The download for source is a newer version than the version shipped

Question

I have built a program using several open source libraries. Most of them fall under MIT, BSD, Appache and LGPL license. To my understanding some of them require the source code to be shared. I was hoping to build a website that would provide the source for download. My problem has to do with providing the correct version of the source. Is this mandatory?

For example say I am using package X version 1.2 and my site allows users to download package X from the creators of X's git repo. Time passes and package X is upgraded to version 3.1. Thus my website is now pointing at the new version of the source even through my program was distributed using version 1.2.

Does this still meet the requirement to allow users to download the source?

Answer 1

The GNU Project licenses are specific about what counts as source for a work: redistribution requires that one must also make available to every recipient the “complete corresponding source” for that very same work.

This ensures the recipient has effective freedom to modify and redistribute the same work themselves.

So, for a work licensed with that wording, it is a violation to fail to offer the source for the same work as was distributed to the recipient. In other words, source for some other version does not satisfy that clause.

Complete corresponding source for the work is a pre-requisite for the recipient's effective freedom to modify and/or redistribute the work.

For non-copyleft licenses, the redistributor is not required to distribute source at all. So they do not ensure the recipient's freedom.

So if you want to ensure recipients can get the complete corresponding source for the same work they received, license that work with terms of a copyleft from the FSF, such as GNU GPL v3 or later.

Answer 2

What most people do is to make an archive of the release available for download. Access to newer source is nice, but the terms of the licenses are best met by providing the actual source. As we say at Apache, 'Apache Releases are Source Release, the binaries are just for convenience.' So, the important thing, from a licensing standpoint, is the source.

Answer 3

When you say that it points to the creator's git repo, I assume you mean their central repository on GitHub. By default, links on GitHub point to the latest version of the code, but it is possible to get a link to a specific version of the code.

1. Navigate to the "Commits" page.
2. Find the commit that corresponds to the release you're using.
3. Navigate to it and select "Browse Files"
4. Copy the url. This link points to the repository as it was at that commit.

Alternatively, many repositories use Tags for release versions. You may be able to use a tag to find the proper version. It's also worth noting that a link to the source may not be enough to full-fill the obligations of the license. You may be responsible for hosting the files yourself. It's a bit unclear to me if using a third party (GitHub) to host the source files fulfills the obligation in regards to the LGPL. Particularly if it's not your repository that you're pointing to. I would take a look at the following link for questions about GPL compliance.

https://softwarefreedom.org/resources/2008/compliance-guide.html

If the creator used GitHub releases, just browse to the release page, find the proper version and download the zipped source files so that you can host it yourself.

If I'm wrong and it's not a GitHub repository, you may still accomplish this by finding the proper tag and commit. It will just be a little more work.