If someone modifies a program licensed with the AGPL, the modified program is required to give user's its source code if it interacts with them over a network. My question is what constitutes a "user" in this scenario.

  • Would other programs that interact with it constitute users? Would the program have to honor a request for the source code from them?
  • Would the users of other programs that interact with it constitute users? Would the program have to honor a request for the source code from them?
  • What about clients of the users of the program? Would their request for source code need to be honored, since they are indirectly interacting the program through a network?
  • How "users" is defined (which the AGPL does not define) is not so important; read section term 13 of the AGPL: "your modified version must prominently offer all users interacting with it remotely through a computer network..." – Brandin Jan 31 at 7:28

The AGPL does not define the term “user”, but context makes it clear (to me) that this means persons, in particular natural persons that are end users, or other third parties.

As Brandin points out in the comments, the precise definition of users is not that important. The AGPL's requirement to offer the source of a modified version effectively triggers as soon as a user could interact with the software over a network: you have to proactively and prominently offer the source code, not just respond to requests. Even if your AGPL-covered software is intended to be used by other programs, this doesn't prevent end users from interacting with these APIs as well.

What constitutes interacting is left open in the AGPL, because the FSF typically wants to use the strongest interpretation that is available under local law. I think it is safe to assume that interacting with the AGPL-covered software through another program (like a client software or a proxy) is still interaction. The offer of the source code would not have to be made to these client programs, but to the actual user.

On the other hand, the AGPL only covers interaction, not other use. For example, a user who interacts with a web app which in turn uses an AGPL-covered modification of the MongoDB database: does the user now interact with that database, thus triggering source disclosure requirements? No: in the general case, the web app's provider will be the user of the AGPL database. The end user does not meaningfully interact with the database at all. But of course that would depend on the functionality of this web app. For example, if the web app is a database management interface, that would probably not prevent any interaction.

So whether a software between the user and the AGPL-covered program prevents interaction in the sense of the AGPL depends on context. Unless it is plainly obvious that no meaningful interaction takes place, it is of course safer to assume that such interaction is in fact happening, and that you have to offer the source code.

Please also note that the AGPL source offer requirements do not trigger for most uses of AGPL-covered software, because they only trigger if you make a modified version of the software available to third parties. Running an AGPL-covered software by itself triggers no requirements, and neither does purely internal use.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.