

That's plausible, but irrelevant. The software provider has executed their proprietary procedure on your server. It's now done. That the process is proprietary does not in itself place any obligations on you.

They consider the implementation process as copyrighted original creative work.

That could conceivably be supportable (though more likely not), in the same sense that a performance of a symphony can be copyrighted. But that's also irrelevant. Any such copyright they have protects against you copying the performance, which you have no way to do anyway, having not recorded it. Copying the contents of the server after the fact is not the same thing as copying the installation process itself.

They've also stated that their installation includes proprietary copyrighted components belonging to them.

That could be true.

They won't allow me to use a third party to backup the server as it will breach the copyright of their work/install.

Meaning, you've clarified, that they demand that you not engage anyone else for backup services, not that they can physically or electronically prevent you from doing so.

In the first place, then, you should consider whether they have a leg to stand on under copyright law generally. You didn't say where you are, but in the U.S., the Copyright Act permits you to make a backup ("archival") copy of computer software, though not necessarily of other digital materials.

This is where you review your agreement with the software provider, or have your lawyer do so. It is possible that the agreement holds that you waive your rights to make backups, or that it gives the software provider an exclusive right to provide backup services. If it does not do either of these things, and if U.S. law or a law with similar provision for software backups applies, then no GPL-specific analysis is required.

---

But if you're not so lucky,

Does the GPL-3.0 license allow them to place this restriction?

Does the GPL permit them to forbid you to make copies of their proprietary, non-GPL components? The GPL does not apply to such components.

Does the GPL permit them to create a proprietary derivative of GPL software? Yes, it does, but it does not permit them to convey a derivative of GPL software to a third party (you) under terms other than the GPL, which permits you to make copies as you like. Furthermore, the provider would be obligated by their license to provide source to you on request.

Does the GPL prevent them from engineering a situation in which you have a copy of a proprietary GPL derivative whose rights they own? No, it does not, though some gymnastics would be required. This would involve provisions along these lines in your agreement with the provider: you agree that the provider is creating a derivative of the GPL software for you as a work-for-hire, and you agree that after they install this derivative on your server, you assign all your rights in the result to them.

---

Much depends on the details of your agreement with the software provider. In addition to any provisions specifically about backups and copyright, you should pay attention to exactly what the provider agreed to install. If they have installed more or different components than you specified, then they may have violated / failed to fulfill their end of the agreement. Do read very carefully, however, as there could be a huge difference here between, say, "PostgreSQL Server 15" and "Joe's Software Shack database server bundle featuring PostgreSQL 15".

Among the options that may or may not be available to you are:

• Just go ahead with engaging whomever you want to make backups. This is advisable only if it is permissible under applicable copyright law and in light of the details of your agreement the the provider (not the GPL).

• Ask the provider to identify their proprietary components, so that you can remove them. This carries a risk of rendering the software you wanted inoperable, which might then roll over to ...

• Demand that the provider reinstall with (only) the software the agreement specifies. Of course, this assumes that the provider has done differently in the first place, which might not be the case.

• Avoid performing backups (not recommended), or limit backups to pieces that you can be sure do not belong to the provider. The database, for example.

• Engage the software provider to perform backups.

• Wipe the server, and engage a more reputable software provider for the next one. Note that you probably still need to pay the original software provider in this case.

Answer 4

There is no easy answer based on the information you have given.

You certainly have a service agreement with the software provider, who installed everything on your server. This agreement is governing the service they provided to install the software (the GPL parts and the proprietary parts). It would also need to cover the rights of your service provider to install their proprietary software on your server, as well as other software (remote access/calling home, license management/kill switch, etc). You should carefully study that and talk to your legal counsel, especially if that agreement authorizes the software provider to impose any restrictions on how you manage your own server.

You certainly have a license agreement for the proprietary parts of the software installed on your server. This license will tell you if you are allowed to create backups of the software. In certain jurisdictions such a backup is allowed by law (see for example here ), but this is more a legal question and not the scope of Open Source SE.

You should ask the software provider for a SBOM for the entire installation and an explanation of the different parts, how they work together, and why they determined that their proprietary parts are not derivative works of the GPL-licensed parts.

Once you have this entire information and there are open-source-related items open you might want to come back to us with another question.

Answer 5

They've also stated that their installation includes proprietary copyrighted components belonging to them.

I've been in a similar situation before, and what they describe could be completely legit. Some service providers have proprietary, internal tools (analagous to Docker or Chef) that they use for provisioning and setting up virtual servers. You wanted to use a program they haven't handled before, so they wrote a plugin to automate the installation process. Your GPLed program is merely a data input into that plugin. The plugin is a separate entity and can be licensed however the author wants. Aside from protecting trade secrets, the source code to such a plugin would not be particularly useful to you since you don't have access to the tools that it goes with.

However, there's a big GPL trap here that the service provider risks falling into. If the GPL program provides install scripts and parts of those scripts were used in the plugin, then the plugin risks inheriting the GPL. The plugin would be safe if it, for instance, merely unpacked the program's zip file and executed the install script inside, or loaded the program as an OverlayFS image that was hand-built from a manual install.

They won't allow me to use a third party to backup the server as it will breach the copyright of their work/install. They would like to provide a server backup and charge a fee for doing this.

Do a thorough deep-dive of this server, comparing it to one that you've set up yourself. If some of their in-house software is still on the server, then you indeed may lack permission to copy it. Some locales have exceptions to copyright that cover backups. If you can locate their in-house software and can see that it includes part of the original program's setup script, then you could argue that the GPL applies and you have full rights to it but the service provider is unlikely to agree unless you take it all the way to court.

If none of their proprietary software is still on the system or if what's still there can be removed, then they don't really have a good argument for preventing you from backing up your server (provided there's nothing about that in your contract). I've had numerous service providers make similar claims that were just thinly-veiled attempts to upsell more services. They tend to throw out techno-babble and pseudo-legalese, hoping that compliance seems easier than trying to figure out what your rights really are. I generally try to come up with some requirement that their service cannot meet, like being able to access and restore the backup image after the service provider goes out of business and ceases to exist. Once they see that there's no hope of upselling, they often become a lot more cooperative.

The fact that they claim their "process" is copyrighted, despite this statement being a category error (processes are not copyrightable)

This could simply be a poor choice of words. A process itself is not copyrightable, but you can copyright a program or script that implements that process. I'm inclined to think that's what they meant, since the setup process they did is already complete and the only thing you have access to is the state of the system after the process. If for some reason their proprietary software is still on the system, then you should definitely require them to remove it because you certainly do not want your production server to be running code some mystery code that's outside your control.

Answer 6

united-states

Note: I am not a lawyer. You should never take legal advice from anyone on the Internet. Even if I were a lawyer, I am not your lawyer, the only person qualified enough to answer definitively.

Section 117 of the Digital Millennium Copyright Act (DMCA) of 1998 provides that archival/backup of software you can legally use can be backed up by you, or any third party you authorize, provided you follow certain rules, namely that such archives are destroyed or transferred when the original is also sold or transferred.

In addition, they cannot claim copyright because this is a work-for-hire (17 U.S. Code § 101). Since you hired them to perform some work, that work is now yours, and you own that software. They must transfer the copyright ownership to you, or they will be in breach of contract, since you do not own the software that they were hired to provide to you.

On the other hand, if the software bits they added were proprietary, either you must get a license to use it, or the server would not be something you could use, as you don't have a license to use part of the server's software.

If they persist, I would consider talking to a lawyer about your options, because they almost certainly do not have any right to make the assertions they are claiming. This is a work-for-hire scenario, which means you own the final product, and therefore you, or any third party you choose, to maintain a backup of your server. Or, they've given you a defective product, because you cannot use it as deployed.