13

I have noticed that some groups or organizations convey the GPL software without the source code. Such examples are:

Some of them, that I have asked, said, "we copied it from Debian/other operating system and look for sources there". But that is by my opinion not in accordance with the GPL licenses. For example kernel of GNU operating system, Linux, is licensed by the GNU GPL Version 2 and by reading it, I understand that every distribution of software shall give the source code.

unor
  • 5,620
  • 24
  • 55
Jean Louis
  • 241
  • 1
  • 8

4 Answers4

19

but that is [in] my opinion not in accordance with the GPL licences

I agree with you. The GPL has always been pretty clear that you need to supply source if you're propagating binaries, and various authorities have opined that pointing to someone else's repository is not sufficient, eg

companies who redistribute software packaged for them by an upstream vendor cannot merely pass along the offer they received from the vendor; they must provide their own offer or corresponding source to their distributees.

Sadly, it is far from the worst violation of the GPL you'll see out there. Some people make very significant changes to GPL codebases like the Linux kernel and sell the resulting binaries without releasing major parts of their codebase at all.

But the only people who have standing to use the law to rectify this are the copyright holders themselves.

If GPL violations like these trouble you, and you'd like to do something about it, one positive step you can take it to support projects that assist the rights holders in taking legal action to compel compliance. This includes projects like http://gpl-violations.org/ or the Software Freedom Conservancy.

MadHatter
  • 48,547
  • 4
  • 122
  • 166
1

The GPL does not require you post your distro . You are free to make modifications and use them privately, without ever releasing them. This also applies to organizations (including companies); an organization can make a modified version and use it internally without ever releasing it outside the organization.

But if you release the modified version to the public in any manner, the GPL requires you to make the modified source code available to users, under the GPL.

Thus, the GPL gives permission to release the modified program in certain terms and not in others; but the decision to distribute looking at you.

GAD3R
  • 111
  • 2
0

Should people who take a Debian system, make some minor configuration tweaks, build an ISO and ship it to the public provide source code? technically yes. GPLv2 makes it pretty clear that access to copy source code should be from "the same place", so unless you are going to count the whole internet as one place it seems pretty clear to me that if you distribute binaries you also need to distribute source.

Does it further the interests of the free software community to go after such projects? probablly not. If resources are to be spent going after GPL violators it makes far more sense to spend those resources on going after software that has actually been modified rather than mere failure to provide copies of stuff that is already public.

Peter Green
  • 328
  • 1
  • 6
0

Some of them, that I have asked, said, "we copied it from Debian/other operating system and look for sources there".

No, it's PERFECTLY LEGAL. Note that wording changed between GPL v2 and GPL v3 but from 6.b about Conveying Non-Source Forms of GPL v3 license (emphasis is mine):

Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.

They should provide a written link to that repository (license requires an access with a reasonable effort for end-user). Note that when 6b doesn't apply then they are in case described by 6d and same reasoning is valid.

For example kernel of GNU operating system, Linux...

True. Note that kernel is licensed under v2 (exactly 2.0, not any other) and things are little bit different in wording (because v2.0 is an old license when network availability was not so wide. From 3.b you know that:

[source code] to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or...

Note that generic wording "...medium customarily used for software interchange...". Nowadays Internet access is absolutely a medium customarily used for software interchange. Also note that again is required a written note about where you can get source code.

I didn't download those ISOs but I'd guess they include required information. I'd define this behavior sloppy but not criminal (because license violations are criminal acts.)

As final note please do not forget that inside Debian distro there are software distributed with many different licenses (not only [L]GPL), that's a good reason to keep license information (it's pretty important) inside ISO where individual licenses can be addressed correctly. A real-world example of this? If you have an Android device you know...

What I'd suggest is to simply contact them and explain your perplexity about license terms. I think it may be ethical to provide required information in a more prominent place but legally speaking (however note that I'm not a lawyer) they're right.

Next paragraph isn't an answer to your question and it's just my very personal opinion about this topic. I guess it will be unpopular but that's it...

<rant>Open Source licenses are made to protect your rights to access source code, change it and improve your knowledge. To be useful they must be reasonable and compatible with real-world. Sadly there are many serious violations - not always in bona fide - however tilting at windmills doesn't help and it may be counterproductive.</rant>

Adriano Repetti
  • 189
  • 1
  • 7
  • 3
    GPLv3 6(b) only applies to physical conveyance of the object code, ie, selling a distro DVD or a widget. For object code made available over the network, such as both the examples the OP quotes, 6(d) applies, and the projects must "maintain clear directions next to the object code* saying where to find the Corresponding Source*" (my emphasis). Neither project is doing so, and when the question is put to them (as it apparently has been), they should have acted to put it right, not merely told the enquirer to get it elsewhere. – MadHatter Mar 09 '16 at 16:37
  • I would also add that I didn't propose the OP reported anyone to anyone - not least because (s)he doesn't have standing to pursue a licence violation complaint, not being the licensor. I suggested that (s)he, and others, support organisations that help licensors bring such actions - and both those I quoted have very much a policy of constructive engagement first and legal action only as a last resort, as you recommend. – MadHatter Mar 09 '16 at 16:39
  • MadHatter. No, it's not restricted to physical medium (like DVDs). v3 also explicitly allow you to distribute both (binaries and sources) from same server (but still keeping them separate). – Adriano Repetti Mar 09 '16 at 16:40
  • 2
    Yes; GPLv3 does permit that, but not under section 6(b), which only applies if you "convey the object code in, or embodied in, a physical product (including a physical distribution medium)". Please read what I wrote. – MadHatter Mar 09 '16 at 16:41
  • @MadHatter it wasn't a critique, if OP thinks it's a license violation then someone - with a legal background - should investigate. That's a good advice (IMO) – Adriano Repetti Mar 09 '16 at 16:41
  • 1
    If it's not under 6b then it's under 6d (source located on your or 3rd party servers). In both cases you're allowed to keep sources on an accessible internet server (you need only to put somewhere a link back to that server). You're not required to do anything else (no need to distribute sources together with binaries, no need to put sources on your own servers, no need to put them on same server where binaries are located). Spirit of the license is to make source code practically available to anyone who wants it. Nothing more and (obviously) nothing less. – Adriano Repetti Mar 09 '16 at 16:45
  • GPLv3 6(d) requires exactly what I quoted in my first comment, above. Note particularly the requirement that "clear directions ... saying where to find the Corresponding Source" be maintained "next to the object code". "Putting somewhere a link back to that server" would probably not satisfy that requirement, which at least to me requires comparable prominence and positioning to the object code itself. – MadHatter Mar 09 '16 at 16:48
  • @MadHatter see point 3 of 6b (emphasis in license text I quoted). It can stay on a network server even if you distribute a physical device. Think, for example, about your Android device...it doesn't contain source codes but it contains all licenses and references needed to find them (with some effort but...) – Adriano Repetti Mar 09 '16 at 16:50
  • 2
    Yes, it can, but the requirements of 6(b) apply only to conveyances that are made via physical device. If you also convey via network server, 6(d) applies to those conveyances. You can't just magically exempt your network server conveyances from 6(d) by giving a single DVD to a friend. The Android device issue is probably not relevant to this conversation, as the Linux kernel is not licensed under GPLv3. – MadHatter Mar 09 '16 at 16:52
  • Maybe I've not been clear but: 1) if 6b applies then source code can be on-line, in any accessible location. 2) If 6d applies then source code can be on-line in any accessible location ("If the place to copy the object code is a network server, the Corresponding Source may be on a different server..."). It would be unreasonable to force you to host full source code if you just need to distribute some binaries (and of course license addresses this issue, no need to discuss about it). – Adriano Repetti Mar 09 '16 at 17:01
  • To make it short and easy: according to GPL v3 it doesn't matter where source code is (until it's accessible). For instance even a printed sheet may be an acceptable media for 30 LOC...Moreover this is true whichever medium you use to distribute your binaries. What you're required to do is to link back those servers (also a license file within ISO, in this case, is good enough) – Adriano Repetti Mar 09 '16 at 17:04
  • Let me be clear also. I agree that source code doesn't have to be on the same server for a 6(d) or 6(b) conveyance. However, I don't agree that what either of the existing projects in the OP's questions are doing - rebuffing source requests pursuant to their 6(d) conveyance with a simple "you can get it from upstream" - is 6(d)-compliant, for the reasons I have stated in my comments above. A licence file on an ISO is enough if and only if the ISO is physically conveyed (6(b) conveyance). For ISOs conveyed from a network server, the sterner terms of 6(d) (again, see above) apply. – MadHatter Mar 09 '16 at 17:06
  • @MadHatter I agree about that. To honor 6d they have to explicitly link to those servers. That's why I suggested to contact them. However note that such link may also be inside ISO, in that case they're OK for 6d. It's not required (arguably?) that those links stay on the same level of binaries. In this case they don't need to do anything (they're just sloppy...) – Adriano Repetti Mar 09 '16 at 17:09
  • Let us continue this discussion in chat. – MadHatter Mar 09 '16 at 17:22
  • 1
    @adriano -- I referred to GPL software, not to GNU operating system with Linux kernel. There are many licenses for bulk of software inside of a CD being offered for download. And Linux kernel is under GNU GPL version 2 -- so that one does not allow using third party servers. And how many other packages are inside with such version? – Jean Louis Mar 11 '16 at 21:56
  • For sure many packages but I'd guess all of them are compatible with GPL. V2 simply does not mention Internet servers but also does not require to be hosted on your own servers. Remember it's an OLD license. Let's change point of view: which part of any license in that distribution makes you think that it's mandatory to host source code on their own servers? If you have a specific doubt it's easier to discuss. For sure not GPL 2/3 – Adriano Repetti Mar 11 '16 at 22:28
  • 1
    @AdrianoRepetti - GPL version 2 is not "old" license. It is version number. Linux kernel is not going to be published under version 3. And such is with many other software. I start with Linux kernel. – Jean Louis Mar 12 '16 at 15:37
  • Obviously it's a version number but 1) it's from 1990 (or 91?!) and from sw point of view it's another era. That's why it doesn't mention Internet as a viable medium for distribution. 2) AFAIK Linus simply disagrees with v3 (I can't find in this moments his notes about this topic). 3) About it: as any legal text is pretty generic. In quote I posted it asks for "...medium customarily used for software interchange...". Nowadays (it wasn't like that in 90/91) you can undoubtedly accept an Internet server. – Adriano Repetti Mar 12 '16 at 21:54
  • Moreover because of its age it doesn't mention Internet directly and it does explicitly talk about own or 3rd party servers. From this point of view it's even more permissive than v3 because more open to interpretations. – Adriano Repetti Mar 12 '16 at 21:55