AGPL and sandboxed user code

Question

I'm developing a web application that allows users to program single-file scripts. These scripts are sandboxed and executed in the same application.

I'd like to release the source of my application under the AGPL. Would my users need to release their code under the AGPL as well? If so, how do I enforce this? Is a checkbox labeled "I hereby release this code under the AGPL" on the code submission page sufficient?

Answer 1

I think you may need to treat these user-supplied contributions more or less as if you were hosting your code on a public repository and these users were contributors. However, this is not to say that these contributions must be part of the AGPL work, however.

It seems like these user contributions are basically plugins to your application. The FSF offers some guidance about how to decide when a plugin is or is not part of its parent program:

When are a program and its plug-ins considered a single combined program?

It depends on how the main program invokes its plug-ins. If the main program uses fork and exec to invoke plug-ins, and they establish intimate communication by sharing complex data structures, or shipping complex data structures back and forth, that can make them one single combined program. A main program that uses simple fork and exec to invoke plug-ins and does not establish intimate communication between them results in the plug-ins being a separate program.

If the main program dynamically links plug-ins, and they make function calls to each other and share data structures, we believe they form a single combined program, which must be treated as an extension of both the main program and the plug-ins. If the main program dynamically links plug-ins, but the communication between them is limited to invoking the ‘main’ function of the plug-in with some options and waiting for it to return, that is a borderline case.

Using shared memory to communicate with complex data structures is pretty much equivalent to dynamic linking.

From here, there are two possibilities:

• If the relationship between your program and user-supplied plugins falls into one of the "separate programs" cases, the licensing of user submissions is unrelated to the licensing of your main program. You should make your users understand and agree to how their submissions will be used and made available to other users (just as you might in the terms of service of any web service), but compatibility with the AGPL is not a concern. The plugins are not part of the AGPL work.

• If the relationship between your main program and user-supplied plugins falls into a "combined" case, then you are effectively allowing users to modify the code of your web service. The AGPL requires that you supply all users with the current source code of your service, including the modifications and additions that you allow users to make via their submissions.

  Users must license their submissions to you under an AGPL-compatible license (AGPL, or a permissive license like MIT, or, in this case, optionally the GPL). You really just need to notify users that their submission will be licensed to you in a particular way. As a case study in this practice, scroll to the bottom of this web page and see that the text of your question on this web site has been licensed under CC BY-SA 3.0. You should mention it in your terms of service at minimum, and have users agree to it when they sign up or when they make a submission.