22

Let’s say that I paid a third-party company to develop a new application for me. I also make myself clear about the need to have the full property of the code at the end of the developing phase. I also made myself clear about being willing to keep the code for myself (and as I’m not a developer I don’t have any idea of what this means for the devs).

At a certain point, the software developer and I will start arguing and my sue will end in a loss because of details that are infringing our contract. At this point, I still don’t have the property of the source code and I’ve never received a copy.

My hardware developer in the meantime is producing a custom board that runs the compiled and last version of the software, so I just run it on that device and then I sell the whole device

None of us is aware that the software devs used some GPL and LGPL libraries. After some time I finally see the code, but in an unofficial way (found a very old copy left by mistake by one of the devs and not corresponding to the last version)

At this point, I meet one of the GPL copyright owners and while talking with him he figured out that I violated his copyright and caught me totally unprepared.

The misunderstanding is coming from the fact that I mentioned his work while talking about mine, but the reason I knew about it was the unofficial copy of the code.

In my point of view in this case I am one of the victims of the violation, as the developer should have handed me the code. In such case, I had also no way to determine the distribution terms to be used and in fact, I don’t need it because I do not distribute the software by itself.

Am I missing something?

9
  • 14
    What makes you think that not knowing you are violating a law makes it cease to be a violation of a law? Apr 12, 2023 at 11:37
  • 7
    Note that many GPL copyright holders seek compliance. That is, they want to work with you to release the source code, rather than take your money.
    – lofidevops
    Apr 12, 2023 at 15:56
  • 1
    Licensing isn't your only issue here. If you don't have the source code, how are you going to support and maintain this product (fix bugs, apply security patches, etc)?
    – bta
    Apr 12, 2023 at 19:44
  • 5
    This actually has nothing to do with the GPL. By default, you cannot copy or distribute anything without permission from the rightsholder (such permission is usually called "a license"). See for example 17 USC 106 in the US, and analogous laws in just about every country in the world. It is your responsibility to get such licenses as may be required for a particular act of distribution. The fact that the license offered happens to be the GPL is entirely irrelevant. Either you get and comply with some valid license, or you violate the law.
    – Kevin
    Apr 13, 2023 at 7:17
  • 1
    "He figured out that I violated his [GPL software] copyright." Generally, if you're keeping software in the company, and not distributing it, then copying and using GPL software can't be a copyright violation. See: gnu.org/licenses/gpl-faq.html#GPLRequireSourcePostedPublic
    – Brandin
    Apr 13, 2023 at 11:17

5 Answers 5

45

To add a little to planetmaker's excellent answer: I'm not entirely sure what loophole you think you've discovered, but assuming your contention is that you're released from your obligation to distribute source alongside the embedded binary by virtue of not having been given it by your upstream supplier, the GPL endorses planetmaker's view in (eg) GPLv3 s12.

If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all.

It's clear that if your code is indeed covered by GPL, and your upstream developer hasn't given you the source, then all your devices must stay in the warehouse, and you may sell none of them. The same would apply if other factors prevented you from distributing the source code; if, for example, your upstream developer had given you the source, but required you to sign an NDA to get it. In both cases your upstream developer has done a wrong thing, but in neither case does his/her malfeasance excuse you from your obligations.

10
  • 14
    Ignorantia legis non excusat, so no, ignorance is no defence. It is very likely a mitigating factor should the rightsholder(s) in the original GPL code decide to sue you, but it doesn't give you the right to ignore your obligations now you do know them.
    – MadHatter
    Apr 12, 2023 at 9:31
  • 1
    Sorry, i just noticed a thing: you say "now you do know them". Perfectly agree. So now that i can fulfill the requirements i have to, but my concern is about the past years where i didn't know it. Then my next question would be: if i come clean and do what i have to comply with GPL obligations, then i'm fine? Or is this still kind of a choice for him? Notice that distribution is stopped since i became aware of that problem. Sorry if i'm annoying, just trying to understand deeper
    – Mburns
    Apr 12, 2023 at 10:27
  • 1
    It depends, on your jurisdiction and the person whose copyright you violated or to whom you could not fulfill the obligations of the license requirements. You might still be liable for any damage, material or otherwise. Ask your local copyright lawyer. Apr 12, 2023 at 11:00
  • 2
    @supercat that's a new question, and I urge you to ask it as one (answers here will be deleted).
    – MadHatter
    Apr 12, 2023 at 18:59
  • 9
    @Mburns The obligation was upon you to find out what license rights and obligations you had to distribute the work. If you weren't aware of any license, then you weren't aware you had any right to distribute the work at all and should not have done so. If your developer lied to you and said they had given you a license to distribute it without source when in fact they had no right to grant that license, then you still technically never had any right to distribute. I would guess that a court would not impose any damages, but would still make you distribute the source now that you know
    – Ben
    Apr 13, 2023 at 3:28
29

That's a legal question, not an open-source one; the answer depends on jurisdiction and on how you fight legal battles. However in short, you are both, victim and offender.

You distribute the software, and thus you are liable for it to fulfill all legal requirements. The deals you made with your (former) cooperation partner don't matter to your clients; for them you are the point of contact and the one who has to provide indemnification.

Your contracts with your (former) contractor only matters to you. Thus they are liable to you - but that's your problem - not the one of your clients; you distributed the software without proper licensing or fulfilling the license obligations.

11
  • 13
    @Mburns sadly, precisely so. You didn't exercise enough care when you outsourced the writing of the software, so now you bear the cost of that.
    – MadHatter
    Apr 12, 2023 at 9:38
  • 7
    @Mburns think of this the other way around - if what you describe actually was a valid loophole, there would be a lot of shady deals, with outsourced shell companies which would disappear with the source code.
    – jaskij
    Apr 12, 2023 at 10:24
  • 11
    I'm pretty sure that it would be the software equivalent of 'selling stolen goods'. Just because you didn't know they were stolen/incorrectly licensed when you got them doesn't mean you can on-sell them. Apr 12, 2023 at 10:52
  • 6
    It's important to fix the violation as soon as possible. The civil penalties for "willful infringement" are far higher than for "innocent" infringement.
    – Brian
    Apr 12, 2023 at 13:42
  • 4
    @Mburns They are not legally allowed to "just refuse" to follow their own license obligations. If they refuse anyway and that "tanks your whole company" you would be able to sue them for a lot of damages that are the direct consequence of their license violations.
    – Ben
    Apr 13, 2023 at 3:32
15

Here's a comprehensive answer from https://copyleft.org with some added emphasis:

With ever-increasing frequency, software development (particularly for embedded devices) is outsourced to third parties. If you rely on an upstream provider for your software, note that you cannot ignore your GPL compliance requirements simply because someone else packaged the software that you distribute. If you redistribute GPL’d software (which you do, whenever you ship a device with your upstream’s software in it), you are bound by the terms of the GPL. No distribution (including redistribution) is permissible absent adherence to the license terms.

Therefore, you should introduce a due diligence process into your software acquisition plans. This is much like the software-oriented recommendations we make in § 14. Implementing practices to ensure that you are aware of what software is in your devices can only improve your general business processes. You should ask a clear list of questions of all your upstream providers and make sure the answers are complete and accurate. The following are examples of questions you should ask:

  • What are all the licenses that cover the software in this device?
  • From which upstream vendors, be they companies or individuals, did you receive your software before distributing it to us?
  • What are your GPL compliance procedures?
  • If there is GPL’d software in your distribution, we will be redistributors of this GPL’d software. What mechanisms do you have in place to aid us with compliance?
  • If we follow your recommended compliance procedures, will you formally indemnify us in case we are nonetheless found to be in violation of the GPL?

This last point is particularly important. Many GPL enforcement actions are escalated because of petty finger-pointing between the distributor and its upstream. In our experience, agreements regarding GPL compliance issues and procedures are rarely negotiated up front. However, when they are, violations are resolved much more smoothly (at least from the point of view of the redistributor).

Consider the cost of potential violations in your acquisition process. Using Free Software allows software vendors to reduce costs significantly, but be wary of vendors who have done so without regard for the licenses. If your vendor’s costs seem “too good to be true,” you may ultimately bear the burden of the vendor’s inattention to GPL compliance. Ask the right questions, demand an account of your vendors’ compliance procedures, and seek indemnity from them.

In particular, any time your vendor incorporates copylefted software, you must exercise your own rights as a user to request CCS for all the copylefted programs that your suppliers provided to you. Furthermore, you must ensure that CCS is correct and adequate yourself. Good vendors should help you do this, and make it easy. If those vendors cannot, pick a different vendor before proceeding with the product.

Taken from Copyleft and the GNU General Public License: A Comprehensive Tutorial and Guide Section 18.2 Kuhn et al. License CC-BY-SA-4.0

3
  • If one views the "source code" for a project built by someone as being the best representation of the code possessed by that person, and someone downloads a package containing pre-compiled libraries and instructions for containing their source, and the person uses those libraries in a project verbatim without downloading any other material associated therewith, then the aggregation of downloaded materials related to the library would be the best representation of the materials therein possessed by the person building the overall application.
    – supercat
    Apr 12, 2023 at 18:18
  • @supercat I don't think that's a common interpretation of Complete Corresponding Source (CCS), my guess is that wouldn't stand up
    – lofidevops
    Apr 12, 2023 at 20:04
  • Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on Open Source Meta, or in Open Source Chat. Comments continuing discussion may be removed.
    – MadHatter
    Apr 14, 2023 at 5:26
0

Recognizing that that OP may not be the last person to face the problem of:

  • A third party developer (DEVELOPER) that embeds OSS into a (contractually) closed source application / project.
  • A deteriorating relationship with the DEVELOPER such that it is not possible to get that DEVELOPER to rework the solution such that it doesn't embed any OSS components.

And that it is probably not a viable position, just to ignore the GPL violation and "ship anyway". Another strategy would be to work with the original author (AUTHOR) of the GPL software, by:

  • Releasing the DEVELOPER from their liability to you, so that they can meet their obligations to the AUTHOR **.
  • Provide any details required to the AUTHOR to help them put pressure on the DEVELOPER to release the software (publically).
  • Consider financially supporting the AUTHOR to further this objective.

** - The DEVELOPER may be in an impossible position (of their own making) where they can't release the software because of your contract/NDA and they can't not release it because of the GPL.

I understand that the original intent was to develop a closed source application - however by going the OSS path you may be able to bring your product to market (earlier) and give yourself the option to hire a different developer, to develop a new (closed source) version of the application later - if you need too - you may later decide the OSS model works for you.

PS. Not a Lawyer/Not Legal Advice - I don't know what obligations to the AUTHOR and DEVELOPER you may have, so you probably want to consult a Lawyer before taking any action.

-2

At a certain point the software developer and I will start arguing and my sue will end in a loss because of details that are infringing our contract. At this point I still don’t have property of the source code and I’ve never received a copy.

Whatever your misunderstanding of the GPL may be, you're misunderstanding contracts and lawsuits as well.

Regardless of what you or your contractor sue each other over, you still paid them for their work, and you own that work. There is no point at which the contractor can legally refuse to hand over the source code. Unless you literally didn't pay them anything, of course.

Assuming you did pay them though, and your "loss" involves a disagreement over payment/work, then your "loss" will always involve you being entitled to the work up to some date. They may not do any more work, and they may not give you the final version if you didn't pay for the last few weeks/months, but you'll still get the source code as of some date. That will be court ordered too, so they can't refuse.

3
  • 6
    The terms of the contract matter. Not everything is performed as a work for hire. Apr 12, 2023 at 21:02
  • 1
    The legeslature also matters Apr 12, 2023 at 23:21
  • Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on Open Source Meta, or in Open Source Chat. Comments continuing discussion may be removed.
    – MadHatter
    Apr 25, 2023 at 6:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.