Use GPLv3 library in a closed system (no software distribution)

Question

I'm developing a software that will be preinstalled in a headless PC. The user will see the "output" of the software processing (sent with a given protocol via ethernet), and can configure some parameters of the running app via web interface.

The application have some proprietary processing code, uses some third party library (closed, precompiled libraries under BDS license to use third party hardware) and some LGPL libraries linked dinamically. To display/stream the mentioned web interface we would like to use a GPLv3 library.

How will this affect the rest of the software licensing?

I've read several topics on this, and one quite similar here. The main difference in my opinion is the fact that the poster is releasing a virtual machine image, that the user can install and use on his PC, while we are actually giving the user a "black box".

The linked thread mentions the AGPL license, that in our case will probably put all the software under AGPL. But looks like the GPL won't do it, if I got it right. Or better, the GPL says that a software running on a server will not be affected by the license (right?). This seems to be actually the case. But we don't really have a server running the app, say, in our office, and the users are connecting to it; we are actually selling such server, that the users will have on their office (actually on their machinery), although they cannot do anything with it besides access the web interface and collect outputs.

I'll try to give you the big picture with a little simplfied example.

I have an overtechnological thermostat. It's a device that runs Ubuntu Server. My app is running on it. It uses a third part library to access the thermal sensor and gather data. It does it sophisticated calc with my proprietary algorithm and controls the water eater. It displays the outputs and controls on a web interface for the user (no other way to access the system for the user); the interface display/streaming is done using a GPLv3 library. What licensing can be used for my software, in particular my algorithms? And what about third party closed libraries used?

Answer 1

The premiss of your question is faulty, at least so far as the title. You are selling a widget (in this case, a thermostat) which contains the binaries of Ubuntu Server and other pieces of free software, these all being covered by a variety of free licences. This is distribution, plain and simple.

For any software you are distributing, whether yours or someone else's, which is covered by GPLv2, you must provide the source code or access thereto. Your life will be simplest if you give each customer a DVD of all the relevant sources along with their widget, but you are permitted by GPLv2 s3b to provide a written offer, valid for at least three years, to provide the source on request. If you go down this path, and a customer requests it, "Oh come on, you bought this two years ago" is not a sufficient reason not to have all those sources to hand and ready to ship. Much of Ubuntu Server will fall into this category.

For any software covered by GPLv3, you must similarly provide source or (via s6b) a written offer to provide it on demand. In addition, under the anti-Tivoisation provision of s6 you must also provide documentation and any relevant access tokens to permit the customer to install updated versions of any covered software, whether those updates are provided by you or created from the source by the customer.

The additional provisions of the AGPL aren't relevant here because the device doesn't "phone home" - the server code ships on the widget.

As for your application, which links to a GPLv3 library, the question of whether or not your code must also be GPLv3 is unsettled. You can find summaries of both pro and con positions on this site. My personal opinion is that dynamic linking does in nearly all cases create a derivative work, but that opinion is not universally held (and nor is any other on the subject).

Free software licensed on non-copyleft terms often carries labelling or licence-notice requirements, so you will probably need a good few pages of your thermostat manual to print all these.

Proprietary software which ships on the widget and which is "merely aggregated" thereon carries no source distribution obligations. The test for mere aggregation is often felt to be arm's-length execution via userspace. Again, more detail about this can already be found on this site.

Answer 2

Part of the purpose of the GNU GPL (LGPL, 2 and 3) is to ensure that free software remains free. (so anyone who has a copy can run, modify, and share it forever)

One of the conditions of redistributing (for free or money) such software is that you provide the same access to the source code of whatever you're releasing under similar terms. (either the piece you licensed and used in the LGPL case, or the whole thing, in the GPL case)

As you might expect, there's been a lot of attempts to circumvent this intent in the years after.

Like companies that exist to break the GPL's terms and get sued, but give their customers indemnity in their use of such software. (e.g. Novell) Or devices which run free software, but refuse to be modified. (e.g. Android, Amazon Kindle, Tivo) (which is why GPL3 exists)

Or running free software on a server, and charging for access to it. (e.g. Amazon with mongodb) (combated by AGPL. Though, I personally don't think SaSS should be used in most cases.)

What you are describing seems to me like you want to avoid licensing problems by making the "product" a single unit which can't be modified. It does not. If there's GPL software in there, you need to abide by the license. Same as you would if you used any other copywritten material in there.

Answer 3

As MadHatter so expertly explained, the issue of whether or not linking to a GPL library constitutes a derivative work has not been settled. For your purposes, you'll have to assume that it does (just to be safe), and plan your product accordingly.

A common way to deal with situations like this is to split your software up into pieces. One of those pieces will be the GPL library and some non-proprietary parts of your code, just enough to make that piece operate on its own. The proprietary parts of your program would communicate with the "GPL-tainted" parts of your program through some sort of user-space interface. You still have obligations under the GPL to distribute source code, but only for the the code that's included in the module containing the GPL code.

Your question leaves out a lot of details, but it sounds like you may already have a situation like this. You said that your device has a web interface, and that you would like to use a GPL library to "display/stream" that interface. I don't know what exactly you mean by that, but a web interface is generally considered to be a clean breaking point between programs. Since the web interface is usable all by itself, external software that happens to use that interface isn't automatically considered part of the same program. If you're simply trying to make that web interface viewable somewhere else, then you should focus on writing a stand-alone program that uses that GPL library and works on any arbitrary web interface. That would be an independent program, would inherit the GPL, and would require you to provide the source code. All of your proprietary magic is on the other side of that web interface, however, so the GPL wouldn't apply there. You'd have two completely independent programs that are usable on their own, and your device just so happens to use them both together.

The devil's in the details, of course. Considering there's a risk of having to publish what might be considered trade secrets, you really should run everything past a legal professional who knows the details of your product and its architecture.

Answer 4

I just wanted to point out that you shouldn't needlessly distribute DVDs when the vast majority of people will never look at the source, and a large portion don't even have a DVD drive.

To summarize the rest of your question:

• Modifications to a GPLv3 licensed source code must be released under GPLv3. If you didn't modify the library you do not have to license your code under GPLv3.

• The source code must be public whenever it is distributed. You are distributing the GPLv3 code , so you need to make it public--be it by a web link or including the source.

A derivative work is one that includes aspects of the original. Libraries are software packages utilized by calling their public interfaces. Using a library for its intended purpose without modification is not derivation. That would be like saying a song is a derivative of the instruments.

(I would have replied with this post but you need 50 karma before you can comment)

Here is an article by Lawrence Rosen about what derivative software is.

The meaning of derivative work will not be broadened to include software created by linking to library programs that were designed and intended to be used as library programs. When a company releases a scientific subroutine library, or a library of objects, for example, people who merely use the library, unmodified, perhaps without even looking at the source code, are not thereby creating derivative works of the library.

He even goes on to paraphrase the idea that "linking a library creates a derivative work" is as if "merely touching [...] open source software will infect their software with a virus."

Answer 5

I have an overtechnological thermostat. It's a device that runs Ubuntu Server. My app is running on it. It uses a third part library to access the thermal sensor and gather data [...]; the interface display/streaming is done using a GPLv3 library.

Essentially, you are distributing 3 separate objects: the Linux OS, the third-party libraries and your software. Thus, you need to provide the source code for the OS and the GPLv3 library, and maybe the "third party" library (it its license requires it) solely because you're distributing these.

The remaining question is about the status of your app. From your description I understand that it uses a GPLv3 streaming library, so you need to release your software as GPLv3 too.

If you can avoid using GPL libraries in your app and stick to e.g. LGPL libs, you will be able to forego disclosing your app's sources. Linux has no requirement to apply GPL license to software that runs on in, even if it links to essential system libs like libc, due to linking exceptions. Here's the relevant exception license if you use gcc, other compilers have similar provisions.