Let's say there are 3 people Q A Z . Q makes a GPL library. A uses it and licensed it under the MIT licence purposefully. Z uses A's library in a proprietary, paid-for library and distributes it with over a million downloads when Q realizes and files an infringement case against A and then Z has also infringed indirectly. However Z cannot apply GPL to his code as it would be a commercial disaster. What will Z do?

  • If Z won't release under GPL, then what possible answer other than Immediately cease distribution and give refunds to all affected users are you expecting?
    – MadHatter
    Oct 22 '20 at 11:54
  • But is it in this case really Z's fault that he did not reverify?Shouldn't all the burden be on A?Z just used code under the license he found. Oct 22 '20 at 12:09
  • 3
    Z's lack of deliberate copyright violation until now is what will likely save him/her from punitive damages. But now (s)he knows. If (s)he continues to distribute code in violation, or allow code to be used by his/her customers in violation, that defence will disappear. I ask again, what sort of answer were you hoping for? That some kind of GPL exception might appear out of thin air, so Z could continue trading without interruption?
    – MadHatter
    Oct 22 '20 at 12:11
  • 1
    Cease distribution and refund all affected customers, yes. As for A's liability, Z didn't pay A anything for the code in the first place; why on earth should A be financially liable? Here's the rub: Z made a business out of selling other people's work. It's Z's job to bend over backwards to ensure (s)he has the rights to do that. Z failed to do so, and must now face the consequences.
    – MadHatter
    Oct 22 '20 at 12:15
  • 3
    That's a completely different question, please don't use comments to ask new questions. Oct 22 '20 at 12:20

Z will either release his/her work under GPL, or (s)he will immediately cease distribution and refund all his/her affected customers for the code which they have paid to use but may no longer use. Those are the options available (edit: approaching Q for a commercial licence is, as Felix G points out below, another option, though one that I consider very unlikely to succeed).

As covered in comments above, Z didn't pay A for the code that A mistakenly made available under MIT; indeed, A may well not have the faintest idea that Z is using A's code in this way. So it is very unlikely A would have any liability.

If Z was selling a product with a clear disclaimer that the customer bought it at their own risk and Z had no idea whether the customer was entitled to use it, then I suppose it's possible that Z would be protected from an obligation to refund his/her customers. But (a) it's jurisdictionally-dependent, (b) it's also off-topic for OS.SE, and (c) why would anybody buy a product under those terms in the first place?

At the end of the day, Z has decided to make a business out of selling someone else's work. If you're going to do that, you need to bend over backwards to ensure that you have the right to do it. Z failed to ensure that, and is enjoying the consequences.

  • 2
    I'd like to add that there technically is a third option: Z could try to ask Q for a commercial license. Of course, Q might not want to do that, or they might not be able to even if they wanted (if there are other contributors and the project doesn't have a CLA/CTA)
    – Felix G
    Oct 22 '20 at 14:36
  • @FelixG that is a very good point, and thank you for making it. I regard it as vanishingly unlikely that Q would agree, since people who use the GPL generally intend their work to remain open. Even if Q did, the fact that a million copies have already been sold is going to have a serious effect on the price. But it is still an option, so thank you again for bringing it up.
    – MadHatter
    Oct 22 '20 at 14:45
  • How about any of these other potential options (practical or otherwise): • Z removing the library and writing their own equivalent (taking great care not to use or even see the original code); • commissioning such a replacement from another company; • refactoring their product to use the original GPL library without linking with it; • releasing their product without the library and requiring their customers to obtain and install it; • approaching Q in the hope of getting an LGPL version (which might be more acceptable than a commercial licence).
    – gidds
    Oct 23 '20 at 0:46
  • @gidds it's a bit late for Z not to see the original code, wouldn't you say? The second option has nothing to do with free software, the third I don't understand, the fourth doesn't remove the GPL obligation (still a derivative work), the fifth Felix already suggested in effect (and I still think is highly unlikely).
    – MadHatter
    Oct 23 '20 at 6:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.