Should I provide my source code if I use GPL source code combined into my subscription service code?

Question

I've looked at other topics related to this question, but mine is quite different from others so I'm not sure about the answer.

Let's say I am building a website that will provide SAAS for users. In my source code, I am using parts of another source code released under GPL v3. Not an external library, but code completely integrated into mine (around 5-10% from all of the code). Users will interact with the website on a subscription basis. I am not selling the code, just providing a service. In this case, I've understood that I'm not obliged to provide my source code.

But if what the following case: I provide another subscription, where the users will be able to download 1 file and placed it on their website. This file will be 100% my code and will appear let's say as a widget and will allow the user and other visitors on their website to use the service I provide, directly from within their site. But at this point, this will not be a "service" but a kind of delivery.

In this scenario must I provide my source code? I think the answer should be NO because I'm still providing a service. If the user' subscription ends, he will not be able to do anything with that file anyway.

Just to be clear, the open-source code I'm thinking to use will be no more than 5% of the end code. It's some class methods related to processing post data from forms, that implements a bit higher level of security and cleaning of the post data.

Answer 1

In your first example you are right, providing a SaaS solution does not count as 'delivery' in the context of GPLv3. That would be different if it was AGPL, but apparently that's not the case.

In your second example, where your users download 1 file (the 'widget', 100% your code) from your website, which will enable them to access the SaaS offering, this one file seems to be able to run individually and separately from your SaaS offering, and therefore it is not affected by the requirements to disclose source code based on the 3rd party GPL code you are using in that SaaS solution. Only if you provide this one file also under GPL (your choice) you would be required to disclose the source. This is assuming that the widget is not actually loading code from your SaaS service, but is loading only data.

It does not matter if you use 90%, 10% or 1% of 3rd party code with a GPL license, the copyleft-impact on your own code is always the same for 'covered work' (i.e. derivatives, modifications, ...)