6

Assuming my SaaS is not a play on "managed hosted version of <agpl software>".
Meaning, I just call the AGPL software without modifying it (binary call/import) - using it to get some part of my SaaS work done.
Do I need to disclose my source code in that case?

Specific example:

  • Let's say I need to use a database or a package to interact with cloud providers that is AGPL

1 Answer 1

10

AGPLv3 section 13 only triggers when both:

  • you use a modified version of the AGPL-covered software; and
  • users are interacting remotely with that software over a network.

Corresponding excerpt from the AGPL:

[…] if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version […]

But what is the “Program” in this context? While you did not modify the AGPL-covered parts, you may have created a derivative work of the AGPL-covered component by incorporating it into your software system, which would be such a modified Program. The AGPLv3 defines modification as follows:

To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work.

We therefore have to distinguish cases like:

  • the AGPL-covered software is a clearly separate program, for example a database server to which you connect via some network protocol, a separate and self-contained microservice, or a separate command-line tool
  • the AGPL-covered component is a library or code snippet, which you incorporate directly into your program

Based on this, we can evaluate the AGPLv3 section 13 conditions against different scenarios.

Scenario: AGPL component is a clearly separate program. Then, since you didn't modify the AGPL program, section 13 doesn't apply and you can effectively treat this software as GPL-licensed: you would not be required to provide any source code in that scenario.

If you had modified the AGPL-covered component, we would have to consider whether users are “interacting with it remotely through a […] network”. This would depend on the nature of your services (e.g. whether your code is only a thin proxy around the AGPL-covered program). But probably, there would be no user interaction with the modified AGPL-covered component, and section 13 would still not apply.

Only if you modified the component and users are interacting with it, then you would be required to provide the Corresponding Source for that Program – but not the source code for your other, separate programs.

Scenario: AGPL component becomes part of your program, e.g. by including it as a library. Then your program is a derivative work of the AGPLv3-covered component. While you not have modified that component, the Program as a whole (including the AGPLv3 parts) is still a modified version compared to the original AGPLv3 component. And since users are interacting with your SaaS program, AGPLv3 section 13 triggers. You would be required to provide the Corresponding Source for the entire Program, including the parts that you have written.

3
  • So If I use the program inside a docker container (without modifying anything, except for maybe adding a proxy in the container to forward it to the program) and I send some kind of requst to the container then I hit the first scenario?
    – funerr
    Sep 30, 2022 at 21:45
  • 1
    @funerr Probably yes, but the important part isn't using a container, but making it clear that the AGPL-covered component and your own components do not form a single (distributed) program – that these components only communicate “at arms length”. Using an unmodified AGPL-covered service (like a database server) is probably safe in this regard.
    – amon
    Oct 1, 2022 at 8:07
  • @funerr The container isn't that meaningful for example because of technologies like de.wikipedia.org/wiki/Remote_Procedure_Call
    – Nobody
    Oct 1, 2022 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.