7

A client has sent me GPL'ed code to work on for them.

This code has not been publicly released, so there is no way for me to obtain it - other than directly from this client.

Is this considered distributing/conveying the work to me? i.e. do I automatically obtain a license to use the code myself?

  • 1
    Which version of the GPL? The GPLv3 seems to explicitly cover this case: no, this probably doesn't count as conveying, and is the same as in-house development. – amon Jun 2 '17 at 9:01
  • @amon GPLv3 in this case, but it happens a bit with GPLv2 code as well so I'd be interested in an answer for both. What part of v3 deals with this? I couldn't find it... – Tim Malone Jun 2 '17 at 21:24
  • @TimMalone "This code has not been publicly released" Then what does it mean it's GPL'ed? You don't get any licenses automatically, if it's their code they have to tell you what you can and cannot do with the code. – Goyo Jun 4 '17 at 16:49
  • @Goyo The code is licensed under GPL (original code was, client's copy has been modified therefore inheriting the original license), but they haven't distributed it publicly yet. My question is simply asking, by sending it to me are they 'distributing'/'conveying' it, thereby giving me a license? – Tim Malone Jun 4 '17 at 20:40
  • 2
    @TimMalone My guess is that it depends on whether what you are doing qualifies as work for hire. In this case I don't think they are distributing their changes to you, just as you won't be distributing your changes to them, all the code is theirs and it's not being distributed, just as if it were in-house development. It's not so much about what the license says but about what the copyright law says. I won't write an answer because I am not really sure. – Goyo Jun 4 '17 at 22:29
5

GPLv3

For the GPLv3, no, you do not have the right to distribute the work.

The GPLv3 allows the distribution of a GPL work without the normal full freedoms, in the narrow case that the distribution is done explicitly for the recipient to make modifications. The exact language is in section 2, which applies to contractors who modify the software and to remote execution environments (e.g., "cloud" providers like Amazon Web Services do not get GPL rights when you give them a copy of GPLv3 software to run):

You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.

The rationale for this change was addressed in the release notes for the GPLv3 final discussion draft:

4 Conveying to Outside Contractors

Large enterprise users of free software often contract with non-employee developers, often working offsite, to make modifications intended for the user’s private or internal use, and often arrange with other companies to operate their data centers. Whether GPLv2 permits these activities is not clear and may depend on variations in copyright law. The practices seem basically harmless, so we have decided to make it clear they are permitted.

GPLv3 now gives an explicit permission for a client to provide a copy of its modified software to a contractor exclusively for that contractor to modify it further, or run it, on behalf of the client. However, the client can only exercise this control over its own copyrighted changes to the GPL-covered program. The parts of the program it obtained from other contributors must be provided to the contractor with the usual GPL freedoms.

This permission is stated in section 2. It permits a user to convey covered works to contractors operating exclusively on the user’s behalf, under the user’s direction and control, and to require the contractors to keep the user’s copyrighted changes confidential, but only if the contractor is limited to acting on the user’s behalf, just as the user’s employees would have to act.

The strict conditions in this provision are needed so that it cannot be twisted to fit other activities, such as making a program available to users or customers. By making the limits on this provision very narrow, we ensure that in all other cases the contractor gets the full freedoms of the GPL.

GPLv2

As the above release note indicates, the situation is complex for GPLv2. The situation as it exists outside the GPLv3's special excpetion is addressed in the GPL FAQ (take note of both paragraphs):

Is making and using multiple copies within one organization or company "distribution"?

No, in that case the organization is just making the copies for itself. As a consequence, a company or other organization can develop a modified version and install that version through its own facilities, without giving the staff permission to release that modified version to outsiders.

However, when the organization transfers copies to other organizations or individuals, that is distribution. In particular, providing copies to contractors for use off-site is distribution.

If this client is distributing someone else's GPL-licensed work (or a derivative) they are only permitted to do so under the GPL. Does your case qualify as distribution? This FAQ item certainly presents the unambiguous opinion that off-site distribution to a contractor (or any non-employee) constitutes distribution. This basically reduces to the question of "Are you an employee or a contractor?" If you're an employee, you are an agent of the company, so the code isn't moving outside the company's possession. If you're a contractor, then your receipt of the code is external to the perimeter of the company, and it is distribution.

In case you're not convinced, this case is very unambiguously covered in another FAQ item (note the final paragraph, which I have emphasized):

Does the GPL allow me to develop a modified version under a nondisclosure agreement?

Yes. For instance, you can accept a contract to develop changes and agree not to release your changes until the client says ok. This is permitted because in this case no GPL-covered code is being distributed under an NDA.

You can also release your changes to the client under the GPL, but agree not to release them to anyone else unless the client says ok. In this case, too, no GPL-covered code is being distributed under an NDA, or under any additional restrictions.

The GPL would give the client the right to redistribute your version. In this scenario, the client will probably choose not to exercise that right, but does have the right.

So, your client can place a restriction in your contract about when you may (or may not) release your own changes, but they cannot legally tell you when you may or may not release their code that they distributed to you under the GPL.

Of course, even if there is no legal impediment to distributing your client's code without their say-so, that sounds like a very efficient way to demolish your trustworthiness as a contractor. They can't sue you, but they are free to hire someone else for future work.

  • I understand the quotations very differently. RE “within one organization”: If a contractor makes changes on behalf of a client, is the contractor part of the client's organization for the purpose of the GPL? I'd think yes, you say no. RE “in this case no GPL-covered code is being distributed under an NDA”: This sentence is true if the code isn't subject to GPL, isn't being distributed, or if no NDA is involved. Since this is explicitly about GPL and NDAs, I conclude such a relationship does not imply distribution of the code because the client holds the right over all changes. – amon Jun 5 '17 at 16:14
  • @amon "is the contractor part of the client's organization for the purpose of the GPL?" Whether transferring a copy to a contractor counts a distribution is a question for a jurisdiction's understanding of distribution under copyright law. I'm just relaying the FSF's opinion that transfer to a contractor does count as distribution, though I would entertain the idea that in some jurisdictions, possibly the intent of the transfer (to use the software versus modify it) could change the answer. – apsillers Jun 5 '17 at 17:21
  • 1
    @amon re: NDAs, if the client says, "Don't share the code you write for me yet," that doesn't apply any restrictions to GPL-covered code, since your new changes are not yet under the GPL. I assume there are no NDAs involved on GPL-covered code here. If there is an NDA involved that imposes restrictions on the original software beyond the terms of the GPL, then the client is committing a GPL violation. I could expand the answer to address that case, if you think it's necessary to fully address the question. Or have I slightly missed your point about NDAs? – apsillers Jun 5 '17 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.