I was thinking of building a chrome extension using some open source code licensed under AGPL version 3 for one of my projects. I have modified the original source code quite heavily, and am fine with publishing the modified chrome extension code under AGPL. However, I’m worried about the copy left aspect of AGPL. The new modified extension runs on a chrome browser instance in the cloud or on a user’s own chrome browser. It's only interaction with my other code is that it receives/sends commands via web sockets or http, all over a network. So there is obviously a ton of logical separation between the chrome extension code, and the code that runs the rest of my SaaS.

But I’m also extremely worried about the copy left aspect of AGPL version 3. Would I be required to publish all my code for my entire SaaS or just the extension code? Obviously I’m not an expert on AGPL... =(

Also in response to my post on StackOverflow a user asked for more specifics about how the chrome browser in the cloud worked. So I provided the following example:

"It runs on an ec2 windows instance on aws that automatically loads a chrome browser at launch which then registers itself with the SaaS. The extension receives commands via web sockets, does something in the browser, like takes a screenshot, then sends the results, in this case an image back to the SaaS's own internal apis. The browser version used by front end users is used to build command sets that are then scheduled for execution and relayed to a remote instance at the appropriate time.

Also the reason I'm concerned about copy left is that my SaaS platform has a ton of non-browser related functions which honestly is where my actual value proposition is. The execution of macros in a cloud environment is just one small piece of it."

  • Perhaps this answer (especially the second paragraph and on) would help you softwareengineering.stackexchange.com/a/107931
    – Charlim
    Feb 6, 2020 at 3:40
  • gnu.org/licenses/gpl-faq.html#MereAggregation I think this basically answers the question. I mean it is pretty obvious that a chrome extension is a separate program lol. Copy left has always scared me. I've never used AGPL anything in any project ever because of it. Linus is even super against it: youtube.com/watch?v=PaKIZ7gJlRU Feb 6, 2020 at 5:02
  • 3
    I feel it necessary to clarify that Linus is opposed to the GPLv3, not copyleft in general. The Linux kernel is licensed under the GPLv2, which is a copyleft license.
    – Charlim
    Feb 6, 2020 at 7:15
  • You make a good point. I really screwed up there. I do agree with Linus on the idea that AGPL v3 is a bad license though. Copy left is fine, but I wish it was easier to determine where the boundaries are as far as what's an aggregate and what is part of an application. Feb 6, 2020 at 17:51

1 Answer 1


Using GPL code in a larger derivative work requires that the entire derivative work be made available under the GPL (GPLv3 s4, s5c) to anyone who gets a copy of it. The AGPL extends this privilege to anyone who interacts with the derivative work over a computer network (AGPLv3 s13).

Your question is: what is the derivative work in this case? Is it just the extension, or extension+browser, or extension+browser+whole SaaS stack? Taking your extension as the core of an onion, how many layers do you have to go out before you leave the derivative work and enter into software that is "merely aggregated" with the onion core?

I note that the Chrome browser is proprietary freeware (see eg Wikipedia). But some have written GPL extensions for it, such as this one (there's nothing special about that, it's just the first GPLed Chrome extension that I came across); it wouldn't be possible for others to distribute these if they were part of a derivative work along with the Chrome browser.

So it seems to me that the wider world has already taken a view on whether Chrome extensions are merely aggregated with their browser, or are derivatives thereof, and they've concluded the former. In my opinion (and IANAL/IANYL), you can publish your modified extension under AGPL without having to openly-license your entire software stack unless your browser extension is sufficiently tightly-integrated with your SaaS stack that the two are part of a single, larger work. But you don't give us any particular reason to suspect this.

  • The only thing I can think of that would give that impression was that I planned on having people log-in on the end user extension in order to access remotely stored resources relevant to it, and to send their changes back to the server. Now I feel like that would be taking something that is an aggregate and making it morel like one work/ However if I make them do that stuff manually, it seems like it for sure is an aggregate. Absent any integration with the SaaS it would just be a generic tool anyone could use. Feb 6, 2020 at 15:30
  • The FSF's usual test is outlined in the GNU document you linked to above, and mentions the exchange of complex internal data structures, so if I knew more about your project I might well agree with you.
    – MadHatter
    Feb 6, 2020 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.