4

I work in a place where we have a group made of several companies/entities (across the world if that matter).

We have a software at entity1 that use a GPLv3 Lib for few things. We would like entity2 to use that software for some tasks. Few things in the software are quite sensitive so we don't want to see it disclosed.

So now that we have context, here comes the questions...

  • Does any employee of entity1 that use the software is allowed to request the full source ?
  • If entity1 is to distribute binary to entity2, are we fine as long as we provide source if entity2 ask for it ?
  • Who at entity2 can make such a request for source ? Any employee of entity2 using the software ? Or can it be resticted to "someone in charge" to avoid ?
  • If software is installed on dedicated VM at entity2 that people use with remote desktop, does that change anything regarding "distribution" to employees of entity2 ?

I don't really understand how the licence work in corporate environnement...

Improve this question
5
  • 1
    Does this answer your question: gnu.org/licenses/gpl-faq.html#InternalDistribution
    – Brandin
    Commented Aug 23 at 11:56
  • Not really since "one organization or company" is not clear to me whether 2 legals entities of a bigger group are concidered as "one organisation or company" or not.
    – jyte
    Commented Aug 23 at 12:15
  • 4
    @jyte legal personhood is well-defined in most jurisdictions. Assuming these are two separate companies, with separate company registration numbers, articles, and memoranda, the fact that they're both wholly-owned by a third legal entity makes no difference to their individuality. If all persons working at both entities are in fact employed by the same third entity, that's different.
    – MadHatter ♦
    Commented Aug 23 at 12:19
  • @jyte Personally I would consider "2 legal entities" to mean two organizations. So, "2 legal entities of a bigger group" just sounds like another way of saying "we are two separate organizations, but we are grouping ourselves together in some way." That's probably fine to do that (e.g. you can partner with another company on something), but the fact that two organizations are collaborating on something together does not make them part of the same organization, AFAIK.
    – Brandin
    Commented Aug 23 at 13:21
  • @MadHatter, thank you that makes things much clearer.
    – jyte
    Commented Aug 23 at 13:26

2 Answers 2

Reset to default
4

Does any employee of entity1 that use the software is allowed to request the full source ?

No. As the link that Brandin provided above makes clear, moving copies around inside a single organisation doesn't constitute conveyance, and doesn't trigger those obligations that are contingent on conveyance, source provision being one such.

If entity1 is to distribute binary to entity2, are we fine as long as we provide source if entity2 ask for it ?

It's possible. GPLv3 s6 governs source provision when object code is conveyed, and the only sections that any longer allow the "written offer" are 6b, which requires the object code to be embedded in a physical product, and s6c,which doesn't apply here. I'd always parsed s6's physical product requirement as "firmware in a functioning device", but the text of GPLv3 says this includes "a physical distribution medium". So if you ship the binary to entity two on (eg) DVD, then yes, you can provide a written offer to provide source on request. This offer must be valid for three years, or longer in certain circumstances.

Who at entity2 can make such a request for source ? Any employee of entity2 using the software ? Or can it be restricted to "someone in charge" to avoid ?

According to s6b, anyone who possesses the object code is entitled to request the source. This is not affected by whether they got that binary via regular conveyance or an internal transfer; if they have the binary, they are entitled to request the source. Furthermore, you cannot control what they then do with that binary and/or source, so long as they honour their GPLv3 obligations.

If software is installed on dedicated VM at entity2 that people use with remote desktop, does that change anything regarding "distribution" to employees of entity2 ?

Not really. That original provision of the VM image was a conveyance. It is true that further copies made and distributed inside entity two aren't conveyances, but that doesn't affect any recipient's eligibility to make a s6b source request.

I don't really understand how the licence work in corporate environment

Essentially, don't use copyleft software if you don't want copyleft obligations. They won't always apply, but it's much simpler to assume they will.

Edit: you write that you will likely remove the relevant libraries in an attempt to make your binary not subject to GPLv3. This may work, but it may not; it's not as easy as it sounds. I recommend Do you retain copyright in a project even if all your code has been rewritten? for further reading.

Improve this answer
4
  • 1
    Well, to be fair, 6b allows commercial distribution with a written offer. The "physical product" seems like it can be just a CD/DVD with just binaries on it, as long as you follow the rules of 6b in doing so. I think 6c is intended to allow someone who received such software under the conditions of 6b to then give that software or a copy to someone else. Without 6c, you would not be allowed to do that (since maybe you don't have the sources yet; only the written offer given to you).
    – Brandin
    Commented Aug 23 at 13:30
  • 2
    The software initally developped wasn't ment for distribution. Things shifted and now it's concidered so I inherited the situation and try to get a better understanding of GPLv3 implication for my specific context (2 companies hold by a common 3rd one), as I am more of a developer than a law person. It is likely that we will end up removing the lib and re-implement equivalent features by ourselves, i just wanted to be sure it was necessary in my case.
    – jyte
    Commented Aug 23 at 13:46
  • Can you clarify who in this situation gets the right to see the source code (and redistribution, etc.): is it the company E2 or the employee who, as partof their job, receives the copy from E1?
    – Bart van Ingen Schenau
    Commented Aug 23 at 18:26
  • @Brandin I didn't agree with you, but then I re-read s6b, and I now do. I have amended the answer accordingly, and I am grateful for your critique.
    – MadHatter ♦
    Commented Aug 24 at 10:47
2

Entity 1 needs to provide the source code to Entity 2.

But Entity 2 doesn't need to provide the source code to all of its employees. This is regarded as internal use within the company, and not conveyance.

However, you cannot restrict Entity 2 from giving a source code copy to its employees. In particular, you cannot require any non-disclosure agreement that would prevent them from exercising their rights under GPLv3. But if they choose not to, that is fine.

With virtual machines and remote desktop, the situation changes a bit. If the remotely accessed virtual machine was at Entity 1, that wouldn't require source code access under GPLv3 (but would under AGPLv3). Any entity you give the virtual machine image to does have right to get the source code. But if Entity 2 provides Entity 1 (and only them) access to a virtual machine that Entity 1 then installs the software to, it is similar to many shared hosting services where no conveyance is intended.

Improve this answer
8
  • The OP says the VM is at entity two, so it's been supplied to them, and the software embodied within has thus been conveyed. This isn't a remote access situation, though if it were I would find your analysis persuasive.
    – MadHatter ♦
    Commented Aug 24 at 10:52
  • @MadHatter Where it is physically at does not necessarily mean anything - many companies have servers at cloud providers but they still "belong" to the company. The question does not tell who administers the virtual machine. And when I take my work laptop with me to another company's premises, I'm not conveying the installed software either. It has to be determined by ownership and access of the machine. It's quite common for on-site servers for proprietary software to be installed by the vendor and have only user-level access by the client.
    – jpa
    Commented Aug 24 at 20:02
  • I beg to differ. I agree that ownership is important in determining whether conveyance has occurred, but the OP has indicated that the VM is running on entity two's premises and has given no indication that there's any kind of SaaS arrangement here. If the VM host was bought with the VM pre-installed, conveyance has occurred. If the VM was purchased, transmitted as an image, and installed on entity two's pre-existing hardware, conveyance has occurred. Other arrangements might well, as you suggest, complicate the analysis, but we have no reason to think those apply in this case.
    – MadHatter ♦
    Commented Aug 26 at 11:40
  • @jpa MadHatter Very interesting to read. My idea was that E2 would setup a VM so E1 could install the software. But since E2 (or possibly contractor of E2) is supposed to administer the said VM, providing source still apply as I understand what you say.
    – jyte
    Commented Aug 26 at 12:12
  • 1
    @jyte in that case (and I wish you'd been clearer about that earlier) the details will depend entirely on the contract governing E1's obligations with respect to this VM install. If the contract makes it clear that E1 retains ownership of the code, and that E2 is permitted to do nothing save interact with the software running on the VM, then conveyance probably hasn't occurred. If the contract is just one for supply and installation of software, then conveyance probably has occurred. If, as is beginning to seem likely, the contract doesn't specify any of this, then it's not clear.
    – MadHatter ♦
    Commented Aug 26 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.