I am working on a proprietary project. My colleague used - by mistake - GPLv3 library (copying it's source code and building along with it). The fact was discovered pretty early (before any release happened), and he replaced it by library with more permissive licence, however, the development process does not allow rebasing - the fact that given library was used is in git history probably forever.

Does that pose an issue? Did the single component already "poisoned" the code, and do we need to remove all traces of it?

It was used in a tool, where it is possible it could be made public with source codes.

  • 1
    To be clear: you may, in the future, release the full git history, correct? (Have you done so already?) Or do you only plan to release only a set of files (e.g., snapshot the files at your HEAD and release them with no history)? – apsillers May 27 at 15:04
  • Yes, this is an issue. Cross-site exact duplicate: law.stackexchange.com/questions/51545/… – MSalters May 27 at 16:06
  • Your question depends upon your legal system. – Basile Starynkevitch May 28 at 17:08

This is not a settled matter, but I think that having a GPL-licensed library in your history is not going to be a big problem.

The GPL does not taint or infect other code, in the sense that it would force that other code to be GPL ever after. Instead, it merely requires that when you distribute a program that includes GPL components, that you also offer the corresponding source of the entire program under the GPL. Other components don't actually have to use the GPL license, but could use any compatible license.

If a program includes both GPL components and GPL-incompatible components (such as proprietary software) then the only legal consequence is that the program cannot be distributed at all. For example, purely internal use of such undistributable software is perfectly fine.

We can therefore say:

  • the current version of your software is definitely not subject to the GPL
  • at most, the versions that included the GPL component could be subject to the GPL
  • in any case, it's probably a good idea to prevent internal Git history from becoming public, ever, even if you want to open-source a later version

Whether the past versions could be subject to the GPL, if they are ever distributed, depends on how the GPL component was used. A Git repository is not necessarily a single program but will generally be an aggregate of multiple works. In such an aggregate, GPL-covered programs could live alongside non-GPL programs without affecting each other. However, if the GPL component was a library, then your proprietary software might have been a work based on the GPL component during those versions, and would be subject to the GPL.

If you want to publish the source code of your proprietary tool, it's probably a good idea to either push through a one-time history rewrite to remove any doubt about possible GPL influence, or to start a new repository with a snapshot from your current state. Publishing internal history is usually a bad idea, independently from licensing concerns.

| improve this answer | |

The practical impact is that the Git repository is tainted. If you want to distribute the whole history, including the commits containing GPLv3 code, then (by copyright law) you need permission, and (by GPLv3) you can only get that permission by licensing the whole as GPLv3.

There is no impact if you distribute a current binary. Under copyright law, that is not a derivative work of your Git repository as a whole. Therefore, you don't need permission of the authors of a library that's not included in the binary. That obviously also means it doesn't matter under which terms they might grant that unnecessary permission.

| improve this answer | |
  • "By licensing the whole as GPLv3" - I believe this is incorrect, because there is definitely room to argue mere aggregation here. – Max Xiong May 28 at 1:44
  • @MaxXiong: Presumably the library was in use, i.e. the program links against it. Mere aggregation would have been fine, but pointless. – MSalters May 28 at 6:56
  • What I meant is, the entire git repo, including its history, would not be completely subject to the GPL, because the state after each commit would probably be considered mere aggregation. – Max Xiong May 28 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.