I work on a third-party open source project (partly GPL 3, partly Apache 2).

I don't want to disclose my changes right away (but publish them in the future).

Is it legal to require a hired worker whom I want to show my code to sign a non-disclosure agreement for my changes? Would it contradict to the license? (My main changes are in an Apache 2 licensed file.)


I am not a lawyer, so verify this yourself.

See the GPL FAQ: https://www.gnu.org/licenses/gpl-faq.html#GPLRequireSourcePostedPublic

Does the GPL require that source code of modified versions be posted to the public?

The GPL does not require you to release your modified version, or any part of it. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.

But if you release the modified version to the public in some way, the GPL requires you to make the modified source code available to the program's users, under the GPL.

Thus, the GPL gives permission to release the modified program in certain ways, and not in other ways; but the decision of whether to release it is up to you.

As long as you do not let it escape, you don’t have to provide the sources.

And the GPL does not evict your own copyright on your changes, thus it should be possible to exert your copyright and demand non-disclosure, but only for the bits you personally hold the copyright of. You could state that the modified version is a proprietary modification and your changes are covered under "all rights reserved", thus prevent re-distribution of your changes.

If the co-worker leaks the code they perform a copyright infringement, and the code won’t be properly “released”. See https://www.gnu.org/licenses/gpl-faq.html#StolenCopy

On the other hand, I don’t understand why you would need such an NDA for changes to a GPL-licensed program/library. It sounds like you want to work against the intended purpose of the license. But this is up to you, so I won’t question it further.

  • 1
    “if your coworker leaks it you have to release your changes” – no, see <gnu.org/licenses/gpl-faq.html#StolenCopy>. It is up to the copyright holder to decide whether the material is published, they are just have to follow the GPL's terms if they decide to publish. Leaks or other illegal means violate that copyright, and don't give anyone rights to the illegally obtained material. – amon Nov 23 '20 at 18:50
  • Thanks, I’ll edit the answer – luziferius Nov 23 '20 at 19:04
  • 3
    "On the other hand, I don’t understand why you would need such an NDA for changes to a GPL-licensed program/library." - first mover advantage. Say, my company developed a device which came with modified Linux kernel. Not publishing the code early would keep the new product a secret until it is ready to be sold/announced. – Jan Dorniak Nov 26 '20 at 19:38
  • Ok, that sounds reasonable. Thanks for explaining the reasoning behind it – luziferius Nov 30 '20 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.