17

I've arranged for a software provider to install a free and open-source application on a server. The application is licensed under GPL-3.0-only.

The software provider has installed the software onto the server (the installation took a couple of days).

The software provider claims that the process to setup, install, configure, and implement the application is proprietary.

They consider the implementation process as copyrighted original creative work. They've also stated that their installation includes proprietary copyrighted components belonging to them.

They won't allow me to use a third party to backup the server as it will breach the copyright of their work/install. They would like to provide a server backup and charge a fee for doing this.

Does the GPL-3.0 license allow them to place this restriction?

10
  • Do you have ssh or other shell access? Feb 18, 2023 at 22:30
  • Yes, I have SSH access
    – Guest
    Feb 19, 2023 at 0:14
  • What stops you using it to do off-side backups? Feb 19, 2023 at 1:06
  • In the database you wish to backup produced by the GPL software, or a separate piece of installation/orchestration software?
    – apsillers
    Feb 19, 2023 at 4:05
  • 3
    @Guest a particular installation is surely a derivative of the software being installed, so it's simply available to you under the GPL or else in violation of the GPL software author's license grant. I'd ask if they believe the installed software is not a derivative, which seems absurd, or if they believe that a derivative of a GPL work isn't required to be GPL licensed, which is wrong.
    – apsillers
    Feb 19, 2023 at 6:27

6 Answers 6

18

They consider the implementation process as copyrighted original creative work.

I don't know how faithfully you've reported their exact words/meaning, but a process is not copyrightable. All copyrightable works consist of some sort of fixed tangible expression (text, video, sound, images). Furthermore, U.S. law (e.g., case law such as Baker v. Selden) makes clear that the copyrightable expression of a system offers no monopoly on outside implementations or descriptions of the system itself. Other jurisdictions probably have similar rules but I can't say for sure.

They've also stated that their installation includes proprietary copyrighted components belonging to them.

This begins to approach plausibility. However, any work of theirs that is legally a derivative of the original GPL work can only be offered to you under the GPL.

If their installation process makes use of (1) material of their original copyrightable authorship that (2) isn't a derivative work of the GPL software (for example, perhaps some proprietary general-purpose software of theirs, used to replicate execution of programs across multiple machines), then they may forbid you from distributing that completely-separate piece of software.

Even if this is the case, copyright can't prevent you from sharing not-copyrightable output of their tools. Trade secret law might enable them to forbid you from distributing the output of their own tools that exist independent of any GPL software, but (at least in the U.S.), this would require having you sign NDAs prior to letting you see anything they wish to claim is protected. Anything they wish to claim protection for under trade secret law could not be a derivative of any GPL work (at least, not without them being in violation of the GPL work's author's license terms and leaving them liable for copyright infringement). Additionally, I don't see how a privately-held backup would be problematic from an NDA perspective (in that you don't actually disclose it to a third party) but I also have low familiarity in this field of law.

I don't know to what degree their installation process actually integrates with the GPL software. I can envision installation systems that are strongly derivative of the software, and other orchestration systems that operate agnostic to what specific software they install, and some types that exist somewhere in between. If their installation system is legally a derivative, under copyright law, then I see no legal way they can make it (or its byproducts) available to you under any terms beyond the GPL itself.

The fact that they claim their "process" is copyrighted, despite this statement being a category error (processes are not copyrightable) suggests to me they do not have a rigorous theory of law in mind when trying to forbid you from performing backups.

7
  • 14
    I didn't want to add this as an answer, because it's more suitable for SF, but hopefully one takeaway from this is that you should get laid down in writing what your consultants are going to do before you have them start. This lot appear to be trying to use copyright woo to get an ongoing revenue stream out of you for backup services (never mind restores). At this point, if it were me, I would ask them to finish what they're doing, pay their bill to date, and never, ever contract them to do anything again. And yes, that may involve throwing away what they've done, and getting it redone.
    – MadHatter
    Feb 19, 2023 at 9:41
  • @apsillers - thank you for your comment. It's reassuring to know that a process is not copyrightable, the installation system could be strongly derivative of the software and therefore covered by GPLv3 and that a privately-held backup provided by a third party is not necessarily a disclosure to that third party. Much appreciated.
    – Guest
    Feb 19, 2023 at 20:37
  • 1
    @MadHatter - we did have a formal quote for the GPLv3 software to be installed. I've just never come across the view that the actual implementation of the free and open-source software could be considered proprietary. It now seems reasonable to consider the implementation as a derivative of the GPLv3 software (the implementation exists because we wanted an installed version of the GPLv3 software only).
    – Guest
    Feb 19, 2023 at 20:38
  • 1
    Th installation process includes snippets of the contractor's novel, and the file structure is remapped to his chapter headings. Hey presto, it's copyrighted!
    – fectin
    Feb 20, 2023 at 18:12
  • Note also that GPL3's "installation information" provision only applies to user products, so it's no help here because this is presumably a B2B product or service.
    – Kevin
    Feb 20, 2023 at 18:19
16

I've arranged for a software provider to install a free and open-source application on a server. The application is licensed under GPL-3.0-only.

[...]

They've also stated that their installation includes proprietary copyrighted components belonging to them.

So,

  • you hired them to install a GPL-3.0 application on your server, but

  • instead they installed the GPL-3.0 application plus some proprietary component without your permission.

IANAL (and you should double-check your contract first to make sure you really hired them only to install the GPL-3.0 application), but if we take your question at face value, they abused access to your server to install stuff you did not allow them to install. This sounds (at least) like a breach of contract (again, if we take the wording in your question at face value) and (at worst) like something borderline illegal (depending on your jurisdiction).

If you're generous, you might want to give them a chance to remove their crap and install (only) what you hired them to install. If you're not, lawyer up.

1
  • 5
    I agree the installation of proprietary components without my knowledge or permission is very concerning and not something i would have expected. @MatHatter has provided some good words of wisdom regarding perhaps starting over with a more trustworthy contractor. Thank you for also sharing your thoughts - it comforting to know that my concerns are not irrational
    – Guest
    Feb 19, 2023 at 21:06
10

Heavily revised.

Disclaimer: I am not a lawyer, much less your lawyer, and this answer does not provide competent legal advice.

The software provider claims that the process to setup/install/configure/implement the application is proprietary.

That's plausible, but irrelevant. The software provider has executed their proprietary procedure on your server. It's now done. That the process is proprietary does not in itself place any obligations on you.

They consider the implementation process as copyrighted original creative work.

That could conceivably be supportable (though more likely not), in the same sense that a performance of a symphony can be copyrighted. But that's also irrelevant. Any such copyright they have protects against you copying the performance, which you have no way to do anyway, having not recorded it. Copying the contents of the server after the fact is not the same thing as copying the installation process itself.

They've also stated that their installation includes proprietary copyrighted components belonging to them.

That could be true.

They won't allow me to use a third party to backup the server as it will breach the copyright of their work/install.

Meaning, you've clarified, that they demand that you not engage anyone else for backup services, not that they can physically or electronically prevent you from doing so.

In the first place, then, you should consider whether they have a leg to stand on under copyright law generally. You didn't say where you are, but in the U.S., the Copyright Act permits you to make a backup ("archival") copy of computer software, though not necessarily of other digital materials.

This is where you review your agreement with the software provider, or have your lawyer do so. It is possible that the agreement holds that you waive your rights to make backups, or that it gives the software provider an exclusive right to provide backup services. If it does not do either of these things, and if U.S. law or a law with similar provision for software backups applies, then no GPL-specific analysis is required.


But if you're not so lucky,

Does the GPL-3.0 license allow them to place this restriction?

Does the GPL permit them to forbid you to make copies of their proprietary, non-GPL components? The GPL does not apply to such components.

Does the GPL permit them to create a proprietary derivative of GPL software? Yes, it does, but it does not permit them to convey a derivative of GPL software to a third party (you) under terms other than the GPL, which permits you to make copies as you like. Furthermore, the provider would be obligated by their license to provide source to you on request.

Does the GPL prevent them from engineering a situation in which you have a copy of a proprietary GPL derivative whose rights they own? No, it does not, though some gymnastics would be required. This would involve provisions along these lines in your agreement with the provider: you agree that the provider is creating a derivative of the GPL software for you as a work-for-hire, and you agree that after they install this derivative on your server, you assign all your rights in the result to them.


Much depends on the details of your agreement with the software provider. In addition to any provisions specifically about backups and copyright, you should pay attention to exactly what the provider agreed to install. If they have installed more or different components than you specified, then they may have violated / failed to fulfill their end of the agreement. Do read very carefully, however, as there could be a huge difference here between, say, "PostgreSQL Server 15" and "Joe's Software Shack database server bundle featuring PostgreSQL 15".

Among the options that may or may not be available to you are:

  • Just go ahead with engaging whomever you want to make backups. This is advisable only if it is permissible under applicable copyright law and in light of the details of your agreement the the provider (not the GPL).

  • Ask the provider to identify their proprietary components, so that you can remove them. This carries a risk of rendering the software you wanted inoperable, which might then roll over to ...

  • Demand that the provider reinstall with (only) the software the agreement specifies. Of course, this assumes that the provider has done differently in the first place, which might not be the case.

  • Avoid performing backups (not recommended), or limit backups to pieces that you can be sure do not belong to the provider. The database, for example.

  • Engage the software provider to perform backups.

  • Wipe the server, and engage a more reputable software provider for the next one. Note that you probably still need to pay the original software provider in this case.

7
  • The application will be populated with my data and there are no external users of the software. The application is on a VPS but the software provider wants to prevent the hosting provider from providing server backups. The software provider was asked to implement the GPLv3 software on the VPS and they now claim that the way they implemented it on the server is proprietary therefore only they (the software provider) are allowed to provide server backups.
    – Guest
    Feb 19, 2023 at 19:56
  • The hosting service provider (VPS provider) is not interested in the code or methods and can provide a server backup at no cost but the software provider claims that this would breach their copyright.
    – Guest
    Feb 19, 2023 at 19:57
  • The question i have is whether GPLv3 software can be implemented in a proprietary way (on a VPS) or whether the GPLv3 license prevents the implementation as being copyrighted because it is a derivative piece of work (the implementation would not exist without the GPLv3 software). I think i have a clearer understanding of the GPLv3 now from the responses on here.
    – Guest
    Feb 19, 2023 at 19:58
  • @Guest, I have already responded to most of those points. The GPL is not an issue, one way or the other. Nothing about it requires the service provider to allow you access to their server to make your own backups. In fact, they could make a proprietary derivative of your software. The GPL ensures it. They would be required to provide source only if they "conveyed" it to other parties, but even in that case, they would not be obligated to allow you any access to their servers. Feb 20, 2023 at 0:49
  • i may not have explained the scenario clearly enough. The service provider (VPS provider) is happy to allow me access to the server and make my own backups. Alternatively the service provider (VPS provider) is happy to assist me and provide backups to me. I have full access and can view the code and methods on the VPS. However, the software provider objects to the service provider (VPS provider) making backups on my behalf.
    – Guest
    Feb 20, 2023 at 1:28
5

There is no easy answer based on the information you have given.

You certainly have a service agreement with the software provider, who installed everything on your server. This agreement is governing the service they provided to install the software (the GPL parts and the proprietary parts). It would also need to cover the rights of your service provider to install their proprietary software on your server, as well as other software (remote access/calling home, license management/kill switch, etc). You should carefully study that and talk to your legal counsel, especially if that agreement authorizes the software provider to impose any restrictions on how you manage your own server.

You certainly have a license agreement for the proprietary parts of the software installed on your server. This license will tell you if you are allowed to create backups of the software. In certain jurisdictions such a backup is allowed by law (see for example here ), but this is more a legal question and not the scope of Open Source SE.

You should ask the software provider for a SBOM for the entire installation and an explanation of the different parts, how they work together, and why they determined that their proprietary parts are not derivative works of the GPL-licensed parts.

Once you have this entire information and there are open-source-related items open you might want to come back to us with another question.

1
  • we contracted the software provider to implement the GPLv3 software only (on to a third party VPS). We were surprised to hear that the software provider 1) considers the implementation copyrighted 2) claims to have installed other proprietary copyrighted components belonging to them. Your suggestion to request an SBOM for the entire installation and an explanation of the different parts is a good idea as that should help provide more clarity on what they're claiming - thanks.
    – Guest
    Feb 19, 2023 at 20:49
2

They've also stated that their installation includes proprietary copyrighted components belonging to them.

I've been in a similar situation before, and what they describe could be completely legit. Some service providers have proprietary, internal tools (analagous to Docker or Chef) that they use for provisioning and setting up virtual servers. You wanted to use a program they haven't handled before, so they wrote a plugin to automate the installation process. Your GPLed program is merely a data input into that plugin. The plugin is a separate entity and can be licensed however the author wants. Aside from protecting trade secrets, the source code to such a plugin would not be particularly useful to you since you don't have access to the tools that it goes with.

However, there's a big GPL trap here that the service provider risks falling into. If the GPL program provides install scripts and parts of those scripts were used in the plugin, then the plugin risks inheriting the GPL. The plugin would be safe if it, for instance, merely unpacked the program's zip file and executed the install script inside, or loaded the program as an OverlayFS image that was hand-built from a manual install.

They won't allow me to use a third party to backup the server as it will breach the copyright of their work/install. They would like to provide a server backup and charge a fee for doing this.

Do a thorough deep-dive of this server, comparing it to one that you've set up yourself. If some of their in-house software is still on the server, then you indeed may lack permission to copy it. Some locales have exceptions to copyright that cover backups. If you can locate their in-house software and can see that it includes part of the original program's setup script, then you could argue that the GPL applies and you have full rights to it but the service provider is unlikely to agree unless you take it all the way to court.

If none of their proprietary software is still on the system or if what's still there can be removed, then they don't really have a good argument for preventing you from backing up your server (provided there's nothing about that in your contract). I've had numerous service providers make similar claims that were just thinly-veiled attempts to upsell more services. They tend to throw out techno-babble and pseudo-legalese, hoping that compliance seems easier than trying to figure out what your rights really are. I generally try to come up with some requirement that their service cannot meet, like being able to access and restore the backup image after the service provider goes out of business and ceases to exist. Once they see that there's no hope of upselling, they often become a lot more cooperative.

The fact that they claim their "process" is copyrighted, despite this statement being a category error (processes are not copyrightable)

This could simply be a poor choice of words. A process itself is not copyrightable, but you can copyright a program or script that implements that process. I'm inclined to think that's what they meant, since the setup process they did is already complete and the only thing you have access to is the state of the system after the process. If for some reason their proprietary software is still on the system, then you should definitely require them to remove it because you certainly do not want your production server to be running code some mystery code that's outside your control.

1
  • Even if the proprietary software inherits some portions of the build scripts, it would not inherit the GPL if the inherited portions would be considered ineligible for copyright protection under the scène à faire doctrine and/or merger doctrine. If a typical programmer given a description of the task to be performed, would be likely to produce a script that contains the inherited portions essentially verbatim, those portions of the scripts would not be copyrightable and thus use of them would not require any kind of license.
    – supercat
    Feb 21, 2023 at 17:18
1

Note: I am not a lawyer. You should never take legal advice from anyone on the Internet. Even if I were a lawyer, I am not your lawyer, the only person qualified enough to answer definitively.

Section 117 of the Digital Millennium Copyright Act (DMCA) of 1998 provides that archival/backup of software you can legally use can be backed up by you, or any third party you authorize, provided you follow certain rules, namely that such archives are destroyed or transferred when the original is also sold or transferred.

In addition, they cannot claim copyright because this is a work-for-hire (17 U.S. Code § 101). Since you hired them to perform some work, that work is now yours, and you own that software. They must transfer the copyright ownership to you, or they will be in breach of contract, since you do not own the software that they were hired to provide to you.

On the other hand, if the software bits they added were proprietary, either you must get a license to use it, or the server would not be something you could use, as you don't have a license to use part of the server's software.

If they persist, I would consider talking to a lawyer about your options, because they almost certainly do not have any right to make the assertions they are claiming. This is a work-for-hire scenario, which means you own the final product, and therefore you, or any third party you choose, to maintain a backup of your server. Or, they've given you a defective product, because you cannot use it as deployed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.