28

Here's a tricky situation that I didn't encounter before:

  • My company embeds a piece of slightly modified GPLv3 code into their otherwise proprietary application. They don't link a library or anything, they just compile the GPLv3 code straight into theirs.

  • They do not include a copy of the GPLv3 license text in the final package

  • They then sell that application, in both binary form AND with the original source code, to their customer. Those two parties are, by contract, the only ones who are allowed to see the code+binary; it is not for the world to see.

Questions:

  • Is this legal?

  • Does distributing the source code like this count as "open source" in the eyes of GPLv3?

  • Would it be better if they link to a library made out of the GPL code instead of embedding it like this?

Improve this question
8
  • 1
    "Those two parties are, by contract, the only ones who are allowed to see the code+binary; it is not for the world to see." That doesn't matter. In order to compare code, you do not need to see it, you can just compare hash values. There are services that do this. The recipient of the code will most likely discover that your company violated GPL. Ask yourself? Is that good or bad? Will they sue your company for breach of contract? or not care at all? And is this the only customer you're going to give the code to?
    – Stephan Branczyk
    Jul 8, 2018 at 6:04
  • 1
    @MartinSchröder they don't include the license, at all. Instead replacing it with their own overarching license in both parties' contracts
    – Rody Oldenhuis
    Jul 9, 2018 at 22:12
  • 1
    @RodyOldenhuis I'm asking about the copyright notice. Do they claim the code is theirs?
    – Martin Schröder
    Jul 9, 2018 at 22:15
  • 1
    @MartinSchröder yes they do
    – Rody Oldenhuis
    Jul 9, 2018 at 22:15
  • 2
    @RodyOldenhuis IMHO that is theft, plain and simple. Any IP lawyer will have a field day. The FSFE will love a whistleblower about this.
    – Martin Schröder
    Jul 9, 2018 at 22:18

7 Answers 7

Reset to default
36

When your code contains (or links to) GPL licensed code, then the GPL license requires that you distribute your application under the GPL license.

The GPL does not require that you distribute your application to the general public. It is entirely legal to sell the application to select customers only, and you only have to distribute your source code only to those parties that have received the binaries.

To answer your questions:

Is this legal

Assuming that your company did not receive a more permissive license on the code that you believe to be under the GPL, then it is not legal to offer that code and the rest of your application under a different license than the GPLv3.
It is allowed to offer the application only to select customers, but they must get the freedom to make changes and to distribute the code further. The GPL also doesn't allow you to restrict those permissions through, for example, a separate contract. If you try to do that, then you don't have a license to use/distribute the third-party GPL code.

Does distributing the source code like this count as "open source" in the eyes of GPLv3?

No. the term "open source" does in this context not refer to the availability of source code, but to the rights that you get. In particular the right to make modifications and to redistribute the code.

Would it be better if they link to a library made out of the GPL code instead of embedding it like this?

For the GPL license, this makes no difference. If the code had been under the LGPL license, then it would have made a difference.

Improve this answer
9
  • 1
    Just what I was thinking of saying - +1 from me! I would be more explicit about the contractual prohibition on redistribution being explicitly not permitted by the GPL, though.
    – MadHatter ♦
    Jul 7, 2018 at 6:44
  • 6
    @RodyOldenhuis: The authors of the third-party GPL code have their full rights (and the right to file a lawsuit against your company for violating their copyrights). The authors at your company probably don't have any rights as they don't hold the copyright on what they created.
    – Bart van Ingen Schenau
    Jul 7, 2018 at 8:19
  • 13
    Do note though that this Those two parties are, by contract, the only ones who are allowed to see the code+binary; it is not for the world to see is illegal. The GPL license allows the two parties to distribute the source code to other people. According to GPL you cannot compel the client to not redistribute but according to common law you can surrender you own rights for a fee so you can agree yourself to never share the code.
    – slebetman
    Jul 7, 2018 at 9:47
  • 1
    @Maxpm For "The GPL does not require that you distribute your application" there is no section to quote, since it's simply the case that the GPL never requires this. For "The GPL also doesn't allow you to restrict those permissions" that's the last paragraph of Section 10 in GPLv3.
    – apsillers ♦
    Jul 8, 2018 at 3:42
  • 4
    @JoseAntonioDuraOlmos International copyright is remarkably synchronized through the Berne Convention, TRIPS, and the WTO. Nearly all countries are signatories to one or more of such treaties, notably absent is Iran. The GPLv3 is carefully written to not be jurisdiction-dependent but simply follows from copyright. It is therefore not very useful to enumerate the few special cases where the GPL would not apply.
    – amon
    Jul 8, 2018 at 8:45
13

If you distribute your propriatiery code combined with GPL licensed code without following the GPL rules, then you commit copyright infringement, and the copyright holder or copyright holders of the GPL licensed code can sue you for damages, and can make you stop distributing your software.

Your contract that the receiving company cannot see or distribute the GPL licensed portions of your software is probably another bit of copyright infringement. You claim to have the legal right to prevent them from seeing or copying that software, when the copyright holder actually allows it.

PS. No, nobody can force you to distribute source code. They can just give you the choice between the full force of the law for a blatant case of copyright infringement, and distributing the source code.

Improve this answer
7

When someone fails to meet the conditions of a license, it voids the license. Without a license, copying, distributing, creating derivative works, etc., is committing copyright infringement. The owner of the copyright can then bring an action in court against the infringer. If found liable, the infringer will be forced to pay monetary damages and may be enjoined against further infringement, but won't be forced to comply with the license terms.

Improve this answer
1
  • I wonder how damages are calculated with open source projects. Another complication is that the owner of the copyright would have to know of the copyright infringement before. If the number of recipients of the software is small and only a binary is distributed then it's probably very hard for the original copyright holder to ever know of it. Doesn't make your points invalid, just shows how difficult this can get.
    – NoDataDumpNoContribution
    Jul 9, 2018 at 12:22
5

The permissions of the GPL are granted when you meet the licensing requirements that require that you license the resulting work as a whole under the terms of the GPL and make the customer aware of his rights under these terms.

You are not in compliance with the conditions of the GPL, so the copyright holder of the GPLed software, should he get wind of this situation, can barr you from any further distribution and may require that you disable/withdraw all distributed copies. You will also be liable for damages but those are hard to specify for Free Software. However, statutory damages may apply.

How might the original copyright holder get wind of this situation? Someone among your customers might notice the GPLed software contained and might decide that they'd very much like to just install multiple copies and/or modified copies and/or further distribute stuff.

Basically, this is a problem waiting to happen.

Improve this answer
2

Would it be better if they link to a library made out of the GPL code instead of embedding it like this?

As mentioned in other answers, for GPL license just linking is not enough.

However, it is often possible to include the GPL code in an entirely separate program (separate .exe file), which is fully GPL licensed. Your proprietary program can then call that program, and give it e.g. input files and read the output data.

This is quite commonly done by development environments that include the GCC compiler combined with a custom GUI.

Improve this answer
3
  • This is not true. Additionally, it matters not what compiler is used, as GCC's license has does not cover the code you compile with it. gnu.org/licenses/gpl-faq.en.html#CanIUseGPLToolsForNF
    – whatsisname
    Jul 9, 2018 at 20:09
  • @whatsisname I added the link to the same FAQ, which includes the "If the two programs remain well separated ...". As for the GCC/IDE part, I meant a situation where the GCC compiler is distributed with a proprietary IDE.
    – jpa
    Jul 10, 2018 at 5:43
  • Ah, now I see the other question (opensource.stackexchange.com/questions/7078/… ) which explains all this in better detail. Indeed, one has to be careful to maintain the separation.
    – jpa
    Jul 10, 2018 at 5:45
1

Those two parties are, by contract, the only ones who are allowed to see the code+binary; it is not for the world to see.

Is this legal?

This part of your contract is likely legally void. E.g. if you customer distributes the binary and later gets accused of a GPL violation, they will most probably have to distribute the source code as well, and your contract will not prevent them from doing so.

IANAL, of course.

Improve this answer
2
  • Void, unlikely. Doomed on attempt to enforce, probably.
    – Joshua
    Jul 7, 2018 at 14:38
  • 1
    The GPLv3 is a copyright license, not a contract. It doesn't force any behavior. What happens if you violate it is that you don't have a valid license, and are guilty of copyright infringement. There is a clause in GPLv3, Section 8 about getting the license back if you come into conformance, and historically people violating a GPL have been allowed to come into conformance, so that's always an option. It isn't a legal requirement. You can always accept a cease-and-desist, stopping distribution and notifying clients that they do not have legal copies of the software, and paying damages.
    – David Thornley
    Jul 9, 2018 at 17:07
0

I think if you want to include your code with the free software, It may be a better idea to simply instruct your customer on how to modify it themselves making it clear that you bare no responsibility for the legal outcome. That gives them a more personal connection to the action, making them more in tune with weather they should share it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.