17

Suppose there is a GPL program.

Say I used a closed source "compiler" to build it.

In building so, I pulled in a proprietary library, but I considered it part of my compiler.

Because the compiler is also proprietary.

Of course, the program can be built using GCC / Clang.

However, it won't have my proprietary build modifications, which my "compiler" provides.

Is this legal under GPL?


Additional Reference from GPL FAQ:

Does the GPL require me to provide source code that can be built to match the exact hash of the binary I am distributing?

Complete corresponding source means the source that the binaries were made from, but that does not imply your tools must be able to make a binary that is an exact hash of the binary you are distributing. In some cases it could be (nearly) impossible to build a binary from source with an exact hash of the binary being distributed — consider the following examples: a system might put timestamps in binaries; or the program might have been built against a different (even unreleased) compiler version.


Example:

Suppose I download GIMP.

Then, I used my proprietary "compiler" to build it. When it builds, it will patch GIMP to add my own modifications and library.

This is not a dynamically linked library, because the library is part of my compiler. That is, it's statically linked. But I haven't modified the GIMP code prior to compile time.

Or perhaps it's not even "linked" at all. My "compiler" may even be built precisely for this purpose, and is only good for compiling GIMP into a Photoshop rival.

The result is a program that is better than Adobe Photoshop. But without the power of GIMP, I couldn't have done it.

Now I will distribute the binaries for money. If anyone will ask for the source code, I will provide the GIMP source code. Because I haven't modified GIMP. I've only made a compiler that builds it in a sneaky way.

So they will not be able to reproduce my binary as they do not have my compiler, and will be dependent on me.

It is not required by GNU GPL to be able to build the exact binary hash using any free compiler, i.e. a reproducible build.

Is this a potential loophole of the GNU GPL license?

Make no mistake, I'm very well aware that this is in clear violation of the spirit of GPL. I'm trying to see if this is a loophole, which will need us to create a better GPL with reproducible builds in mind.

3
  • 3
    Are you asking about your compiler linking in a normal, expected, general-purpose library (say, inlining math functions)? Or are you asking about the compiler patching the program to give it functionality that is not expressed in the source code?
    – marcelm
    Mar 24 at 12:55
  • 1
    @marcelm Yes exactly, the "compiler" patching the program to give it functionality that is not expressed in the source code. Mar 24 at 14:22
  • Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on Open Source Meta, or in Open Source Chat. Comments continuing discussion may be removed.
    – MadHatter
    Apr 5 at 5:48

2 Answers 2

11

In your example, the answer is probably no. The library that the compiler embeds into the program doesn't fit the definition of a system library, and the fact that it's part of the program blocks the other potential exemption from the corresponding source.

The definition of a system library (in GPL v3) requires that it "serves only to enable use of the work with [a] Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form". I would put emphasis on the word "only". It does enable your code to be used with your compiler, but that's not its only purpose; it also adds new functionality, so the first half of the statement wouldn't apply. A "Standard Interface" needs to be approved by a standards body or widely used by developers for a particular programming language, so that wouldn't fit either.

The other way that you could exclude the source code of the library would be if it falls under the category of "general-purpose tools or generally available free programs which are used unmodified in [generating, installing, or running the work] but which are not part of the work". However, your library would be considered "part of the work", since it's incorporated into the compiled program (which is the relevant work in this context), so that doesn't apply.

So the source code for the library would be part of the corresponding source, and you would need to share it.

5
  • But library is something I've just mentioned it as for a relatable example. What if I just call it a compiler? "A "Standard Interface" needs to be approved by a standards body or widely used by developers for a particular programming language, so that wouldn't fit either." -- I guess this means my "compiler", albeit not a "library", will be considered something which is not a "Standard Interface for which an implementation is available to the public in source code form". So the interface through which I'm generating this source code is certainly not the C programming language standard. Mar 24 at 22:55
  • What I'm doing is considering the source code as a different non-standard programming language which processes C code according to my evil GPL-breaking intentions. Therefore, I'll have to say that my program is written in a secret non-C or modified C programming language. However, GPL won't let me distribute source code for a binary in a non-standard programming language for which there is no reference implementation available. I guess this beats my argument. I'll mark this as an answer. Mar 24 at 22:59
  • But before that, a question, does GPL really disallow that? Visual C++ and Intel C++ compilers should deviate from the ANSI standard, but code buildable only by them could be considered GPL right? Or is it possible that code which can only be built by MSVC++ can be GPL? Mar 24 at 23:05
  • 6
    @BlacklightMG: To cheat the system library definition like that results in something like "the output of the compiler is a function of its input" which ends up in you just GPL released your transformative library in binary form. MSVC's copied-in blobs could easily qualify as system libraries but your compiler's copied-in blobs don't.
    – Joshua
    Mar 25 at 0:06
  • @Joshua Fair enough :) Mar 25 at 0:12
10

If the proprietary library would be dynamically linked with your program, this would not be allowed by the GPL license, unless it's a system library.

If it would be allowed by the GPL license because it is a system library, then I assume that it would either be present on the Operating System, or independently installable as runtime libraries, and therefore you should not be distributing it along with your program.

The typical use case for this would be building an app for Windows on desktop using the MSVC compiler. In this case, the app would be dynamically linked with Windows runtime libraries, that may be proprietary.

GPL FAQ on the system library exception:

Can I link a GPL program with a proprietary system library?

Both versions of the GPL have an exception to their copyleft, commonly called the system library exception. If the GPL-incompatible libraries you want to use meet the criteria for a system library, then you don't have to do anything special to use them; the requirement to distribute source code for the whole program does not include those libraries, even if you distribute a linked executable containing them.

The criteria for what counts as a “system library” vary between different versions of the GPL. GPLv3 explicitly defines “System Libraries” in section 1, to exclude it from the definition of “Corresponding Source.” GPLv2 deals with this issue slightly differently, near the end of section 3.

From the text of GPLv3:

The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.

The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.

Similarly, from GPLv2:

The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.


Edit based on the update of the question and this comment from the OP:

I'm talking about a library that is statically linked by the compiler patching the source code during compilation. Say it is GIMP. I downloaded GIMP, but when I compile it with my compiler, I get a Photoshop beater. But when others ask for the source code, I will provide the GIMP source code. Without my "compiler", they cannot get the same binary as me.

Since the patched program ("Photoshop beater") is derived from both the GPL-licensed code and proprietary code, the GPL license then applies to the whole patched program, if you're not the sole copyright owner of the GPL-licensed software.

In order to be compliant to GPL, all of the source code and build scripts needed to regenerate the patched program from source code, must be distributed (or made available) to the recipient of the binaries of the patched program. The licensee must be able to completely regenerate the patched program based on all the inputs you make available to them under GPL. If they are not able to regenerate the patched program using all your inputs, then you would have not fulfilled the requirements of GPL (please see the definition of "Corresponding Source" above).

The compiler itself is not subject to GPL, but anything inserted into the patched program by the compiler would be subject to GPL. The license of the compiler itself doesn't matter, but the license of anything inserted by the compiler into the patched program must be GPL-compatible.

However, if you are the sole copyright owner of the GPL-licensed code and the proprietary patch code, then you can relicense the combination under another license.

WolfSSL is an example of a software that's available under either the GPLv2+ or a commercial license. The WolfSSL company can add additional features to the commercial license version of the software, if they wanted to.

3
  • 2
    No, I'm talking about a library that is statically linked by the compiler patching the source code during compilation. Say it is GIMP. I downloaded GIMP, but when I compile it with my compiler, I get a Photoshop beater. But when others ask for the source code, I will provide the GIMP source code. Without my "compiler", they cannot get the same binary as me. Mar 24 at 14:26
  • @BlacklightMG I have updated the answer accordingly.
    – ruben2020
    Mar 24 at 15:59
  • Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on Open Source Meta, or in Open Source Chat. Comments continuing discussion may be removed.
    – MadHatter
    Apr 5 at 5:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.