3

I am working on a project to generate a 508 compliant annual PDF Publication from our database using iText 7 java library. This library works great for accessible PDFs. We are in the process of procurement to get a commercial license to use for our future applications.

Issue:

For this particular application however, we are planning to create an executable java jar file that will run once a year in a server that can connect to our databases. It will sit in the backend and we will run the application manually or using a cronjob (java -jar application). Since this publication has to come out by the end of September and since procurement process takes around 4 to 6 months, we are planning to make this application open sourced. The resulting PDF however will be put as a download in our closed application manually. I read through many websites about the extent of using AGPL V3 license but was still unclear. I also saw this:

There were so many mixed answers out there and also our scenario is bit different. So here are my questions:

  1. In our scenario, do we need to make the source code open?
  2. If yes to question 1, are we allowed to use iText 7 as an open source alternative in this particular scenario?
  3. If yes to question 2, what portion of the source code needs to be open? Since we host the file (even though manually added) in a separate public but closed application, do we need to make the source code of this application also open?

Update: To clarify things a bit, for our current application, we are using the community version of iText 7 and are in no way modifying the source code.

It would be nice if we could hear back from the author himself. (@BrunoLowagie; @bruno-lowagie)

Improve this question
6
  • 1
    Did you read section 13 of the AGPL: "if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network..." So first you should ask yourself, "did I modify the AGPL program?" and then you should ask "am I offering users a chance to interact with this program remotely?" Offering a PDF is not offering a chance for people to interact with the Program remotely. By analogy, a professional artist who uses Photoshop to produce and distribute an image is not offering people a chance to interact with Photoshop remotely.
    – Brandin
    Commented Sep 5, 2018 at 5:29
  • @Brandin please see my update above.
    – comwiz756
    Commented Sep 5, 2018 at 13:51
  • See also: Is the output of an open source program licensed the same? It sounds like you are partly confusing the output (the generated PDFs from an application) with the application itself. If you use a GPL or AGPL library to create an application that generates PDFs, you need to make that application open source to the people you give the application to. AGPL also req
    – Brandin
    Commented Sep 6, 2018 at 4:57
  • AGPL also requires that if you let people access the application remotely through a computer network, that you also give those people who have access to it remotely the source code of your application.
    – Brandin
    Commented Sep 6, 2018 at 5:03
  • @Brandin users don't interact with the application in this case. But they do get to download the PDF.
    – comwiz756
    Commented Sep 6, 2018 at 14:20

1 Answer 1

Reset to default
4

The key question with regards to your use of iText is who can use the application to generate the report.

If only employees of your company have access to the application (either by installing it on their machine or accessing it remotely), then you are not required to make the application open source. Giving employees access to (install) an application as part of the work they do is not considered distribution under copyright law, not even for the AGPL.

If (employees of) customers can remotely use the application, then the AGPL requires that you make the sources of the application available to those customers under the terms of the AGPL.

If the general public can remotely use the application, then the AGPL requires that you make the sources of the application available to the general public under the terms of the AGPL.

Improve this answer
6
  • While I broadly agree with this, I wonder if the OP's situation is more nuanced than these cases. In the OP's case, it sounds like only employees can run the program to generate PDFs, but they are generated from a database of user-supplied information. While the annual batch-generation of a report doesn't seem like "interaction", what if it ran every day, or in the extreme, every minute? I think there is probably an unsolved legal nuance about what constitutes interaction. (To be clear, I don't think an annual batch job would count, but the spectrum of time is interesting to consider.)
    – apsillers ♦
    Commented Sep 5, 2018 at 17:36
  • @apsillers, I think that depends on who would get the PDF. If it goes to the client that submitted the data, you have a point. If it goes to a third party, like the IRS, then I don't agree.
    – Bart van Ingen Schenau
    Commented Sep 5, 2018 at 20:05
  • @BartvanIngenSchenau It doesn't matter who gets the PDF. The PDF is output from the program; if I generate PDFs from an (A)GPL application and then host those PDFs on a closed-source server software, does that somehow mandate the server software need to be open source? No.
    – Brandin
    Commented Sep 6, 2018 at 5:06
  • @Brandin: If you submit data to a server and receive some time later a PDF from that server, then that can be seen as remotely interacting with the application that creates the PDF. If that application uses AGPL licensed components, then the application would need to be open source. So, it is not the delivery of the PDF itself that would trigger the AGPL requirements, but rather the round-trip nature of the interaction.
    – Bart van Ingen Schenau
    Commented Sep 6, 2018 at 6:12
  • @BartvanIngenSchenau what if data is added by the employees in the database (not consumer related but business related) but PDF is hosted for anyone to download online?
    – comwiz756
    Commented Sep 6, 2018 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.