Use of GPL licensed code in unit test source for verifying the operation of non GPL program that analyses source code

Question

Say I have a program (not GPL compatible) that performs static analysis against source code through some pattern matching, similar to a linter.

One way I could write unit tests for my program is to supply source code with specially formatted comments that contain assertions about my program's output.

An example syntax for such an comment might be the following:

# ASSERT-{PASS|FAIL} {RULE_KEY}`

I might wish to test my program accurately detects unsanitized rendering of user input, per the following example taken directly from the flask docs.

Original snippet:

from markupsafe import escape

@app.route("/<name>")
def hello(name):
    return f"Hello, {escape(name)}!"

The above snippet is licensed under BSD (The whole Flask project appears to be), but for the purposes of this exercise, the snippet is licensed under GPL.

Test Case Adaptation

from markupsafe import escape

@app.route("/pass/<name>")
def pass(name):
    # ASSERT-PASS XSS
    return f"Hello, {escape(name)}!"

@app.route("/fail/<name>")
def fail(name):
    # ASSERT-FAIL XSS
    return f"Hello, {name}!"

Let's say my analysis tool is a simple CLI program that takes the file path as input, and produces some JSON output, and the test tool compares the input source annotations with the output JSON.

# ci-test-script.bash

static-tool flask-xss-example.py > analysis.json
test-tool flask-xss-example.py analysis.json > test-results.json

# Now check that test-results.json has the field correct: true
jq test-results.json # etc

analysis.json might look like this:

{
   "fails" : [
      {
         "line" : 11,
         "key"  : "XSS"
      }
   ]
}

test-results.json might look like this:

{
   "correct" : true,
   "assertions" : [
       {
         "kind" : "pass",
         "key"  : "XSS",
         "line" : 4,
         "match" : true
       },
       {
         "kind" : "fail",
         "key"  : "XSS",
         "line" : 10,
         "match" : true
       }
   ]
}

In this instance, test-tool and static-tool are both statically compiled binaries with no dependencies on the GPL derived test case.

If I were to commit the GPL derived unit test to some code-base, maybe something that runs ci-test-script.bash as CI for static-tool, which parts of my program & its test infrastructure would be considered GPL licensed works?

The following post is related, however doesn't discuss the direct inclusion of GPL code for the purpose of test snippets: Using GPL library in unit test suite of open source library?

Answer 1

This answer includes a few if-then causalities which can easily be applied.

If you are including (linking, dependency,...) GPL-licensed code in your program, then your program is a derivative work and therefore needs to be licensed under GPL (see GPL FAQ).

If you are collecting/using snippets of GPL-licensed code into a list of test cases, which serves as an input-file when running your program, then this list of test cases will likely be considered a derivative work and therefore needs to be licensed under GPL (and you need to provide its source code, attribution language and everything else as required by the GPL license). However this does not affect your program itself.

If, however, you compile the list of test cases into the binary executable of your program, then the entire program would need to be GPL licensed (see GPL FAQ).