5

I'm considering integrating iText into an internal-use web application.

According to the AGPLv3 license, I have most certainly modified "the Program".

However, this application cannot be accessed outside of the company office. It is only available to employee workstations that are connected to the office LAN and it is most definitely not for sale and for employees only.

Even though this application is available for use over a network as a service, according to the GPL FAQ it is not considered distribution.

Given what I know it seems that I am in the clear, but I want to be absolutely sure that I will not get into legal hot water.

EDIT:

If I am in the clear for that scenario, what if my application reads files in a directory that is used by a public-facing FTP server where third parties can submit files to my company?

Am I still in the clear?

|improve this question
  • 2
    You primary question is an interesting legal nuance: I would naively expect that the "company is only exposing the software to itself" holds analogously to how company-internal distribution works, but copyright law has lots of statutes and case law about what does and does not constitute distribution, whereas it's a less-thoroughly explored question whether an individual employee using a company service is a "user" in the sense that AGPL §13 uses the term, or if the company itself is the only "user". – apsillers♦ Mar 8 '18 at 16:35
2

If you only internally use the library meaning only people within your corporation are (indirectly) using it, you do not have to distribute the source (even not your employees), because you are not redistributing (selling or giving away a software product that includes the library) outside of your organization.

But please note that when using the library as part of an network-accessible service: AGPL != GPL. This is one of the differences between AGPL and GPL. So if external users have the possibility to access the service you have to supply the source and obey all other license requirements.

To your edit: That depends - your service may read any other publicly available file in the internet, no problem. If you do not expose your service to the public you are fine.

Basically you have to ask yourself:

Is there a chance that one of your (*Text) generated PDFs (and this is visible in the META information of each generated / edited PDF) is floating around outside your company?

Update: As correctly indicated by amon the output itself does not fall under AGPL since there is no source contained. So it is basically all about the reachability of your service.

|improve this answer
  • 2
    The AGPL does not impose any restrictions on input/output data, like the generated PDFs in this case. The question is merely whether that FTP server would constitute a “remote network interaction” between the AGPL-derived software and end users. I don't think so. – amon Aug 13 '18 at 14:50
  • @amon That indead is an interesting question and I researched it and discussed it internally. And you are right. Altough this is not a general answer like for instance certain outputs like bison savannah.gnu.org/projects/bison or the GCC contains parts of the sourcecode which would then fall under (A)GPL (if there wouldn't be a special exception for that case) – Lonzak Aug 14 '18 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.