Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. It only takes a minute to sign up.
Sign up to join this community
I work on a third-party open source project (partly GPL 3, partly Apache 2).
I don't want to disclose my changes right away (but publish them in the future).
Is it legal to require a hired worker whom I want to show my code to sign a non-disclosure agreement for my changes? Would it contradict to the license? (My main changes are in an Apache 2 licensed file.)
I am not a lawyer, so verify this yourself.
See the GPL FAQ: https://www.gnu.org/licenses/gpl-faq.html#GPLRequireSourcePostedPublic
Does the GPL require that source code of modified versions be posted to the public?
The GPL does not require you to release your modified version, or any part of it. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.
But if you release the modified version to the public in some way, the GPL requires you to make the modified source code available to the program's users, under the GPL.
Thus, the GPL gives permission to release the modified program in certain ways, and not in other ways; but the decision of whether to release it is up to you.
As long as you do not let it escape, you don’t have to provide the sources.
And the GPL does not evict your own copyright on your changes, thus it should be possible to exert your copyright and demand non-disclosure, but only for the bits you personally hold the copyright of. You could state that the modified version is a proprietary modification and your changes are covered under "all rights reserved", thus prevent re-distribution of your changes.
If the co-worker leaks the code they perform a copyright infringement, and the code won’t be properly “released”. See https://www.gnu.org/licenses/gpl-faq.html#StolenCopy
On the other hand, I don’t understand why you would need such an NDA for changes to a GPL-licensed program/library. It sounds like you want to work against the intended purpose of the license. But this is up to you, so I won’t question it further.
