Can CC-BY-SA code be removed from a larger code base and not have the remaining code bear the CC-BY-SA license?

Question

My understanding of the CC-BY-SA is that if you use a snippet of CC-BY-SA code in a larger project, not only must you reveal the source code of your entire project, but you must also brand the entire project's code-base with the CC-BY-SA license.

My concern would be that if I, at one stage of a project, used a little snippet of CC-BY-SA code, my entire project would have to be CC-BY-SA, even if the original CC-BY-SA snippet was removed.

I understand that the CC-BY-SA is only relevant when the project is published, but if I had a project in a CI/CD pipeline, it is always being "published" whenever a change is made.

Think of this theoretical example:

• You make a website.
• You deploy it in a CI/CD pipeline.
• You keep makings commits (each one is immediately deployed) .
• You copy code that's CC-BY-SA licensed not understanding the full implications (perhaps you thought CC-BY-SA only required attribution like MIT or CC BY 3.0)
• You find out that the CC-BY-SA code snippet you used means the entire project must now bear the CC-BY-SA license.

The problem here is that if the author panics and removes the CC-BY-SA code snippet it's too late. The ENTIRE project has forcibly become CC-BY-SA. If the original CC-BY-SA code is removed it doesn't matter because every step constitutes as being published, binding the code base as CC-BY-SA. Furthermore, the entire project is now (for lack of a better term) infectious... If you say "I'll just start over," you can't use ANY of your original code base at any commit, or your new app will also become "infected," and then you'll have to start over again and not use any code from either project...

I hope I am wrong. Is there any legal theory that can save the situation I described? I'd hate to think that any code base I've been working with that has touched CC-BY-SA code must be thrown out.

Answer 1

My concern would be that if I, at one stage of a project, used a little snippet of CC-BY-SA code, my entire project would have to be CC-BY-SA, even if the original CC-BY-SA snippet was removed.

I fully agree with the answer by @MadHatter, including the assessment that building upon the codebase that includes the CC BY-SA code, even if that change removes the original CC BY-SA code, cannot remove the CC BY-SA obligations.

However, I do see a way out of the situation without having to publish your product under the CC BY-SA license for all time, or being unable to publish due to conflicting licenses.

That way out is to go back in time in your codebase to a commit before the first line of CC BY-SA code was added. From this point forward, you can start doing a cleanroom re-implementation of the features that were added after the introduction of the CC BY-SA code.

The features need to be re-implemented in a cleanroom manner, i.e. without referring to the previous implementation, to ensure that you don't accidentally pull in again some code that is encumbered by the CC BY-SA license.

This is not a cheap or easy process, so you should add measures to your development process to catch addition of code with an undesirable license as early as possible. Preferably before it actually gets added.

Answer 2

My concern would be that if I, at one stage of a project, used a little snippet of CC-BY-SA code, my entire project would have to be CC-BY-SA

That is so, as it is with most copyleft licences.

even if the original CC-BY-SA snippet was removed.

Some, including me, would so argue.

if I had a project in a CI/CD pipeline, it is always being "published" whenever a change is made

Copyleft obligations, like most obligations in copyright licences, trigger when something is done that would infringe someone else's copyright if not otherwise permitted. It's not clear to me that merely putting the code into a CI pipeline is such an act. Better to focus on conveyance, as GPLv3 has it: the act of giving copies to other people. That definitely requires permission.

I'd hate to think that any code base I've been working with that has touched CC-BY-SA code must be thrown out.

I understand that, but the best advice we can give is to have a care about the licence status of the third-party code you use. The practice of pulling in code from all over, willy-nilly, and only starting to worry about the legalities when the project is ready to ship, is as foolish as it is common. If you're going to use someone else's work in your own project, licence compliance must be your highest priority.

In practice, if you accidentally use some copyleft code which you promptly remove as soon as you realise your error, and which you have never shipped to another person, it's unlikely that anyone will ever notice or care that you have done so. But it could still be a technical infringement; instead of looking for loopholes in copyright, spend your time being careful about what code you reuse.