Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. It only takes a minute to sign up.
Sign up to join this community
Imagine you have a proprietary project (non open source), and by mistake you added a dependency to a library with a strong copyleft license. You have already distributed your code. And you realize that now you have to open source your code due to this dependency.
Is it legal to remove this dependency and keep your proprietary source code closed ?
Thanks for your advice ;)
Law is complicated and varies by jurisdiction. In the United States (and probably many other jurisdictions), a court generally cannot compel you to release your source code simply because you did not abide by the terms of a copyleft copyright license. In this situation, you have committed copyright infringement (based on the facts you've presented), but the remedies for copyright infringement are monetary damages and injunctions to cease future distribution.
Part of what complicates the case is that the GPL says you may exercise certain permissions pursuant to certain obligations. If you exercise the permissions without meeting the obligations, the question is: have you simply acted outside the license altogether, or have you acted within the license but failed to meet your obligations? In the latter case, how should the law resolve the situation? Different jurisdictions may answer this question quite differently, and even within a jurisdiction the answer could possibly turn on case-by-case particulars.
Certainly the best thing you can do immediately is to cease distribution of the infringing version (as you say you've already done in your hypothetical). From there, it is up to the copyright holder whose copyrighted work you infringed whether to take legal action against you, or ask for a settlement in lieu of legal action, or do nothing at all. Regardless of what the law may do, it is not impossible that the copyright holder could ask that you release your source code or else they will pursue a lawsuit. In that case, you can decline their offer and leave it to the court whether and how your infringement will be punished under the law.
Eben Moglen (a lawyer who has advised the FSF substantially) offers the following explanation (quoted from this article):
The claim that a GPL violation could lead to the forcing open of proprietary code that has wrongfully included GPL'd components is simply wrong. There is no provision in the Copyright Act to require distribution of infringing work on altered terms. What copyright plaintiffs are entitled to, under the Act, are damages, injunctions to prevent infringing distribution, and--where appropriate--attorneys' fees. A defendant found to have wrongfully included GPL'd code in its own proprietary work can be mulcted in damages for the distribution that has already occurred, and prevented from distributing its product further. That's a sufficient disincentive to make wrongful use of GPL'd program code. And it is all that the Copyright Act permits.
Though he speaks from the perspective of a United States lawyer -- indeed, the Copyright Act he references is an American law, so the answer may differ internationally. See MadHatter's answer for some international particulars.
Note also that GPLv3, section 8, explicitly grants a copyright holder the right to permanently terminate your rights under the GPL if you violate those terms. If that happens, it doesn't impact your proprietary project, since you've already removed its dependency on the GPL-licensed code, but it would prevent you from using that dependency in other correctly-licensed projects in the future.
With respect to my colleague apsillers (and noting IANAL/IANYL) I disagree somewhat. The law is indeed complex, and does indeed vary by jurisdiction. Just how much became clear to me in a talk at FOSDEM 2018 by three experienced lawyers, which I wrote up for LWN (the article also links to the original video). The parts specifically relevant to your question are the availability of orders for specific performance, and third-party rights. The former deals with whether a court might order someone who had violated a licence such as the GPL to perform a specific act, such as releasing source code to a recipient of binaries, instead of merely paying compensatory damages. The latter deals with whether third parties, such as the recipients of those binaries, have standing to bring such suits.
The conclusions of the panellists shows how much things vary by jurisdiction. In the US, they said, third-party rights depend on the wording, and orders for specific performance are theoretically available but are rarely granted, which broadly agrees with what Eben Moglen said above. In the UK, no third-party rights exist, and specific performance is not available. In civil-law jurisdictions such as much of the EU, however, third-party rights do exist, and specific performance is available.
So in civil-law jurisdictions, such as Germany (where courts have already held on several occasions that the GPL is a contract, and can be litigated as one), it is very possible that a recipient of your code can sue, and ask a court to order you to release the rest of your code under GPL, with some likelihood of success.
Moreover (said one speaker) in these jurisdictions, acceptance of the GPL's conditions can be signalled by many means, including conduct, and is probably irrevocable. So removing the dependency stops you continuing to widen the pool of people who might so sue, but it doesn't make those who are already in that pool disappear.
