1

I'm trying to figure out if GPLv3 copyleft is triggered for the following scenario:

A company has a backend service written in a dynamically typed programming language. The service has a bunch of dependencies, including a module under GPLv3 license. The GPLv3 module is linked dynamically into the backend service's main program. The service exposes some public API endpoints, exchanging JSON-based data. The company also has a mobile client distributed via major digital distribution platforms. The mobile clients use the backend's API endpoints to operate.

My questions are the following:

  1. Can the backend service the company is running be considered a private copy of GPL covered work so that copyleft isn't triggered in this case and the company doesn't have to convey (distribute) a source code of its service to the public?
  2. Can be the backend service program and the mobile client considered as two independent programs (taking into account that they are exchanging JSON data)?
  3. Any real court cases supporting the answers for 1 and 2? (I do understand that jurisdiction may matter here)
  4. How AGPLv3 for the dependency module would change the outcome?

My understanding is that:

a. Backend service is a modified version of GPL covered work (dynamically linking considered as modification, see https://www.gnu.org/licenses/gpl-faq.html#GPLStaticVsDynamic)

b. Backend service isn't conveyed/distributed, because the interaction is done over the network (see https://www.gnu.org/licenses/gpl-faq.html#UnreleasedMods)

c. Mobile client and the backend are considered two separate, independent programs, because the interaction is based on simple JSON data, with NO source code, code generation, complex internal data structures involved in exchange (see https://www.gnu.org/licenses/gpl-faq.html#MereAggregation).

So the copyleft isn't triggered in this case, the company has a right to run its software on the backend as a private copy. The copyleft would trigger if the backend service dependency would be under GNU Affero General Public License.

But I am not a lawyer, so I am not sure. Any help is highly appreciated!

5

My understanding is that: a. Backend service is a modified version of GPL covered work (dynamically linking considered as modification, see https://www.gnu.org/licenses/gpl-faq.html#GPLStaticVsDynamic)

They call it a combined work, but close enough, yes.

b. Backend service isn't conveyed/distributed, because the interaction is done over the network (see https://www.gnu.org/licenses/gpl-faq.html#UnreleasedMods)

Correct. This is the infamous difference between the GPL and the AGPL (Affero GPL). If the code had been licensed under the AGPL, you would be required to distribute the backend's source code because you are providing access to the backend over a network.

c. Mobile client and the backend are considered two separate, independent programs, because the interaction is based on simple JSON data, with NO source code, code generation, complex internal data structures involved in exchange (see https://www.gnu.org/licenses/gpl-faq.html#MereAggregation).

This one is the only part that may be tricky. As a developer I would generally assume this is the case. However, note that JSON can be used to encode complex, internal data structures. The FSF's opinion is based on the semantics of the communication - that is, the nature of the data that is being exchanged - not whether you used JSON or not.

Consider JSON A:

{
    "searchResults": [
        {"productId": "1", "name": "Flour"},
        {"productId": "2", "name": "Sugar"}
    ]
}

That is not intimate. Anyone could write code to generate or parse that.

Now consider JSON B:

{
    "sid": "04591623",
    "qbref": "67942267",
    "data": [
        {"fmt": "QZ", "bref": "85634234", "pid": 1},
        {"fmt": "QZ", "bref": "85634235", "pid": 2},
        {"fmt": "QS", "bref": "85634236", "pst": "Flo"},
        {"fmt": "QS", "bref": "85634237", "pst": "r"},
        {"fmt": "QS", "bref": "85634238", "pst": "u"},
        {"fmt": "QS", "bref": "85634239", "pst": "S"},
        {"fmt": "QS", "bref": "85634240", "pst": "ga"},
        {"fmt": "QR", "bref": "85634242", "concat": ["85634236", "85634238", "85634237"]},
        {"fmt": "QR", "bref": "85634243", "concat": ["85634239", "85634238", "85634240", "85634237"]},
        {"fmt": "PRO", "bref": "85634244", "p":"85634234", "l": "85634242"},
        {"fmt": "PRO", "bref": "85634245", "p":"85634235", "l": "85634243"},
        {"fmt": "QNH", "bref": "IATA_JFK", "alt": 1030},
        {"fmt": "REP", "bref": "67942267", "chunks": [
            {"type": "chunk", "base": "85634244", "count": "2"},
            {"type": "end"},
        ]}
    }
}

what the heck is this? It's some kind of memory dump of C structures expressed in JSON. You have no idea what this means unless you reverse-engineer it or you wrote it in the first place. What's a sid? What's a bref? Why is one of them not a number? What are these format codes? And pid and pst and p and l and alt?

I would say that to understand a format like this you have to understand the program that wrote it (or reverse-engineer the format). Presumably you would not reverse-engineer your own format but rather look at the code which writes this data in order to understand how to read it. In my interpretation of the FSF's opinion, they believe this constitutes "intimate communication exchanging complex internal data structures" and therefore makes the front-end a derivative work of the back-end.

Standard disclaimer: I am not a lawyer and this is not to be construed as legal advice.

3
  • Great example of the JSON that may fall under "semantics of the communication are intimate enough, exchanging complex internal data structures, that too could be a basis to consider the two parts as combined into a larger program". Thank you! These kinds of definitions are somewhat murky though. When speaking about AGPL, FSF mentions game servers containing free software. I guess there should be quite intimate communication between a game server and client software (online game), so having GPL on the server-side would suffice to trigger copyleft. Nonetheless, AGPL is advised for the case. – vrs Jul 21 at 11:26
  • 1
    @vrs "intimate communication" is something that would have to be judged on a case-by-case basis by a judge and/or jury or whoever. AGPL would make it very clear. Note that in case of an open-source game server, AGPL would affect modified servers, and the client is not derived from any modified server, only the original one. (It can't have been, because the modified server didn't exist yet!) One might argue the modified server is derived from the client, if there is intimate communication involved, but that still doesn't get the company to release the source code. – user253751 Jul 21 at 11:32
  • I'm trying to figure out if the semantics of communication between two programs that distinguish "mere aggregation" and "combined work" is something specific to GPL or a more universal principle that may be applied to other licenses. Your comments would be highly appreciated. opensource.stackexchange.com/questions/11963/… – vrs Jul 26 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.