64

If I create a closed source application which uses some GPL licensed libraries but don't actually distribute the software, only its output, can I keep the software closed sourced?

Specifically, I am talking about a biological data analysis pipeline. Internally, our software will be using some GPL libraries to generate its output. However, the software itself will not be distributed. Users will either receive a virtual machine with the pipeline set up which they can run locally, or submit their input data to us and access their results from a web interface.

In other words, the product distributed is not really the software itself but its output. If the software is calling dynamically linked, GPL licensed libraries, will I need to make the entire project GPL?

I have read the GPL FAQ and I think that this one may apply:

A company is running a modified version of a GPL'ed program on a web site. Does the GPL say they must release their modified sources? (#UnreleasedMods)

The GPL permits anyone to make a modified version and use it without ever distributing it to others. What this company is doing is a special case of that. Therefore, the company does not have to release the modified sources.

It is essential for people to have the freedom to make modifications and use them privately, without ever publishing those modifications. However, putting the program on a server machine for the public to talk to is hardly “private” use, so it would be legitimate to require release of the source code in that special case. Developers who wish to address this might want to use the GNU Affero GPL for programs designed for network server use.

If I understand the above correctly, that means that using it internally to produce the data served by the web portal would be OK. If so, how about when I distribute the VM with the software set up? Would that constitute "distribution" of the software?

  • 19
    "Users will either receive a virtual machine with the pipeline set up which they can run locally" - ah, so you are distributing the software? – immibis Jan 13 '16 at 21:35
  • 8
    VM image is no different from a zip file when it comes to software distribution. Binaries can certainly be extracted from it, so you have to provide the source code. – Dmitry Grigoryev Jan 14 '16 at 11:16
  • Are you sure the libraries are GPL and not LGPL? – pjc50 Jan 14 '16 at 19:01
  • 2
    @DmitryGrigoryev, that the executables can be "extracted" is irrelevant, I get binaries as a par of the VM image, thus they are distributed to me. – vonbrand Jan 27 '16 at 0:30
  • 1
    @terdon Just as a side note, this (the output-only stipulation) is precisely the difference between the GPL and the AGPL. The AGPL would require you to distribute the source. – Duncan X Simpson Sep 21 '18 at 16:24
82
+100

This is a great question and speaks to a lot of confusion about the GPL. The answer is mostly “yes” here, but since the GPL is frequently seen as very scary, it is important to understand why this is allowed.

Note that you say two contradictory things in your post, first that you

don't actually distribute the software, only its output

and the contradictory second statement,

Users [may] receive a virtual machine with the pipeline set up which they can run locally

This answer is addressing only the first, since that is the usual meaning of “output:” the data that emerges as a result of processing.

However as other answers indeed note, the second statement is distributing the software which processes the data into its final form, and you do need to release source code in that context.

Let’s understand why.

The GPL is about ownership

The abstract purpose of GPL software is for people to have full ownership of their computers. What I mean is that typically, legally speaking, you (the “end user” of the computer) own the hardware of your computer: you can throw it out of a window or install whatever software you want on it. But you usually don’t own the many pieces of software running on your computer, which follow so-called intellectual property laws. Because of this, the authors of that software can say “Hey: you can’t peek inside of this code that’s running on your computer. You can’t mess around with that.” And I mean anyone can say that but in this case they can back it up with a lawsuit if you don’t listen.

You will probably never own all of the software that you run, but on a program-by-program basis that is what GPL software is trying to provide. The GPL starts from the following ideological position: “You have this computer with these programs that you have bought, and you should be able to inspect and modify those programs, so that your computer does exactly what you want it to do. You legitimately, fully own these programs: they aren’t on loan from some mega-corporation. But you can do whatever you want with that code: debug it, share it with a friend, increment all the bytes by 1 and see what that does, play it as a static-sounding symphony, or print it onto underwear.” (There is a legal corner which you can’t own, which is the ability to strip the copyright and software from their lawful owners.)

Software licenses will either get in the way of this full ownership (as proprietary ones often do) or facilitate full ownership (as open-source ones often do). And when they facilitate, they might try to also facilitate other peoples’ full ownership of copies (as copyleft ones like GPL do) or just your full ownership (as non-copyleft ones like BSD, MIT, LGPL do). Non-copyleft licenses are particularly simple and are usually much easier to read. They generally say something like: “Here is this software. We hold the copyright. It is a condition of this license that you promise not to sue us for anything. We promise not to sue you for anything either.”

Copyleft licenses have to be a little more complicated, they have to say something like “We reserve the right to sue you if you pretend that you have the right to sue someone else over this software. You don’t have that right; don’t do that.” In this sense copyleft licenses use lawsuits defensively to try to reduce the global number of intellectual property lawsuits. They resist attempts to “re-proprietarize” their code.

And this is why you are concerned; you are worried that you might fall afoul of this if you share the output of your software. So the first thing you need to ask yourself may be, “under what circumstances do I want to sue my clients for using my software?” If you are unable or unwilling to take legal actions against your clients then you are implicitly allowing them (one might even say giving them license) to do whatever they want. But let’s suppose that you really do care about suing someone if they modify how your software works.

The code is the real concern

Here’s a common misconception: the GPL emphatically does not say “anyone who modifies the source code must release their modifications for free to the public.” In fact until very recently with the advent of GitHub, publishing software publicly was a really difficult task. It’s easier now, but publication is still in a general sense, a barrier to your ownership of that software. The GPL, which hates those sorts of barriers, does not and would not ever require such a barbarous thing.

What does it say? It says, “when you distribute the modified program to someone else, you have to give them, and only them, ownership of the modified source code under this license, so that they can fully own their computers just the same as you could.” There are two similarities to what most people are expecting; there are also two differences. The similarities are: (1) most people are expecting the source code to be free-of-charge; (2) most people are expecting that it does not matter whether you distribute a compiled or source-code form. But the differences are: (1) this sharing is not triggered by modification but by transmission and (2) this sharing is not intrinsically public (though you can’t control what the recipient does with it and the recipient can share it publicly). Notice that if you are already transmitting something to someone, then the publishing burden is offset: you only have to also offer to transmit the source code alongside whatever you’re originally transmitting. Also notice that while the source code must be free-of-charge, the transmission of the whole package can cost whatever you want: the financial cost of releasing the source code to this other person is merely expected to be covered by the amount they paid you for you to hand them the software in the first place.

Therefore: if this program runs on your server, nobody else’s, and other people only interact with the program by sending packets to your server, usually no source code release is needed. That code runs on your computer, nobody else’s. Since the GPL code doesn’t execute on anyone else’s machine, they cannot demand to see the source for the running program, even if it was modified. There are minor exceptions but they consist of programs which transmit GPLed parts of their own source code to the client so that the client can run them; these snippets need to satisfy the GPL of course.

On the flip side, when you send a virtual machine to someone, you are sending them code which they execute on their computers, and the GPL absolutely demands that they be able to control what’s running on their computers: so you will want to release source code in such a case, even with that VM boundary making things somewhat murky.

The GPL also allows a lot of strange things

Now, you might still be able to distribute some mechanism to process data, without disclosing that mechanism, even under the GPL. So it’s worth discussing what your options are here. How can you give someone else a computer program modified as GPL, if you are very worried about them sharing the source code?

First, a caution

First let me say that this is usually an unreasonable fear. Bryan Cantrill has run big tech companies for years and pointed out in some public talks that Open Source has never been a problem for his companies. Heck, it’s a perk for his developers—it helps him hire great talent. If I can distill why he thinks your fears are unreasonable, I’d say that it comes down to about three surprising practical facts:

  1. Your competitor companies are proud; they would often rather die than use your software. They’re thinking “oh that’s Acme stuff, but we’re better than them,” even when their company is financially crashing, on fire, into the ocean.
  2. Your competitor companies are often just as afraid of open-source licenses as you were before you read this. They’re thinking “If we do improve on Acme’s software, we’ll have to give those improvements back to them! We’ll be helping our competitors out!”
  3. Your competitor companies that are big enough to take your code and then beat you on your home turf would often rather buy your company outright, so that they get your platform and they don’t have to lose profits competing with you.

Open-source software has the very nice property that it becomes effectively immortal while proprietary software can and will die whenever the proprietors declare “it’s no longer in our financial interests to keep developing and supporting this software; bye!” without open-sourcing that software (which can itself be a mammoth task if parts were contracted out to others). Cantrill saw this personally when his company (Sun) was bought out by Oracle. If “we” means a particular legal entity, then maybe open source sounds crazy. But think about why we form LLCs: the promise of “if someone sues us into oblivion, we can fold this company and start anew.” In that sense “we” means the people who are working at this particular legal entity, and that “we” might want to outlive the death or acquisition of the company that they happen to be working at right now. Open source allows the software to outlive that, too.

So usually “my competitors will get to see my code!” is an unreasonable concern, when compared to the benefits of (a) your clients sometimes fix your software for you, (b) you occasionally convert competitors into clients, (c) you can advertise open-source contributions to hire better developers, (d) “you” the people making up the company have protections against company-level disaster.

But what options do you have?

  1. You can retain ownership of physical hardware. Some medical devices run a combination of proprietary and GPL software, most notably by running Linux. They make it explicitly clear that the hospital who is buying that device is renting it out from the company, perhaps for a one-time fee: the device-company still owns the device and therefore they do not have to share the source code with the hospital.

  2. You can sell support. In the comments, @perkins suggests that you might hand over the source code but that you also might say “hey, if you DO mess with any of this code, I will refuse to support it or send you any new updates I write.” Someone might desire their working relationship with you more than they desire to use their legal freedoms.

  3. You can sell proprietary plugins. There is an isomorphism between data structures and the control structures that consume them, so very often you may see a “platform” that is GPL but there are totally-optional “plugins” or “modules” which are proprietary. This requires some up-front effort, and you may want to run it by a lawyer (I am not one) to make sure that it does not count as “linking” in the GPL sense.

Again, these are usually not what you want to do and you are usually underestimating how proud your competitors are. But options do exist.

  • 3
    That's a useful explanation. Welcome to OS! – ArtOfCode Jan 13 '16 at 18:16
  • 3
    Wonderful explanation. I always wondered how the free software movement is different from open source, and I can see that now. – Prashanth Chandra Jan 14 '16 at 12:38
  • 7
    Do note that it would be perfectly valid to sell them the VM image which includes the source to your new application with the caveat that, while they're legally allowed to modify and redistribute your application, if you find out they've done it that will be grounds for terminating their support contract with no refund and never selling them a new version ever again. There are a number of groups that have adopted this business model since virtually all code requires updates, so unless your code would be easy for some other group to pick up and maintain it's a pretty good deterrent. – Perkins Jan 14 '16 at 23:14
  • 2
    @eMAD parts of it can, yes. For example if it has GPLed JavaScript, then the source code for that must be available. On the backend, source code disclosure is only needed to whoever you distribute the backend software to; if you never distribute the software for the website then you never need to distribute the source code. So, for example, if you customize WordPress to suit your needs, you likely do not need to release your code. – CR Drost Mar 21 '17 at 19:12
  • 2
    @eMAD: Yes, both GPLv2 and GPLv3 allow you to distribute the software in an "object code" form (any form that's not source code) with "a written offer, valid for at least three years" to also share the source with anyone who asks for it. You have to voluntarily disclose to anyone that you send the software to that its source code is available, but you do not have to publicly publish it. – CR Drost Mar 22 '17 at 23:19
39

Generally yes, the output is not covered by the license. However you say you will redistribute the virtual machine with the pipeline setup.

Nope, providing the virtual machine with executable binaries is the distribution of the executable binaries so please source code on the table. Just wrapping the virtual machine around does not change anything.

14

Distributing the Virtual Machine with the GPL-including-Software and not providing the sources (and/or the possibility to download/receive them) along with a GPL License notice is clearly a violation of the GPL itself.

Furthermore and if the Virtual Machine is based on a Linux distibution, distributing the Virtual Machine without the GPL'ed sources, i.e.: kernel and others (and/or the possibility to download/receive them) and a GPL notice would also constitute a violation of the GPL.

And the chaintool to recreate the binaries (you may provide your own proprietary barts as binary blobs) in the distribution must also be provided.

A real life example which covers this case

  • An ADSL router manufacturer provides only a "Box" which takes input and produces output. The manufacturer is forced to release the sources (given almost all of the routers are Linux based) and the chaintool to recreate the firmware image. Of course some manufacturers attempt to forego the obligation, with some of them having been successfully sued.

P.D. Yes, Tivo is also a device manufacturer and found a loophole in the GPLv2 to avoid loading modified firmwares and hence the GPLv3 special provisions to close that loophole.

9

There is an exact duplicate of this question here on Programmers.SE.

Yes, your understanding is correct. According to GPL, having a program run entirely on a server and accessing its output from a networked client doesn't constitute distribution (or in GPLv3 language, conveyance) to the client. Obviously this seems like a loophole given the philosophical goals of GPL, which is why the AGPL was created, to ensure that the copyleft clauses apply even in this scenario.

This is also why companies like GitHub (which uses git, GPLv2) or StackExchange (which uses Wordpress, GPLv2) don't have to open source their code, as interacting with their websites doesn't constitute distribution according to the GPL.

Just be wary of the language used in the GPL FAQ; saying "it would be legitimate to require release of the source code" doesn't mean you have to release source code, only that in GNU's opinion, this would be in the spirit of GPL.

  • Thank you, your answer and the one on Programmers address the web portal but how about the case where I would provide a client with a virtual machine where the pipeline is set up? Would that constitute distribution? – terdon Jan 13 '16 at 13:04
  • 7
    @terdon IANAL but I can't see how distributing SW on a VM can not be distributing software... the user ends up with a copy of the software, I wouldn't have thought it mattered whether it's as discrete files, a ZIP/tar file or an MSI etc. – TripeHound Jan 13 '16 at 13:45
  • 2
    @terdon you don't seem to get it, yes without any shadow of a doubt it is distributing. How dare you give (me say) something DERIVED from GPL things without (being willing to give me) the source code too. This is the point of the license. – Alec Teal Jan 13 '16 at 20:11
  • @AlecTeal I have been using foss software pretty much exclusively for the past 20 years and have been a staunch supporter of open source in general and the GPL in particular for just as long. Every project I have ever worked on has been released under the GPL. I "get it" just fine, thank you, and there's no call for you to take that tone with me. This question is about a future project of someone I am collaborating with and who, for various reasons, cannot take the foss route. – terdon Jan 13 '16 at 22:22
  • 1
    @terdon then why are you asking this question? Your question asked "can I distribute a VM with GPL derived stuff on it" in 20 years you didn't pick any of that sort of logic up? Also calm down, it's not like someone's taken your GPL work and given out a binary without giving you credit or anything! – Alec Teal Jan 13 '16 at 22:48
6

Be careful. Some uses of a program or library include parts of it in the result. Quite unlikely for a library, but a tool like e.g.bison writes a program that contains pieces of the source. In fact, bison is under GPLv3 with a special exception. Also, a compiler like GCC does something similar, and has also a similar exception to it's license.

  • Thanks, good to know. Any idea whether distributing a VM with the software installed constitutes distribution of the software? – terdon Jan 13 '16 at 13:11
  • 1
    @terdon, that is another question. And, even to me as a complete non-lawyer, it is distribution unless you stay in complete control of the VM on which it runs at all time (like it was a physical machine you lend with your program). And in that case I'm not completely sure it isn't distribution... – vonbrand Jan 13 '16 at 13:13
  • 1
    That's the question I was actually asking. Perhaps I didn't make it clear enough. OK, thanks. – terdon Jan 13 '16 at 13:23
  • 3
    @vonbrand: Renting out a machine, physical or virtual, with GPL software on it? That's a "consult your lawyer" case. I'm inclined to treat it as a distribution, if only because a 99 year lease is de facto a sale. – MSalters Jan 14 '16 at 16:29
  • 1
    @MSalters, I was thinking more in the line of "I provide a service, which incidentally includes installing a machine of mine on your premises, which I am completely in control of". – vonbrand Jan 27 '16 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.