34

In a recent question on programmers.SE, it was asked whether a project is open source if it provides some source code but doesn't make it clear how to actually compile it. Consensus is that it's not required for compilation to be easy, but that raises the question where to draw the line between non-obvious and impossible.

Assume a company sells a program written in, say, C, including some code taken from third-party, GPL-licensed sources. They provide both a binary of the program, as well as all their own C source code used in that project, but no e.g. Makefile or build scripts. Or, only scripts which assume the presence of some particular (possibly non-free, in-house) compiler. It turns out the project can not just be compiled with a simple setup of the usual implicit rules (like .c+.h.o and *.oa.out).

Is the company violating GPL?


I'm not asking about the specific program discussed in the linked question (which, apparently, is actually not that hard to compile unless you happen to use Windows), nor any other particular project.

3
  • 8
    One concrete example is "tivoisation", which RMS felt was not successfully prohibited by the (OSI-approved) GPLv2 and which motivated GPLv3. OK, so the hurdle there was erected at the very last step: executables needed to be signed to work on TiVo hardware and the signing key was missing. But arguably it's the same kind of thing: you could manipulate the source but you couldn't produce a working executable, and an open source license (GPLv2) permitted this form of distribution, albeit it was not intended to permit it. Mar 29, 2016 at 12:30
  • 3
    You forgot to mention that in the "programmers.SE" question the project does compile (probably) on Linux, but the OP wants to compile on Windows. So at least from the open source project perspective, there is no malice, like your question is suggesting.... Mar 29, 2016 at 13:15
  • Related: if you do not ship object code, you are under no obligation to provide such scripts.
    – o11c
    Apr 7, 2016 at 18:14

2 Answers 2

24

IANAL, but I believe the answer is yes, you violate GPL. If you distribute binaries, then GPL requires that you also distribute all the files necessary to rebuild that same binary, and to make modifications. GPLv3 has the specific term "corresponding source", which you must convey in addition to, and in a similar manner to the source code. Under section 1:

...

The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.

...

(emphasis mine)

Under this generalised definition, the following will be included:

  • Makefiles (needed to generate object code from source code)
  • Installation scripts (needed to install object code)
  • Program data files (needed to run the object code)

GPLv2 also has a similar clause, in section 3:

... For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. ...

So if someone distributes binaries and source code but does not provide compilation instructions (e.g. Makefiles), they may be violating the GPL.

One of the goals of the GPL is to protect users' freedom to modify software. These clause are meant to serve that goal.

I'm surprised that among the voluminous GPL FAQ questions, none address this point. But gpl-violations.org (not GNU affiliated afaik) has one:

The GNU GPL demands that as soon as you distribute GPL licensed software in executable format you make available the "complete corresponding source code". The GNU GPL also contains a definition of this term:

The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.

This is a quite precise definition. For a typical C program, this translates into all the source code (.c files) plus header files (.h files) plus the scripts used to control compilation and installation.

(emphasis mine)

The SFLC also publishes an article, A Practical Guide to GPL Compliance, which contains a section relevant to the question:

4.2.2 Building the Sources

Note that you must include “scripts used to control compilation and installation of the executable” and/or anything “needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities”. These phrases are written to cover different types of build environments and systems. Therefore, the details of what you need to provide with regard to scripts and installation instructions vary depending on the software details. You must provide all information necessary such that someone generally skilled with computer systems could produce a binary similar to the one provided.

...

[...] Sometimes, however, scripts were never written (e.g., the information on how to build the binaries is locked up in the mind of your “build guru”). In that case, we recommend that you write out build instructions in a natural language as a detailed, step-by-step readme.

No matter what you offer, you need to give those who receive source a clear path from your sources to binaries similar to the ones you ship. If you ship a firmware (kernel plus filesystem), and the filesystem contains binaries of GPL’d programs, then you should provide whatever is necessary to enable a reasonably skilled user to build any given GPL’d source program (and modified versions thereof), and replace the given binary in your filesystem. If the kernel is Linux, then the users must have the instructions to do the same with the kernel. The best way to achieve this is to make available to your users whatever scripts or process your engineers would use to do the same.

(emphasis mine)

Note: All of the above only applies if you are distributing a binary. If you only distribute source code, there is no requirement to distribute all your changes, or for these changes to be even compilable. See section 6 of the GPL v3, or term 3 of the GPL v2.

Thanks to sleske for the corrections to GPLv2 applicability.

16
  • 4
    I think you mean "yes" at the top, don't you? It seems to me that you give a pretty good argument as to why the conveyor must provide source code in a form that will compile to the conveyed executable - in which case the answer to the original question is yes, you violate the GPL if you provide source code that cannot be compiled. I don't want to add any more until I'm sure you mean what you say!
    – MadHatter
    Mar 29, 2016 at 15:29
  • 1
    @supercat If I receive a copy of GPL-covered binary and source that is signed for use in the $50 machine, I think it's safe to say that that binary was distributed "specifically for use in" (GPLv3 Sec.6) the $50 machine, and I am entitled to "Installation Instructions" to modify and resign the code to run in the $50 machine. If the code I receive is unsigned and will not work as-is in the $50 machine, then the distributor can fairly say that the code was "intended for use" only in the $15k machine, because, indeed, it won't work in the $50 machine unsigned.
    – apsillers
    Mar 29, 2016 at 16:05
  • 7
    It's worth noting for clarity that you must provide build scripts (etc.) to produce a binary form identical to whatever binary you distribute. If you don't distribute a binary, then you don't have any obligation to provide buildable source code whatsoever. I'm sure this is obvious to you, but may be a helpful clarifying point to others. Specifically, you could change, "if someone distributes source code but does not provide compilation instructions..." to "So if someone distributes source code alongside a binary but does not provide compilation instructions to recreate that binary..."
    – apsillers
    Mar 29, 2016 at 16:16
  • 3
    This is a very confusing answer. It's written no in bold, then goes on to describe why the answer is yes.
    – wim
    Mar 29, 2016 at 17:03
  • 2
    @congusbongus: The GPL v2 has similar language to v3: "The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. " So including things like Makefiles is definitely required for binary distribution under GPL v2, too.
    – sleske
    Mar 30, 2016 at 11:02
4

I am not a lawyer, but I would believe that the copyright owner of a GPL-ed software cannot thus violate the GPL, since legally GPL is based upon copyright law.

In particular the copyright owner can use or release (and sell) his code under some other, non-free or non-open source, license.

License violation is a legal concept (ultimately judged in court). It is not a matter of "intents" or "being nice".

Notice that GPL code explicitly states that there is no warranty.

  1. Disclaimer of Warranty.

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

You could argue that the company is violating the spirit of the GPL, but probably not the letters of that license.

I believe that the fact that a code is difficult or impossible to compile is a "quality" issue... (so is a "defect" of the source code).

Also, I would believe that making a git commit of any GPLv3 software on github is probably "conveying" or "releasing" that software. And it does happen in practice that (by human mistake, not malice) a commit sometimes does not even compile. If your interpretation was correct, that would be a legal violation of the GPL, then I'm sure that lawyers of competitors companies would have tried to sue big companies in such cases, and I never heard of such cases.

Again, IANAL, since I am simply a free software developer.

At last, source code can be viewed as addressed to human developers. It is their responsability to compile or use it (and code written in Python is generally never compiled, because Python implementations are interpreters)


a thought experiment.

Imagine that I am working in the richest computer science lab (or IT corporation) in the world. So I have access to the most powerful Linux computer on Earth (e.g. the only computer on Earth with 16 terabytes of RAM, addressable by a single processor). I'm coding a program which (like my GCC MELT thing, or my manydl.c program) is metaprogrammed: it is a C program basile.c which generates another C program /tmp/generated.c (and need 15Tb of RAM to generate that) and forks a compilation gcc -O -fPIC /tmp/generated.c -shared -o /tmp/generated.so then dlopen that /tmp/generated.so. Let's suppose that the /tmp/generated.c code is so weird (e.g. it has a single C function of a hundred millions lines) that any reasonably optimizing C compiler (both GCC & Clang/LLVM...) needs 16 terabytes of RAM to compile /tmp/generated.c. In that hypothetical situation, I am the only person in the world able to compile and run that entire thing (because nobody else has access to a 16Tbyte RAM computer). IANAL, but I hope that if I publish that code under GPLv3 license, I won't be prosecuted for GPLv3 violation. People would be able to read the code -assume I also documented it nicely- and perhaps even improve it (so that it could be compiled and run on a simple powerful PC).

To makes things even more funny, imagine that basile.c has #include "generated.c" and I am releasing/publishing under GPLv3 both files. People could still modify that to make it compilable, even if they could not compile the original code without accessing my hypothetical 16terabyte computer.

6
  • 7
    I don't think this question is intended to ask about the copyright owner doing this. Rather, somebody is distributing a work with multiple authors, possibly including themselves, and "some of the code [is] taken from external GPL-licensed sources". I think "external" is supposed to mean the person doing the distributing is not the copyright holder of that part of the code they're distributing. Mar 29, 2016 at 13:25
  • The copyright holder can't violate their own GPL license grant, so your answer doesn't really address this specific possibility of violating the GPL -- the same is true of every other possible way of violating the GPL: a sole copyright holder with work licensed under the GPL can't do it. The interesting question here is whether someone else who is distributing a derived work with GPL obligations to some other copyright holder fails to satisfy their GPL obligations to that copyright holder by failing to supply installation instructions.
    – apsillers
    Mar 29, 2016 at 15:39
  • 1
    As the sole copyright holder, I can violate the GPL, but I'm the only one who can sue myself for it :-) (If I give you my own application without source code, that's a violation, but the only thing you can do about it is ask me politely to sue myself, which I will equally politely refuse to do. For the copyright holder, violations have no consequences).
    – gnasher729
    Mar 29, 2016 at 16:26
  • 1
    @gnasher729: If you are the sole copyright holder, and you do not wish to distribute the source code to your binary, there is no point in placing your code under any version of the GPL. As the sole copyright holder, placing your code under GPL is a promise to the Universe to release the source upon request, subject to certain restrictions, said restrictions designed to ensure that nobody ELSE takes that code private. Mar 29, 2016 at 19:37
  • 2
    If the GPL license is offered to you by the copyright owner, and you accept the offer, then a contract is in place between you, and the copyright owner why offered the license is also bound by it. However the GPLv3 doesn't require to offer compilation scripts along with the source, if you are only distributing source code. It only requires you to offer the "Corresponding Source" (the compilation scripts etc) if you distribute binaries. Mar 30, 2016 at 3:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.