12

Consider the following hypothetical situtation.

  • The company C uses the library L under the MIT license to create a distributable binary under proprietary license
  • Later, the author of the library L finds out that they have to license it under the GPL due to a dependency not previously accounted for

What should the company C do in this case? Does the company C have the option to cease all distribution of the binary, get rid of the library dependency, and release a new version of the binary? Or is it required to release the whole source code under the GPL?

What are ways to prevent such risks?

P.S. Inspired by this post

3
  • 2
    Aside: while your question is hypothetically valid, it is worth reading and understanding this comment on the post. Particularly when it comes to optional, pluggable dependencies like the MySQL libraries in an ORM, the GPL is not as viral as it is in other circumstances. Feb 12 at 20:56
  • GPLv2 or GPLv3?
    – Schwern
    Feb 13 at 0:38
  • Library L can be licensed under the MIT license; that's compatible with the GPL. The problem for company C is if they used the GPL dependency.
    – prosfilaes
    Feb 13 at 15:51

1 Answer 1

11

In law, C has committed a copyright violation. Nothing they do now can undo that fact and any of the copyright holders of the GPL code has a very good chance of winning if they sue for damages.

Does the company C has an option to cease all distribution of the binary, get rid of the library dependency, and release a new version of the binary?

They certainly should do this ASAP; courts generally look a lot less favourably if a party continues to commit an offence once they have become aware of it. However and to re-emphasise the point: doing this does not make good the violation; C can still be sued for damage caused up to this point.

Or is it required to release the whole source code under GPL?

Almost certainly not. While the concept of specific performance does exist in law, this is a case where damages are a sufficient remedy so a court would be incredibly unlikely to order this. (Disclaimer: my knowledge is mostly based on UK law, with a bit of an extension to other legal systems in the same family. If you care about a specific jurisdiction, consult a lawyer in that jurisdiction)

What are ways to prevent such risks?

Properly audit the dependencies you are using. If you don't have the expertise to do this internally, there are plenty of companies who will do it for you.

Stepping back slightly here, unless this is an exceptional case (e.g. something like Apple discovering a GPL library which is crucial to all functionality of the iPhone), the actual damage caused here is likely to be small. Proactively contacting the authors of the GPL code and offering to make a donation to the project is probably the best solution for everyone, except the lawyers who now won't get lots of fees.

(Yes, I also know the above paragraph is probably naive and realistically what most companies will do is just to silently stop distributing the GPL code and hope nobody ever notices / actually sues. That would be unethical though)

9
  • 4
    @Schwern Even if the author of library L committed a copyright violation, that doesn't get C off of the hook, unless L's author has a contractual obligation to C to provide an un-infringing version of L; and if the author of L did nothing wrong, it still doesn't mean C did nothing wrong. They're responsible for the software they choose to use and publish, and how they use and publish it. That includes reviewing each dependency for licensing concerns which might be pertinent to them. After all, C and L have different goals; so what might be okay for L might not be okay for C.
    – jpaugh
    Feb 13 at 1:33
  • 3
    @chadbag In the original question, C was never allowed to use the library under an MIT licence because the library, being a derived work of GPL'd software, could not have been licensed to them under an MIT licence. That someone told them they could, but that someone was wrong, does not absolve them of liability or give them extra rights not granted by the original copyright owners.
    – cjs
    Feb 13 at 7:11
  • 3
    @JoL: You cannot settle with the average FOSS project. Most FOSS projects are not incorporated and do not otherwise have legal personality (and even if it is incorporated, it would need to own all copyright via a CLA to be party to a settlement involving that copyright). You would have to track down all of the contributors and settle with them individually (or collectively). In principle, a class action could be used to facilitate that process. In practice, settlement is much less practical than just quietly removing the dependency and hoping nobody notices, so that is what will happen.
    – Kevin
    Feb 13 at 8:10
  • 5
    @cjs Small but important correction: "C was never allowed to use the library" should be "C was never allowed to distribute the binary containing the library". Feb 13 at 8:31
  • 3
    @Kevin that's true for group projects, but many FOSS projects are personal.
    – Barmar
    Feb 13 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.