If I can't provide GPL source because a supplier did not provide it, am I at fault?

Question

Let’s say that I paid a third-party company to develop a new application for me. I also make myself clear about the need to have the full property of the code at the end of the developing phase. I also made myself clear about being willing to keep the code for myself (and as I’m not a developer I don’t have any idea of what this means for the devs).

At a certain point, the software developer and I will start arguing and my sue will end in a loss because of details that are infringing our contract. At this point, I still don’t have the property of the source code and I’ve never received a copy.

My hardware developer in the meantime is producing a custom board that runs the compiled and last version of the software, so I just run it on that device and then I sell the whole device

None of us is aware that the software devs used some GPL and LGPL libraries. After some time I finally see the code, but in an unofficial way (found a very old copy left by mistake by one of the devs and not corresponding to the last version)

At this point, I meet one of the GPL copyright owners and while talking with him he figured out that I violated his copyright and caught me totally unprepared.

The misunderstanding is coming from the fact that I mentioned his work while talking about mine, but the reason I knew about it was the unofficial copy of the code.

In my point of view in this case I am one of the victims of the violation, as the developer should have handed me the code. In such case, I had also no way to determine the distribution terms to be used and in fact, I don’t need it because I do not distribute the software by itself.

Am I missing something?

Answer 1

To add a little to planetmaker's excellent answer: I'm not entirely sure what loophole you think you've discovered, but assuming your contention is that you're released from your obligation to distribute source alongside the embedded binary by virtue of not having been given it by your upstream supplier, the GPL endorses planetmaker's view in (eg) GPLv3 s12.

If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all.

It's clear that if your code is indeed covered by GPL, and your upstream developer hasn't given you the source, then all your devices must stay in the warehouse, and you may sell none of them. The same would apply if other factors prevented you from distributing the source code; if, for example, your upstream developer had given you the source, but required you to sign an NDA to get it. In both cases your upstream developer has done a wrong thing, but in neither case does his/her malfeasance excuse you from your obligations.

Answer 2

That's a legal question, not an open-source one; the answer depends on jurisdiction and on how you fight legal battles. However in short, you are both, victim and offender.

You distribute the software, and thus you are liable for it to fulfill all legal requirements. The deals you made with your (former) cooperation partner don't matter to your clients; for them you are the point of contact and the one who has to provide indemnification.

Your contracts with your (former) contractor only matters to you. Thus they are liable to you - but that's your problem - not the one of your clients; you distributed the software without proper licensing or fulfilling the license obligations.

Answer 3

Here's a comprehensive answer from https://copyleft.org with some added emphasis:

With ever-increasing frequency, software development (particularly for embedded devices) is outsourced to third parties. If you rely on an upstream provider for your software, note that you cannot ignore your GPL compliance requirements simply because someone else packaged the software that you distribute. If you redistribute GPL’d software (which you do, whenever you ship a device with your upstream’s software in it), you are bound by the terms of the GPL. No distribution (including redistribution) is permissible absent adherence to the license terms.

Therefore, you should introduce a due diligence process into your software acquisition plans. This is much like the software-oriented recommendations we make in § 14. Implementing practices to ensure that you are aware of what software is in your devices can only improve your general business processes. You should ask a clear list of questions of all your upstream providers and make sure the answers are complete and accurate. The following are examples of questions you should ask:

• What are all the licenses that cover the software in this device?
• From which upstream vendors, be they companies or individuals, did you receive your software before distributing it to us?
• What are your GPL compliance procedures?
• If there is GPL’d software in your distribution, we will be redistributors of this GPL’d software. What mechanisms do you have in place to aid us with compliance?
• If we follow your recommended compliance procedures, will you formally indemnify us in case we are nonetheless found to be in violation of the GPL?

This last point is particularly important. Many GPL enforcement actions are escalated because of petty finger-pointing between the distributor and its upstream. In our experience, agreements regarding GPL compliance issues and procedures are rarely negotiated up front. However, when they are, violations are resolved much more smoothly (at least from the point of view of the redistributor).

Consider the cost of potential violations in your acquisition process. Using Free Software allows software vendors to reduce costs significantly, but be wary of vendors who have done so without regard for the licenses. If your vendor’s costs seem “too good to be true,” you may ultimately bear the burden of the vendor’s inattention to GPL compliance. Ask the right questions, demand an account of your vendors’ compliance procedures, and seek indemnity from them.

In particular, any time your vendor incorporates copylefted software, you must exercise your own rights as a user to request CCS for all the copylefted programs that your suppliers provided to you. Furthermore, you must ensure that CCS is correct and adequate yourself. Good vendors should help you do this, and make it easy. If those vendors cannot, pick a different vendor before proceeding with the product.

Taken from Copyleft and the GNU General Public License: A Comprehensive Tutorial and Guide Section 18.2 Kuhn et al. License CC-BY-SA-4.0

Answer 4

Recognizing that that OP may not be the last person to face the problem of:

• A third party developer (DEVELOPER) that embeds OSS into a (contractually) closed source application / project.
• A deteriorating relationship with the DEVELOPER such that it is not possible to get that DEVELOPER to rework the solution such that it doesn't embed any OSS components.

And that it is probably not a viable position, just to ignore the GPL violation and "ship anyway". Another strategy would be to work with the original author (AUTHOR) of the GPL software, by:

• Releasing the DEVELOPER from their liability to you, so that they can meet their obligations to the AUTHOR **.
• Provide any details required to the AUTHOR to help them put pressure on the DEVELOPER to release the software (publically).
• Consider financially supporting the AUTHOR to further this objective.

** - The DEVELOPER may be in an impossible position (of their own making) where they can't release the software because of your contract/NDA and they can't not release it because of the GPL.

I understand that the original intent was to develop a closed source application - however by going the OSS path you may be able to bring your product to market (earlier) and give yourself the option to hire a different developer, to develop a new (closed source) version of the application later - if you need too - you may later decide the OSS model works for you.

PS. Not a Lawyer/Not Legal Advice - I don't know what obligations to the AUTHOR and DEVELOPER you may have, so you probably want to consult a Lawyer before taking any action.

Answer 5

At a certain point the software developer and I will start arguing and my sue will end in a loss because of details that are infringing our contract. At this point I still don’t have property of the source code and I’ve never received a copy.

Whatever your misunderstanding of the GPL may be, you're misunderstanding contracts and lawsuits as well.

Regardless of what you or your contractor sue each other over, you still paid them for their work, and you own that work. There is no point at which the contractor can legally refuse to hand over the source code. Unless you literally didn't pay them anything, of course.

Assuming you did pay them though, and your "loss" involves a disagreement over payment/work, then your "loss" will always involve you being entitled to the work up to some date. They may not do any more work, and they may not give you the final version if you didn't pay for the last few weeks/months, but you'll still get the source code as of some date. That will be court ordered too, so they can't refuse.