6

This question and answer were created as a clarification to AGPLv3 source redistribution: when does it apply to my code for a server-side Java app using an AGPL-licensed library?

Suppose that:

  • I want to create a closed source server-side application.
  • I want to use an AGPL library X in this application.
  • The AGPL library X contains a bug that no one is fixing, but that makes my closed source application useless as long as it isn't fixed.
  • Suppose that I don't want to share my own code, but I want the bug to be fixed.

Can I pay a middleman to publish an AGPL library Y, based on library X, that contains the bugfix, so that I can keep my application closed source by using the unmodified code of library Y released by the middleman?

  • 4
    Well, due to those discussions on the reach of the AGPL and how it impacts the code outside it, I've seen (literally, with my owns eyes) great AGPL projects being left out in favour of other not-so-good-but-with-a-less-tricky-license projects. – woliveirajr Jan 23 '17 at 12:42
2

The AGPL does cover non-modified use of the original code.

To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work.

A "covered work" means either the unmodified Program or a work based on the Program.

Text taken from the license itself. Bolding mine.

Notice here you are still adapting even if you use the entire unmodified library in your project. Because you are making a "derivative work" as would be mentioned in the GPL, and because you are adapting the code by writing code to interface with it, you still must abide by the AGPL.

My take on this license is that since the AGPL simply adds some conditions to the GPL, anything linked to a piece of AGPL software must also be AGPL.

Here are some questions with widely differing opinions on other SE sites: 1, 2, and 3.

Here are some software authors' opinions on the matter: Scylla does believe in the loophole, MakeHuman does not. Quoted below:

We promise that we will not seek to enforce the copyleft provisions in the AGPL v3.0 against you if your application (a) does not link to the Scylla database directly but exclusively uses Scylla drivers, and (b) you have not modified, added to, or adapted the source code of the Scylla database in a way that would result in the creation of a “modified version” of or a “work based on” the Scylla database as such terms are used in the AGPL v3.0.

and

I want to link to MakeHuman as a library in my non-gpl -licensed application.

You can't. AGPL stipulates that any derivate or aggregate has to be licensed AGPL too.

As a side-note this is the functional difference of LGPL and GPL/AGPL. LGPL does allow linking without forcing the end result to adopt the LGPL license. But MakeHuman is licensed AGPL, not LGPL.

The gray area around this is such that I would recommend a lawyer for any questions involving commercial use.

  • Guys, if you feel like talking it over, here's a chatroom. – ArtOfCode Jan 23 '17 at 17:23
  • Thanks @Art. I wasn't going to talk about it anymore anyway because I won't convince him nor he me. – oldtechaa Jan 23 '17 at 20:04
7

According to Philippe Ombredanne, one can use an unmodified AGPL library in a closed source web application. I quote:

I cannot fathom how you could consider that "Software that is based on/is linked with/uses an AGPL library is considered software that modifies the software" is a possible interpretation any way I look at it. If there are no modified bits, then how can you claim that it has been modified? Say I use the verbatim sha1-identical iText Jar you published on Maven Central and I use it as-is in an application (internal or public): How could using be considered a modification? If this assertion is true, then I am modifying every software I use or run which does not make any common sense.

That interpretation goes against common sense because it would cause a middleman loophole that make all AGPL software that is used on a server act as if it were LGPL software.

LGPL only requires changes made to the library and not changes made to the whole work using the library to be made open source. A narrow interpretation of unmodified would have the same effect: a middleman could publish a modified version of the original AGPL software. The middleman could meet all the requirements of the AGPL. If Philippe Ombredanne is right, that "new" AGPL library could then be used in a closed source web application.

That's not correct. It was never the intention when the AGPL was created: the AGPL was created to close a loophole, not to create a new loophole.

What is the point of view of the FSF in all of this? The page explaining why not to us the LGPL explains why a narrow interpretation of modification goes against the spirit of free software:

We free software developers should support one another. By releasing libraries that are limited to free software only, we can help each other's free software packages outdo the proprietary counterparts. The whole free software movement will have more popularity, because free software as a whole will stack up better against the competition.

The middleman loophole can only be used if modification is interpreted in a very narrow way. That's not the way of the free software developer as it would make it possible to use AGPL in non-free software.

Summarized: No, the middleman loophole can't be used to make AGPL behave as LGPL, because the "unmodified" premise you used was wrong.

Update:

In the comments, people are claiming that no attorney is joining this conversation, to which I replied by referring to a video that explains when the copyleft kicks in. I was asked to make the content of this video available to people can't (or do not want to) watch the video. To meet this request, I am copy/pasting some of the slides that are presented in the video:

Software is covered by copyright law. The GPLv3 grants rights to users if they meet specific conditions:

enter image description here

Merely running GPLv3 software doesn't "activate" the conditions:

enter image description here

However: integrating GPLv3 software into an application, distributing,... can only be done if the GPLv3 is accepted.

enter image description here

In other words: the copyleft kicks in, and the AGPL makes the copyleft kick even if the application runs on a network:

enter image description here

In this case, you must distribute your application under the (A)GPLv3:

enter image description here

This is inherent to the concept of copyleft.

Update 2

The accepted answer quotes the AGPL:

To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work.

David Schwartz doesn't accept this argument, and in the comments he says:

For example, when you color in a coloring book, you are arguably creating a derivative work. But it won't be treated as one because it was a necessary step in using the coloring book in the ordinary, expected way.

I didn't agree with this argument, so I asked my lawyer if the law would agree. He gave me this example:

Recruiters use tests to assess candidates for a job. An example of such a test is the Foursight Thinking Profile test. This test comes as a series of questions that need to be answered by a candidate. These questions can be asked orally, or they can be distributed on a paper form that needs to be filled in. The candidate answers the questions, and either the candidate or the recruiter calculates a score that corresponds with a "thinking profile."

This test is copyrighted. The recruiter can fill it out himself or herself as many times he wants without violating the copyright, but every time the recruiter presents the test to a candidate, he or she has to pay a small copyright fee. Note that the recruiter doesn't change the form. If he changed a question, he would make the test useless because not the test as such is important, it's the resulting thinking profile based on the data filled out by the candidate that matters.

Now back to software: a software library is like that test. If you use a library for your own purposes, you are making normal use of the copyright. However, if you use a library to get a result based on an action of another user, you need permission to use the copyright.

This confirms what I said earlier: if you'd use an unmodified AGPL PDF library to create PDFs without any interaction of another user, you don't have to accept the AGPL. However, if you use an unmodified AGPL PDF library in an application that creates invoices based on a user request, the AGPL kicks in, and you have to disclose your own source code.

  • 4
    I think Philippe's statement is the common sense one and I think its hard to refute it without changing the common sense interpretation of modification. The statement from the FSF from 'why not use the LGPL' is only tangentially related to AGPL. This answer does not quote any of the AGPL license text, or any interpretation from someone with a legal background, that supports your interpretation. So I do not see this as a correct answer. – Roy T. Jan 23 '17 at 8:37
  • Some things in open source licenses are implied. Take for instance the difference between the MIT license and the BSD license that adds the clause about redistributions in binary form. Some people think that the copyright notice isn't needed for compiled MIT code because that clause is missing in the MIT license, but that's nonsense, because the MIT doesn't need to say this explicitly. That is already covered by the Berne Convention for the Protection of Literary and Artistic Works. As I said before: in the end, it is a judge who will decide, and he'll look at the AGPL and at the law. – Bruno Lowagie Jan 23 '17 at 9:18
  • @RoyT. Check out this video: youtube.com/watch?v=NCwhEWEPV-E Ywein van den brande is an IP attorney and he has written and co-authored different books on the subject. – Bruno Lowagie Jan 23 '17 at 9:24
  • Could you instead provide references in your answer of quotes of this video that support your answer? We cannot ask users of this site to go offsite watching a 15-minutes long video if this contains the substance of an answer. – Philippe Ombredanne Jan 23 '17 at 9:42
  • 3
    The answer has changed significantly but I still do not see how they support your conclusion. You're using a 'what was meant with' argument and show that this argument is sometimes enforced but again nothing specifically talks about the AGPL-middleman loophole and what modified exactly means. I still think that your definition of modified is very far from the regular meaning. – Roy T. Jan 23 '17 at 12:07
0

I am not sure the title of your question matches its body so I see two questions here: one in the title and one in the body:

Can I use the middleman loophole to reduce AGPL to LGPL?

I am not sure what is the middleman loophole but what is sure that the AGPLv3 has no provisions to be toned down to the LGPLv3. What it has instead is a section 13 that allows to combine GPLv3 code with AGPLv3 (and the GPLv3 has similar reciprocal terms in its own section 13). There is not much more I can comment on this topic.

Can I pay a middleman to publish an AGPL library Y, based on library X, that contains the bugfix, so that I can keep my application closed source by using the unmodified code of library Y released by the middleman?

You can surely pay a middleman to do this, but in doing so I do not see any difference between doing this with a middleman and you modifying this library directly. This middleman is just an extension of you and would likely be treated as if it were you. Therefore every terms of the AGPL that are triggered by you using this middleman "modified" version would apply to you. And eventually if "you" do not share back these modifications you would be in violation of the AGPLv3 terms.

To be very clear in this case if you keep my application closed source by using the unmodified code of library Y released by the middleman then you would be in violation of the AGPL and eventually not licensed. Whether or not anyone can prove it is another matter. In my own experience, this type of evil behavior is rather quite rare: folks are usually more likely to be ignorant than evil doers.

Now let me play a little What if? and be the devils advocate (though for the sake of clarity I am not trying to escape copyleft obligation myself nor would I ever condone anything or anyone that would try to do so. As I mention below, I think this would be a clear violation of the AGPL terms).

What if you establish a secret covenant with your middleman such that none can ever know that you have paid a middleman to perform this modification on your behalf?

This does not change the facts that this middleman is essentially the same as you though it would be hard or impossible for an external party not aware of this covenant to prove that the middleman is in fact just you in disguise.

You would therefore not be licensed under the AGPL if you do not share back your fixes, though none could prove this.

What if another party P finds the public release made by your middleman with your modification and is not privy to your secret covenant with your middleman?

If P is in good faith reusing this unmodified (e.g P is reusing the unmodified version made by your middleman that incorporates the modifications paid secretly by you), then the AGPL terms for unmodified use apply alright as explained in my related answer. From the standpoint of P, this middleman version is used by P unmodified and there is nothing specific in the GPLv3 or AGPLv3 that would preclude this, to the contrary: the spirit of the AGPLv3 as explained in the its preamble is to ensure that "modifications" are shared back and in turn each shared modified version becomes a new unmodified version from the point of view of the user at the end of the reuse chain:

The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.

The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version.

... and here again because the middleman shared the modifications and because P is not you and reusing without knowledge of your secret covenant, all is well.

Why would anyone care about someone using an unmodified version if that unmodified version corresponding source code is available from its distributor publicly already?

The AGPL does not care in this case. What the AGPL cares for is for modified versions as it should and clearly states in its text.

  • That's a very elaborate construction to escape the copyleft obligation, wouldn't you say? It's for people like you, interpreting the AGPL and copyright/copyleft to their own advantage (and to escape having to give anything back at the community, ever) that we added the clarifying note about modification to our AGPL library. In this post-truth times, one can't be clear enough. Givers have to set limits because takers rately do. That's sad. That's not what free and open source software is about. – Bruno Lowagie Jan 23 '17 at 16:39
  • Maybe we should stop creating foss altogether if ever a judge accepts your point of view. So far, we've only had to go to court once to defend our AGPL library against abuse. We won the case without any problem. – Bruno Lowagie Jan 23 '17 at 16:39
  • 1
    It's also strange that you don't see that, should your point of view be correct, then there would be no difference between LGPL and AGPL software when that software is used in a network context. That goes against all logic. A middleman could always provide a modified version to escape the copyleft obligation. – Bruno Lowagie Jan 23 '17 at 16:43
  • 1
    Folks, I love how there is some really good insightful discussion, and I would hate to be the one to ruin it. Please be respectful of others, no matter how much you may disagree with their opinion. Keep it constructive; don't move on to name calling since that's just plain mean. Remember to Be Nice. Comments are not for extended discussion; this conversation has been moved to chat. – Zizouz212 Jan 24 '17 at 22:13
  • 1
    If the middleman publishes the modified fork, how is the fix not shared back? – rackandboneman Dec 14 '17 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.