When using an AGPL v3 licensed software within a public-facing web application hosted on a private server, you are obligated (section 13) to share your code if you modify the original AGPL code. Many companies providing AGPL code also provide a commercial offering that is not AGPL licensed.

My question is, if I'm a software developer and I simply "use" the AGPL code without modification (again, in a public facing web application hosted on a private server), such as by linking a library (e.g. java import), to create a derived work, then provide a web service for the public to access the derived work, how would the original AGPL author upon seeing my service and output, know that I did NOT modify the original AGPL3 code?

Or conversely, from the other point of view, if release software with an AGPL3 license andlater observe someone is distributing a derived work without an AGPL license via a web app, how would I know whether or not this derived work DID modify my original code licensed as AGPL3 (to determine if they're infringing)?

Simply redistributing a derived work without AGPL license (again, in a public web app hosted on a private server) does not mean one is infringing on the original AGPL license, because the derived work needs to MODIFY the original AGPL code. So, in practice, how does one determine infringement?

Do lawyers actually contact companies out of the blue and demand to see their code in all its detail (can they do that?), then get programmers to pour through the code line by line to see if the original AGPL code was modified? Otherwise, it seems impossible to know. But, this doesn't seem practical, and can waste a lot of resources.

How does this play out in practice? Is my understanding of AGPL correct here?

  • 3
    When distributing a A/GPL program, modified or not, you need to include the license and provide the source code on demand, otherwise it's a violation. So your question doesn't make much sense. – Zimm i48 Oct 30 '16 at 17:59
  • @Zimm, I agree if you're talking about the original A/GPL code. But regarding the non-A/GPL code that uses the A/GPL code, doesn't the A/GPL obligation to share software only relate to modified versions of that software? That is, if the original A/GPL software is simply being used by non-A/GPL software, there's no obligation to share the non-A/GPL software. Or, am I confused somewhere? See related question that spawned this question: opensource.stackexchange.com/questions/4691/… – user46688 Oct 30 '16 at 18:05
  • 2
    After reading this other question I understand were the confusion is coming from. The question of whether the software has been modified only matters when you are running the software on a server (which is otherwise not considered redistribution). My previous comment was for traditional redistribution (making the binaries available for download typically). So I suggest you reformulate your question to limit it to the specific case of running a (possibly modified) AGPL software on a server. – Zimm i48 Oct 30 '16 at 18:12
  • 1
    Also make sure you don't confuse (private) use and redistribution of a program deriving from the work. – Zimm i48 Oct 30 '16 at 18:13
  • 1
    OK, I tried to clarify things in the original posting. Feel free to edit it as well if it's still not clear. – user46688 Oct 30 '16 at 18:22
up vote 7 down vote accepted

Section 13 of the AGPLv3 says

...if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version...

So when do you modify the program? The license text says:

To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission

So the central question is whether your combination of new code plus unaltered AGPL-licensed code creates a derivative or combined work under copyright law, such that you would need to permission from the copyright holder to prepare it:

  • If so, you must make the source code of your entire work (which comprises your work and the AGPL-licecnsed work) available to network users.
  • If not, and your work is actually separate from the AGPL work under copyright law, then you do not satisfy the criteria in Section 13 and the AGPL does not impose its source-sharing requirement on you.

Whether the linkage or interaction between the two works will create a derivative work is not an exact science. The FSF's opinion is captured in their GPL FAQ:

What is the difference between an “aggregate” and other kinds of “modified versions”?

[...]

Where's the line between two separate programs, and one program with two parts? This is a legal question, which ultimately judges will decide. We believe that a proper criterion depends both on the mechanism of communication [...] and the semantics of the communication [...]

[...] If modules are designed to run linked together in a shared address space, that almost surely means combining them into one program.

By contrast, pipes, sockets and command-line arguments are communication mechanisms normally used between two separate programs. So when they are used for communication, the modules normally are separate programs. But if the semantics of the communication are intimate enough, exchanging complex internal data structures, that too could be a basis to consider the two parts as combined into a larger program.

For the second part of your question, how to practically determine if a particular web service uses AGPL-licensed code in a way that the license would require source availability: this, too, is an inexact science. To a limited degree, the same problem exists in non-networked software: how do you determine if closed-source software A secretly and illegally includes work from copyleft-licensed software B? In that case, we can do reverse engineering on the binary, but it can be extremely difficult, especially if the closed-source project deliberately obfuscated their use of the copyleft code.

Ultimately, this is very difficult practical problem, and it could be very hard (harder than it is already for non-network software) to prove infringement. In general, you might have a reasonable case if you can demonstrate an uncanny similarity (e.g., it has the same bugs as your software) or if the service provider outright admits using your AGPL-licensed software. The degree to which a court could demand to examine the source code of such a potentially-infringing service surely varies by jurisdiction, and is possibly untested is some jurisdictions.

If you are seriously concerned about this, you may want to speak to an experienced intellectual property lawyer in your jurisdiction who might tell you your options and how a court would go about judging the merits of such a copyright infringement case.

  • Thanks so much @apsillers. So, if I simply use a function in an AGPL3 library in a function I write sitting in a public web app, could this act of using that function be interpreted legally as modifying the original AGPL3 software, thereby triggering redistribution of my code (per section 13 of AGPL3)? Is the answer yes, no, or "it depends"? – user46688 Oct 31 '16 at 16:40
  • 1
    @user46688 As long as the the function is sufficiently creative and substantial to qualify for copyright protection (i.e., it is not such a simple function that the merger doctine applies) its unlicensed use in another person's work would be copyright infringement. This sounds to me like it satisfies the "modify" definition of the (A)GPL, but the subtle nuances of law might disagree; I'm not sure. Also, it's possible the infringing use of a small amount of code would carry a lesser punishment than use of a more substantial amount. – apsillers Oct 31 '16 at 16:50
  • Thanks @apsillers. Just knowing that it is indeed possible that calling a function in an AGPL3 library can possibly be interpreted as "modifying" the original code is quite an eye-opener. So, basically, using an AGPL3 library in any way can possibly trigger an obligation for redistributing the derived work. Thanks for taking the time to write down your thoughts. – user46688 Oct 31 '16 at 17:01
  • @user46688 Ah, I misunderstood "use" as "incorporate within" rather than "call from an external library". Understood in that sense, I think the answer is still "it depends; courts will decide" as quoted in my answer; maybe the minimal use will influence the court's decision, maybe not. If would probably not, for example, if your code calling the library is just a simple wrapper of the AGPL code. – apsillers Oct 31 '16 at 17:06

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.