2

I plan to build an app based on a public repo with a copyleft license (AGPL-3.0 license). I don't want to open-source my own code (my own code will just server and front-end code, which are built on top of that repo's codebase). I wonder what the potential consequences are? Theoretically can the original repo's owner sue me? But if I don't publish my code, how can they even prove whether I am using their repo or not? Thanks

5
  • 4
    We need more details to answer. Which licenses are attached to the code you are using (complete list)? When you refer to 'front end', does that mean HTML on JS code, which you are delivering to a browser (this is considered a form of publication)? Jan 24 at 8:02
  • 2
    "it will be mainly just server and front-end code". OK, so if "mainly" means that 99% of the time, you are not publishing (which is OK with most copyleft licenses), but if you do publish it 1% of the time, then of course for that 1% case, you'll need to respect the copyleft. Or by "mainly" do you mean you will never publish it at all?
    – Brandin
    Jan 24 at 8:59
  • I updated the questions. Hopefully it is clearer now. What I meant was: my own code will just be server (Java) and front-end (JS) code, which are built on top of that repo's codebase (python). By nature my front-end code is public but I don't want my server code to be public as well
    – Kism281
    Jan 24 at 15:42
  • The important question is the actual architecture of how the components interact. Only knowing that, the question can be really decided. If the components interact via well-defined API, the dependency and judgement is different than when it is included as a library or even as the server with custom plug-ins. Jan 24 at 17:36
  • 1
    The fact that it's AGPL triggers specific requirements. Even if it's backend code, if you allow users to "interact with it remotely through a computer network" (such as the Internet, or a local network), then the requirements are triggered. So, whether or not you "publish" the program is not enough, in this case. "How can they prove it" strikes to me more of a legal or philosophical question. Well, just as a simple example, suppose I am an employee at your company and notice that you're using this AGPL code in violation of copyright, and then I quit the company, ....
    – Brandin
    Jan 25 at 8:39

2 Answers 2

3

A copyleft license has the requirement that when you distribute a derivative work, then you are required to do so under the same copyleft license.

The AGPL license is one of the strictest licenses regarding what triggers the copyleft nature of the license and regarding what acts are considered to be distribution.

In simplified terms, if the program you execute contains code that is under the AGPL license (even if it is just a single line), then the AGPL license requires that the complete program is released under the AGPL license. Also, just giving people remote access to the program, like the server backend of a web-app, triggers a requirement that you must give your users access to the source code under the terms of the AGPL license.

Failure to follow the requirements in the license you received from a third party means that you are infringing upon their rights under copyright law and the copyright holders of the third-party code have the right to start legal action to stop the infringement and to seek damages.

Even without access to the source code or even a binary, similarities in behavior, especially for edge-cases, can be sufficient for a suspicion of a copyright violation. I am not a lawyer, but I can imagine that if a strong enough case of such suspicion can be made, that a judge could order you to give an independent auditor access to your code to assess if you actually make use of the code you are thought to infringe upon. And as copyright violations are civil law, the standard of proof isn't as high as for criminal law.

6
  • I know it's popular to treat AGPL as if it said "network interaction = distribution", but in fact AGPLv3 s13 defines different obligations to users interacting via a network from those it specifies to distribution recipients in ss4-6, and I think it's best to treat them separately, for clarity.
    – MadHatter
    Jan 26 at 11:51
  • @MadHatter: I have also seen some people argue that the AGPL's requirements are incoherent and/or incompatible with typical GitHub-like development practices. Most commonly, this problem centers on the fact that much network code is not designed to interact directly with a human (e.g. over a Telnet-like protocol) but instead is intermediated by some client software, and it may not be practical or even possible to "offer" source code over such a protocol without some kind of client support. E.g. is an AGPL FTP server required to offer a copy of its source for download as a "fake" file?
    – Kevin
    Jan 30 at 4:37
  • @Kevin, the AGPL requires that you make the software available "from a network server, through a standard or customary means of facilitating copying software". There is no requirement at all that those means are the same as the protocol used to interact with the software. Your FTP server could fulfill the AGPL requirements by providing a Github link to the source code in the greeting it sends when the connection is opened. Jan 30 at 7:28
  • @BartvanIngenSchenau: No, it must be offered "prominently" to "all users." A user of a GUI client would not see the greeting, ergo it has not been "prominently" offered to them.
    – Kevin
    Jan 30 at 18:16
  • @Kevin, I don't expect a court to find you at-fault if a third-party software that you have no control over at all hides the most prominent place that you can use. Would you say that an AGPL website is violating the AGPL if I have a browser plugin that strips out all mentions of source code from the pages rendered? Jan 31 at 7:45
2

It's about distribution with most licenses.

If you build a web app based on software that is copyleft-ed, but if you don't distribute it, and only make it network-accessible, then you don't have to make available the source code to your app or any changes to that copyleft-ed software, unless the license in question is the AGPLv3.

AGPLv3 requires all linked software that is network accessible, to have their source codes made available to those accessing and using the app by a network interface.

This is based on section 13 of the AGPLv3:

Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.

7
  • Yes the license is AGPLv3. My question is if I don't open source my code (my own code will just be server (Java) and front-end (JS) code, which are built on top of that repo's codebase (python)), what are the potential consequences? My server code contains sensitive information so I can make it public.
    – Kism281
    Jan 24 at 15:44
  • 2
    You make yourself liable of a copyright violation. Simple. If you do it commercially... even worse - especially as your question here now proves that you would do so willfully. Who can sue you for it, and for what, and the extent of possible criminal prosecution depends on their and your jurisdiction. However you might want to reconsider your software design, if publishing the code publishes sensitive information... security by obscurity is a proven bad concept. Jan 24 at 17:32
  • @Kism281 "My server code contains sensitive information so I [can't] make it public" - In this case the answer is more of a software engineering issue -- you need to separate out the parts of your code which are sensitive information, such as server names, port numbers, authentication information, etc. Even if you're not legally required to do this, you'll need to do it one day or another for practical reasons, so you may as well do it now, so you can comply with the AGPL as a "bonus" and protect yourself from getting sued as another "bonus". I.e. just do it.
    – Brandin
    Jan 25 at 8:49
  • @planetmaker Let's be fair, here just because a user is asking a question about compliance, does not mean that she intends to violate the copyright or violate the license. The opposite could reasonably be true, that she wants to steer clear of violating the license, but needs some kind of motivation or justification to put in that extra effort to do so.
    – Brandin
    Jan 25 at 8:58
  • 1
    @ruben2020 Recommended reading gnu.org/licenses/gpl-faq.html#MereAggregation . It's probably not wise to completely generalize and to say that "if it's TCP then it's OK". That said, we would probably need a court case that really hinges upon this kind of technical specific (e.g. TCP vs. say, "python import") to ever see a definitive legal answer to something like this.
    – Brandin
    Jan 26 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.