6

I'm considering integrating iText into an internal-use web application.

According to the AGPLv3 license, I have most certainly modified "the Program".

However, this application cannot be accessed outside of the company office. It is only available to employee workstations that are connected to the office LAN and it is most definitely not for sale and for employees only.

Even though this application is available for use over a network as a service, according to the GPL FAQ it is not considered distribution.

Given what I know it seems that I am in the clear, but I want to be absolutely sure that I will not get into legal hot water.

EDIT:

If I am in the clear for that scenario, what if my application reads files in a directory that is used by a public-facing FTP server where third parties can submit files to my company?

Am I still in the clear?

Improve this question
1
  • 2
    You primary question is an interesting legal nuance: I would naively expect that the "company is only exposing the software to itself" holds analogously to how company-internal distribution works, but copyright law has lots of statutes and case law about what does and does not constitute distribution, whereas it's a less-thoroughly explored question whether an individual employee using a company service is a "user" in the sense that AGPL §13 uses the term, or if the company itself is the only "user".
    – apsillers ♦
    Mar 8 '18 at 16:35
3

If you only internally use the library meaning only people within your corporation are (indirectly) using it, you do not have to distribute the source (even not your employees), because you are not redistributing (selling or giving away a software product that includes the library) outside of your organization.

But please note that when using the library as part of an network-accessible service: AGPL != GPL. This is one of the differences between AGPL and GPL. So if external users have the possibility to access the service you have to supply the source and obey all other license requirements.

To your edit: That depends - your service may read any other publicly available file in the internet, no problem. If you do not expose your service to the public you are fine.

Basically you have to ask yourself:

Is there a chance that one of your (*Text) generated PDFs (and this is visible in the META information of each generated / edited PDF) is floating around outside your company?

Update: As correctly indicated by amon the output itself does not fall under AGPL since there is no source contained. So it is basically all about the reachability of your service.

Improve this answer
2
  • 2
    The AGPL does not impose any restrictions on input/output data, like the generated PDFs in this case. The question is merely whether that FTP server would constitute a “remote network interaction” between the AGPL-derived software and end users. I don't think so.
    – amon
    Aug 13 '18 at 14:50
  • @amon That indead is an interesting question and I researched it and discussed it internally. And you are right. Altough this is not a general answer like for instance certain outputs like bison savannah.gnu.org/projects/bison or the GCC contains parts of the sourcecode which would then fall under (A)GPL (if there wouldn't be a special exception for that case)
    – Lonzak
    Aug 14 '18 at 11:00
2

I'm afraid I can't agree with the other answer to this question. The normal GPL-style obligations in the AGPL (ss4-6) are engaged by the conveyance of the software (all three sections read "You may convey... provided that..."). Both GPL and AGPL define (in s0) "conveying" as "any kind of propagation that enables other parties to make or receive copies", and "propagation" as including "distribution (with or without modification)".

Distributing copies within a corporation is therefore propagation, but doesn't constitute conveying and thus doesn't engage ss4-6, because the copies remain within a single legal entity (the corporation), and thus no other parties are involved. The GPL FAQ is clear on the subject, when it says:

Is making and using multiple copies within one organization or company “distribution”?

No, in that case the organization is just making the copies for itself.

This isn't any kind of "exemption" for internal use, it's simply an observation that because there's only one party involved (the company), no conveying has occurred, and thus ss4-6 are not engaged.

The language of AGPL s13 is very different. It says nothing about conveying; its requirements are engaged by the acceptance of an offer of interaction with a modified version over a computer network:

if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network ... an opportunity to receive the Corresponding Source of your version

This is unaffected by any limitations arising from the definition of conveying. The GPL FAQ also makes no mention of them, when it says:

A company is running a modified version of a program licensed under the GNU Affero GPL (AGPL) on a web site. Does the AGPL say they must release their modified sources?

The GNU Affero GPL requires that modified versions of the software offer all users interacting with it over a computer network an opportunity to receive the source. What the company is doing falls under that meaning

There is no similar language there "exempting" internal usage, or restricting its analysis to websites that are publicly-accessible. By your own admission, you are offering users interaction with "a modified version of a program licensed under the GNU Affero GPL on a web site". I see no reason to think that they cannot benefit from AGPL s13 simply because you work for the same company.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.