14

I'm developing a software that will be preinstalled in a headless PC. The user will see the "output" of the software processing (sent with a given protocol via ethernet), and can configure some parameters of the running app via web interface.

The application have some proprietary processing code, uses some third party library (closed, precompiled libraries under BDS license to use third party hardware) and some LGPL libraries linked dinamically. To display/stream the mentioned web interface we would like to use a GPLv3 library.

How will this affect the rest of the software licensing?

I've read several topics on this, and one quite similar here. The main difference in my opinion is the fact that the poster is releasing a virtual machine image, that the user can install and use on his PC, while we are actually giving the user a "black box".

The linked thread mentions the AGPL license, that in our case will probably put all the software under AGPL. But looks like the GPL won't do it, if I got it right. Or better, the GPL says that a software running on a server will not be affected by the license (right?). This seems to be actually the case. But we don't really have a server running the app, say, in our office, and the users are connecting to it; we are actually selling such server, that the users will have on their office (actually on their machinery), although they cannot do anything with it besides access the web interface and collect outputs.

I'll try to give you the big picture with a little simplfied example.

I have an overtechnological thermostat. It's a device that runs Ubuntu Server. My app is running on it. It uses a third part library to access the thermal sensor and gather data. It does it sophisticated calc with my proprietary algorithm and controls the water eater. It displays the outputs and controls on a web interface for the user (no other way to access the system for the user); the interface display/streaming is done using a GPLv3 library. What licensing can be used for my software, in particular my algorithms? And what about third party closed libraries used?

  • Which GPL version? GPL 2 and GPL 3 will differ in what is required in this situation. – Brandin Oct 11 at 8:52
  • By the way the other QA that you linked to is about distributing only the "output". However in your case it sounds like you are distributing a device and on that device you have included GPL software. So you still need to read the respective GPL version and see what is required of you in that situation. Normally you would at least need to provide your customer with at least a written offer to obtain the source code of all (L)GPL components on that device, but the details depend on which GPL version(s). – Brandin Oct 11 at 8:54
  • GPLv3 (edited question). "provide your customer with at least a written offer to obtain the source code of all (L)GPL components"; since there is a GPL "component" in the software, won't all other components will be licensed under GPL, too? So I actually have to provide the full source code – il_mix Oct 11 at 9:02
  • 4
    There is one key piece of information missing. Do you intend to sell this PC and/or the software, or otherwise give it to anyone else? If this is merely for in-house use within your company, you are perfectly entitled to do anything you like with GPL code, because you are not distributing the software. It's only when you distribute software based on GPL'd code that your software also needs to comply with the GPL. – Graham Oct 11 at 21:29
  • 3
    @il_mix in that case you are distributing and therefore have to distribute the source as well. This is exactly the same as say a wifi router with linux. Depending on how you are linking the library you may or may not have to ship that proprietary source as well. If you don't want to do that you cannot link it in that way and cannot use the GPL'ed code. Sadly, I don't know the specifics regarding packaging/linking but I do know that since GPLv3 even companies like Apple can no longer bundle stand-alone GPL'ed software in their closed-source systems anymore. – John Keates Oct 13 at 3:06
29

The premiss of your question is faulty, at least so far as the title. You are selling a widget (in this case, a thermostat) which contains the binaries of Ubuntu Server and other pieces of free software, these all being covered by a variety of free licences. This is distribution, plain and simple.

For any software you are distributing, whether yours or someone else's, which is covered by GPLv2, you must provide the source code or access thereto. Your life will be simplest if you give each customer a DVD of all the relevant sources along with their widget, but you are permitted by GPLv2 s3b to provide a written offer, valid for at least three years, to provide the source on request. If you go down this path, and a customer requests it, "Oh come on, you bought this two years ago" is not a sufficient reason not to have all those sources to hand and ready to ship. Much of Ubuntu Server will fall into this category.

For any software covered by GPLv3, you must similarly provide source or (via s6b) a written offer to provide it on demand. In addition, under the anti-Tivoisation provision of s6 you must also provide documentation and any relevant access tokens to permit the customer to install updated versions of any covered software, whether those updates are provided by you or created from the source by the customer.

The additional provisions of the AGPL aren't relevant here because the device doesn't "phone home" - the server code ships on the widget.

As for your application, which links to a GPLv3 library, the question of whether or not your code must also be GPLv3 is unsettled. You can find summaries of both pro and con positions on this site. My personal opinion is that dynamic linking does in nearly all cases create a derivative work, but that opinion is not universally held (and nor is any other on the subject).

Free software licensed on non-copyleft terms often carries labelling or licence-notice requirements, so you will probably need a good few pages of your thermostat manual to print all these.

Proprietary software which ships on the widget and which is "merely aggregated" thereon carries no source distribution obligations. The test for mere aggregation is often felt to be arm's-length execution via userspace. Again, more detail about this can already be found on this site.

  • Re-citing Lawrence Rosen from pro/con links: "a new program is a derivative work if whether the source code of the original program was used, modified, translated or otherwise changed in any way to create the new program". One can say that a derivative work is something that uses the source code itself directly. Is using the (precompiled) library still considered using the source code? I suppose so. So if a program that uses a GPL library to do something, or calls an external GPL program (via socket, shm, ...) becomes a derivative work. Thoughts? – il_mix Oct 11 at 14:26
  • 8
    My principal thought is that we've already had the discussion here on OS.SE, and the results are in those two questions I linked; I don't see we'll gain anything by having the discussion again here. It's your product and your company. You should go with the option that you judge best - and you should probably take professional legal advice before you do so! – MadHatter supports Monica Oct 11 at 14:33
  • You're right. The problem is that both "discussion results" seems perfectly resonable... I tried opening the discussion again to have opinions on the precise case study. Anyway, probably a professional legal advice will be the best solution, as you suggested. – il_mix Oct 11 at 15:03
  • 1
    @il_mix Other than a few narrow exceptions created by statute, to be a derivative work, a work must contain some new protectable expression. An automated process can't create protectable expression because it's not a creative process. A derivative work is a new work that contains protectable expression from other works. Automated processes (other than those few exceptions specifically created by statute) can't create new works. – David Schwartz Oct 11 at 17:45
  • 2
    Re library linkage, it would be useful to note that the LGPL is intended to answer precisely this point. Static linkage with LGPL code explicitly requires your code to also be released under (at least) the LGPL; whereas dynamic linkage with LGPL code explicitly allows your code to remain closed-source. As you say, the regular GPL is intended to require linking code to also be GPL'd. – Graham Oct 11 at 21:33
1

Part of the purpose of the GNU GPL (LGPL, 2 and 3) is to ensure that free software remains free. (so anyone who has a copy can run, modify, and share it forever)

One of the conditions of redistributing (for free or money) such software is that you provide the same access to the source code of whatever you're releasing under similar terms. (either the piece you licensed and used in the LGPL case, or the whole thing, in the GPL case)

As you might expect, there's been a lot of attempts to circumvent this intent in the years after.

Like companies that exist to break the GPL's terms and get sued, but give their customers indemnity in their use of such software. (e.g. Novell) Or devices which run free software, but refuse to be modified. (e.g. Android, Amazon Kindle, Tivo) (which is why GPL3 exists)

Or running free software on a server, and charging for access to it. (e.g. Amazon with mongodb) (combated by AGPL. Though, I personally don't think SaSS should be used in most cases.)

What you are describing seems to me like you want to avoid licensing problems by making the "product" a single unit which can't be modified. It does not. If there's GPL software in there, you need to abide by the license. Same as you would if you used any other copywritten material in there.

  • 2
    Is not that I want to cheat the license, I just want to better understand how things interacts (on the other hand, I admit that I'll be glad if I can use the mentioned third party library without "legal issues"). Anyway, why are the mentioned companies/projects "getting away" with licensing infringment? Isn't it due to the fact that some concepts/terminology ("aggregation", "derivative", ...) are not good definitions in legal terms, so prone to loopholes? Again, not asking how to cheat for my project; a 5 employees company has a legal protection way different from mentioned Google, Amazon, ... – il_mix Oct 12 at 19:49
  • Such companies just haven't been sued enough to to not exist yet. (also, when suing someone breaching GPL terms, usually someone sues to get them to comply rather than to pay damages) I made some assumptions about what your intent was, because a whole lot of FOSS license questions I see are "How do I violate GPL correctly?" with different phrasing, so it's not a duplicate. – bobsburner Oct 14 at 12:15
1

As MadHatter so expertly explained, the issue of whether or not linking to a GPL library constitutes a derivative work has not been settled. For your purposes, you'll have to assume that it does (just to be safe), and plan your product accordingly.

A common way to deal with situations like this is to split your software up into pieces. One of those pieces will be the GPL library and some non-proprietary parts of your code, just enough to make that piece operate on its own. The proprietary parts of your program would communicate with the "GPL-tainted" parts of your program through some sort of user-space interface. You still have obligations under the GPL to distribute source code, but only for the the code that's included in the module containing the GPL code.

Your question leaves out a lot of details, but it sounds like you may already have a situation like this. You said that your device has a web interface, and that you would like to use a GPL library to "display/stream" that interface. I don't know what exactly you mean by that, but a web interface is generally considered to be a clean breaking point between programs. Since the web interface is usable all by itself, external software that happens to use that interface isn't automatically considered part of the same program. If you're simply trying to make that web interface viewable somewhere else, then you should focus on writing a stand-alone program that uses that GPL library and works on any arbitrary web interface. That would be an independent program, would inherit the GPL, and would require you to provide the source code. All of your proprietary magic is on the other side of that web interface, however, so the GPL wouldn't apply there. You'd have two completely independent programs that are usable on their own, and your device just so happens to use them both together.

The devil's in the details, of course. Considering there's a risk of having to publish what might be considered trade secrets, you really should run everything past a legal professional who knows the details of your product and its architecture.

  • The test of "operates on its own" to establish a non-derivative work has no basis in copyright law (case or statute) that I'm aware of; the FSF's test for separation through user space has everything to do with what's shared between the parts, and nothing to do with whether either is a free-operating entity. If you feel this is a "common way to deal with [the] situation" I invite you to link to other projects that have successfully used this strategy. – MadHatter supports Monica Oct 11 at 19:46
  • @MadHatter I probably worded that poorly. I was referring to something like (for example): UltraVNC is a GPL application. If I use it to access a remote machine and view the output of my proprietary program, my program isn't affected by the GPL at all. UltraVNC and my program are two independent, standalone programs with nothing in common, they just happen to be used together. – bta Oct 11 at 20:37
  • That's much clearer, and for what it's worth I completely agree. – MadHatter supports Monica Oct 12 at 5:36
  • It looks like the "communication interface" (socket, shm, ...) used to connect a closed software and the GPL licensed one is often used to cheat GPL, but most of the time create licensing infringments, because the GPL software is still an integral part for the main software functionality. In my specific case, the web interface is used to configure the app, so, even if put in a different software, there's still astrong aggregation with the main software. – il_mix Oct 12 at 20:03
  • @bta Anyway, UltraVNC example makes perfect sense, and in that case I also agree with MadHatter that the main program and UltraVNC are actually two independent softwares. It's like saying that you are running your program on Ubuntu; this won't "infect" the licensing of the main program. Although, contradicting my own comment, one can say that the OS/kernel is with no doubt an integral part for the main software functionality. ...man, lawyers must have it tough (...or fun?) – il_mix Oct 12 at 20:08
0

I have an overtechnological thermostat. It's a device that runs Ubuntu Server. My app is running on it. It uses a third part library to access the thermal sensor and gather data [...]; the interface display/streaming is done using a GPLv3 library.

Essentially, you are distributing 3 separate objects: the Linux OS, the third-party libraries and your software. Thus, you need to provide the source code for the OS and the GPLv3 library, and maybe the "third party" library (it its license requires it) solely because you're distributing these.

The remaining question is about the status of your app. From your description I understand that it uses a GPLv3 streaming library, so you need to release your software as GPLv3 too.

If you can avoid using GPL libraries in your app and stick to e.g. LGPL libs, you will be able to forego disclosing your app's sources. Linux has no requirement to apply GPL license to software that runs on in, even if it links to essential system libs like libc, due to linking exceptions. Here's the relevant exception license if you use gcc, other compilers have similar provisions.

0

I just wanted to point out that you shouldn't needlessly distribute DVDs when the vast majority of people will never look at the source, and a large portion don't even have a DVD drive.

To summarize the rest of your question:

  • Modifications to a GPLv3 licensed source code must be released under GPLv3. If you didn't modify the library you do not have to license your code under GPLv3.

  • The source code must be public whenever it is distributed. You are distributing the GPLv3 code , so you need to make it public--be it by a web link or including the source.

A derivative work is one that includes aspects of the original. Libraries are software packages utilized by calling their public interfaces. Using a library for its intended purpose without modification is not derivation. That would be like saying a song is a derivative of the instruments.

(I would have replied with this post but you need 50 karma before you can comment)

Here is an article by Lawrence Rosen about what derivative software is.

The meaning of derivative work will not be broadened to include software created by linking to library programs that were designed and intended to be used as library programs. When a company releases a scientific subroutine library, or a library of objects, for example, people who merely use the library, unmodified, perhaps without even looking at the source code, are not thereby creating derivative works of the library.

He even goes on to paraphrase the idea that "linking a library creates a derivative work" is as if "merely touching [...] open source software will infect their software with a virus."

  • In a previous comment I cited Lawrence Rosen from a pro/con links shared by @MadHatter: "a new program is a derivative work if whether the source code of the original program was used, modified, translated or otherwise changed in any way to create the new program". It says that by just USING the code (or its binary) you are creating a derivative product. – il_mix Oct 21 at 7:53
  • @il_mix I would be extremely skeptical of that stance, I have no idea what the basis of an argument that just by using something you... I have no idea what it is supposed to imply. And just and FYI that quote doesn't say anything about using the code. Do what you (and your lawyers) thinks right, good luck. – jgn Oct 21 at 8:21
  • 1
    I did some digging on Lawrence Rosen and found this article: rosenlaw.com/lj19.htm Interestingly his confusions are opposite to the quote you found: " The meaning of derivative work will not be broadened to include software created by linking to library programs that were designed and intended to be used as library programs. When a company releases a scientific subroutine library, or a library of objects, for example, people who merely use the library, unmodified, perhaps without even looking at the source code, are not thereby creating derivative works of the library." YMMV – jgn Oct 21 at 8:30
  • Well, it looks like there are different interpretations, and that's why several questions on the matter arise. Anyway, internet discussions aside, the best "solution", as you said, is: "Do what you (and your lawyers) thinks right" (better without the parentheses) – il_mix Oct 21 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.