Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. It only takes a minute to sign up.
Sign up to join this community
Assuming my SaaS is not a play on "managed hosted version of <agpl software>".
Meaning, I just call the AGPL software without modifying it (binary call/import) - using it to get some part of my SaaS work done.
Do I need to disclose my source code in that case?
Specific example:
AGPLv3 section 13 only triggers when both:
Corresponding excerpt from the AGPL:
[…] if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version […]
But what is the “Program” in this context? While you did not modify the AGPL-covered parts, you may have created a derivative work of the AGPL-covered component by incorporating it into your software system, which would be such a modified Program. The AGPLv3 defines modification as follows:
To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work.
We therefore have to distinguish cases like:
Based on this, we can evaluate the AGPLv3 section 13 conditions against different scenarios.
Scenario: AGPL component is a clearly separate program. Then, since you didn't modify the AGPL program, section 13 doesn't apply and you can effectively treat this software as GPL-licensed: you would not be required to provide any source code in that scenario.
If you had modified the AGPL-covered component, we would have to consider whether users are “interacting with it remotely through a […] network”. This would depend on the nature of your services (e.g. whether your code is only a thin proxy around the AGPL-covered program). But probably, there would be no user interaction with the modified AGPL-covered component, and section 13 would still not apply.
Only if you modified the component and users are interacting with it, then you would be required to provide the Corresponding Source for that Program – but not the source code for your other, separate programs.
Scenario: AGPL component becomes part of your program, e.g. by including it as a library. Then your program is a derivative work of the AGPLv3-covered component. While you not have modified that component, the Program as a whole (including the AGPLv3 parts) is still a modified version compared to the original AGPLv3 component. And since users are interacting with your SaaS program, AGPLv3 section 13 triggers. You would be required to provide the Corresponding Source for the entire Program, including the parts that you have written.
