There are several Q&A about the AGPLv3 on this site and some answers are sending vague or mixed signals.
Here is an (hopefully) clear and definitive answer with references.
First the AGPLv3 is essentially the same license as the GPLv3 with the addition of Section 13 as you can see in this side-by-side diff of the two license texts:
- Remote Network Interaction; Use with the GNU General Public License.
Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. [...]
The intent of this new section is spelled out clearly in the preamble (bold emphasis is mine):
The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.
The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version.
Now let's look at which parts of the AGPLv3 are triggered in your four cases:
You are using an unmodified
exact copy of this library. Therefore this definition of Section 0 is relevant. You are not using a
modified version if you are using an
exact copy (bold emphasis is mine):
To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work.
Therefore per Section 1 in all three cases (bold emphasis is mine):
This License explicitly affirms your unlimited permission to run the unmodified Program.
And therefore since you did not modify it, the section 13 is not triggered.
- In case 1, you certainly do not "propagate" the work: you are instead
executing it on a computer.
- In case 2 you may be "propagating" the work as your are somehow indirectly
making it available to the public by running your public web server. Yet this is not 100% clear as you are not distributing a copy. I take a prudent point of view that you may be "propagating".
- In case 3 you are clearly "propagating" the work as you [re]
distribute the code.
(as defined in section 0)
To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
You are clearly only conveying in case 3. In case 2, you are propagating but not conveying as there is
no transfer of a copy.
(as defined in section 0) (bold emphasis is mine)
To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
Your further mention that as such this library does not have a built-in mechanism to offer a download of its corresponding source code as explained in the Section 13. Since this library does not have a built-in mechanism to self-download its corresponding source code, your propagation does not
enables other parties to make or receive copies. Which further reinforces the fact that your are not "conveying" in case 2.
You also mention that this library takes your data and create some report format. I will assume that therefore the output is not subject to the license of the library itself and this part of Section 1 does not apply in your case:
The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work.
Finally, in all cases your application is combined and depends on the AGPL-licensed library and I would consider that its copyleft extends to your own source code.
But when is the copyleft effectively triggered in these cases? (and of course the copyleft requirement to eventually redistribute the source code of your own application?)
Since you are using the library unmodified, the key is whether you are either propagating or conveying or both
1. when I run this application on a private company network and its is only available internally to my company?
In this case, you are using the library internally unmodified, without neither conveying nor propagating:
And per Section 1
This License explicitly affirms your unlimited permission to run the unmodified Program. [...]
You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force.
This is all I have to say about your case 1: you do not have to make any source code redistribution of your own code using this library and of this library in this case.
2. when I run this application on a public web site on the open internet?
You are using the library unmodified, and there is no built-in Section 13 corresponding source code download mechanism. In this case you are propagating but not conveying. Therefore none of the Section 4, Section 5 and Section 7 apply here. In this context, the AGPLv3 is not different from the GPLv3. This is like running an unmodified GPLv3 program that you call from your own code on a publicly accessible web server backend. The copyleft is NOT triggered in the sense you do not have to make any source code redistribution of your own code or of this library.
3. when I redistribute this application as a packaged software product to possible customers?
You are using the library unmodified and there is still no built-in Section 13 corresponding download mechanism (but that mechanism would not matter much in this case).
Here you are propagating AND conveying. Therefore the Section 4 applies. In this context, the AGPLv3 is still not much different from the GPLv3. You are redistributing an application that is based on the unmodified AGPLv3-licensed library.
And the copyleft is triggered: you have to make a redistribution of the corresponding source code of both your own code and this library. In this case, this could also cover Tomcat, though Tomcat may also be treated as a "System Libraries" per Section 1.
4. What if in my case 2. the author of the library insist that the copyleft is triggered even if I am using the library unmodified and that I must redistribute the whole source code, including my own?
In this special case you should never ignore this interpretation (even though it looks clearly incorrect based on the facts I presented here) and you have two options:
You could consider that short of proper
Additional Terms compliant with the Section 7 of the AGPL, the author is trying to make a modification to the AGPL which is not OK under this license as the first statement says
Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.. You could discuss this with the author and if you want to take the high road involve the FSF in a private discussion at first to resolve the matter.
Or you could take this author assertions and comments at face value and treat this as if it were part of the license. This is usually my approach. E.g in this case and if you do not want to redistribute your source code when using the library unmodified in your case 2. you could just pass using this library entirely if anything because of its possibly incorrect and unclear licensing. Or use it and adopt its author's interpretation of the AGPLv3 -- even if not based on license text facts.
Finally let me provide some additional quotes supporting this answer:
From Jeffrey Kaufman in his article Do I need to provide access to source code under the AGPLv3 license?:
What is often misunderstood is that the source code requirement in AGPLv3 Section 13 is triggered only where the AGPLv3 software has been modified by "you" (for example, the entity providing the network service). My interpretation is that, so long as "you" do not modify the AGPLv3 code, the license should not be read as requiring access to the Corresponding Source in the manner prescribed by Section 13. As I see it, many unmodified and standard deployments of software modules under AGPL simply do not trigger Section 13, although making the source code available even if not required under the license is a good idea.
From @apsillers who relates his exchange with the Free Software Foundation in his answer to a very similar question: Do I have to offer the source of an AGPL (v3.0) licensed Web app even if I didn’t modify it?
I wrote to the FSF's licensing team about this question:
[...] Does this [section 13] mean that if I run a *completely unmodified* AGPL-licensed program as a network service, I am *not* required to offer the source code to network users?
And I received this response (bracketed phrase added by me):
[...] If you haven't modified the software then you are not required to add that functionality [i.e., to download the source]. Of course, if the functionality to download the source is already in the unmodified software, it will already be there for everyone to enjoy.
This exchange with the FSF is consistent with the Free Software Foundation article on Why the Affero GPL?:
[...]Suppose you develop and release a free program under the ordinary GNU GPL. If developer D modifies the program and releases it, the GPL requires him to distribute his version under the GPL too. Thus, if you get a copy of his version, you are free to incorporate some or all of his changes into your own version.
But suppose the program is mainly useful on servers. When D modifies the program, he might very likely run it on his own server and never release copies. Then you would never get a copy of the source code of his version, so you would never have the chance to include his changes in your version. [...]
and (with my additions in brackets):
If D runs his version [e.g. the version that he modified] on a server that everyone can use, you too can use it. Assuming he has followed the license requirement to let the server's users download the source code of his version, you can do so, and then you can incorporate his changes into your version. (If he hasn't followed it, you have your lawyer complain to him.)
Heather Meeker makes this consistent comment in her the book "Open Source for Business" on page 134 after quoting the AGPL section 13:
Note that these requirements only exist if you modify the software. Mere users need not make the source code available. [...]
And she further makes related comments in her article AGPL: Out of the Shadows:
[...]Not surprisingly, AGPL3 has been slower to propagate than GPL3; if GPL3 has gained acceptance slowly, AGPL3 has been tagging along behind like a younger sibling. But the license is not as scary as it seems. The network interaction provision only triggers source code offer requirements when you modify the Program. In fact, most open source software is used without modification from community versions.[...]
And yet another comment in her article The Gift that Keeps on Giving – Distribution and Copyleft in Open Source Software Licenses that highlights what "convyeing" means:
A Clear Case in the Clouds
Ultimately, this variation was removed from GPLv3 and memorialized in an alternative form of the license known as the “Affero GPL.” The basic form of GPLv3 makes clear that ASP or SAAS use does not trigger copyleft requirements. In GPLv3, copyleft is triggering by “conveying” rather than distribution, and “To ‘convey’ a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.”
Under US law, distribution requires actual transfer of a copy, in whatever form. Therefore, under US law, SAAS use – which involves the access of software without transfer of a local copy to the user – does not trigger copyleft requirements.
Dr. Miriam Ballhausen in the article OpenSaaS: Using Free and Open Source Software as Software-as-a-Service makes this comment, with a point view of Germany (emphasis is mine):
According to Section 13 AGPL-3.0 the SaaS provider - as the person who offers his users to remotely interact with a program via a computer network - is obliged to license any modifications to software licensed under AGPL-3.0 also under AGPL-3.0. In particular, he must give all users (but not all third parties) the opportunity to obtain the corresponding source code of the software version made available via SaaS.