13

So, for example, assume an independent software developer has created a library and has licensed it under GPL v3.

The developer is then contracted by a company to develop a software product for the company. The developer uses his library in the course of completing the job and includes the library in the final product.

As part of the development for the company, the developer added new features to the library that were needed for the project, and fixed some library bugs. So now, the library has been modified.

The question is, can the developer use the modified library on his next project for another customer, or does the company own the new library features and bug fixes?

Assume that the time required to add the new library features and bug fixes was billed to the company.

Philip Kendall
  • 19,156
  • 1
  • 57
  • 82
Michael
  • 131
  • 1
  • 3
  • 1
    See also in the GPL v3, section 2 (Basic Permissions), the whole paragraph which says "You may convey covered works to others for the sole purpose of having them make modifications exclusively for you ...". I believe that section is written with this sort of situation in mind. – Brandin Oct 18 '21 at 08:31
  • @Brandin: Interesting. That seems like a weakening of copyleft vs GPLv2 and yet another good reason to prefer v2 over "v2 or later". – R.. GitHub STOP HELPING ICE Oct 18 '21 at 13:36
  • 1
    I've probably misunderstood, but since he is the author of the library, can't he release the library under whatever license he like, including a commercial one, regardless of what license he released the previous versions under (assuming it's all his work, or any contributors released their code to him). If I wrote a library and release version 1.0 under GPL, that doesn't mean I have to release the next version under GPL also, nor that I can't use an extended version in my own projects and release it as non-GPL. But v1.0 will remain GPL - and may be freely forked &c. What am I missing? – Baard Kopperud Oct 18 '21 at 15:57
  • 1
    @R..GitHubSTOPHELPINGICE Maybe it's a weakening, but it's to allow (say) a company to hire someone to make a custom modification of (say) GCC, and still allow that company to retain control over that custom version. – Brandin Oct 19 '21 at 04:56
  • @Brandin: Which is the whole thing I don't want to be able to happen if I'm using a copyleft license. – R.. GitHub STOP HELPING ICE Oct 19 '21 at 12:43
  • This question is not straight-forward to answer. It likely depends on the law of the country applicable to the contracting of the developer, also the exact language of the contract. On top of that it likely depends if the company is releasing the developed program to the public or only using it internally. Can the developer get a license for the program (s)he has developed (which would include the requirement for the company to ship the source under GPL)? So many questions, so few answers. A lot of good thoughts in the answers below, but many are just based on specific assumptions. – Martin_in_AUT Oct 19 '21 at 16:17

7 Answers7

27

In general, if something is completed as "work for hire" then anything produced as part of that work belongs to the hirer, not the hired. However (and this is a very big however) there is enough uncertainty around exactly what counts as "work for hire" that you should always spell this out explicitly in any contract. This is all independent of the GPL or any other open source license.

If the independent developer didn't make it very clear while completing the work that they were depending on a GPL'd piece of code (whether their own or someone else's), then they have at best been unprofessional and are possibly in breach of contract. If that's you, talk to a lawyer as soon as possible.

Can the developer use the modified library on his next project for another customer, or does the company own the new library features and bug fixes?

In the case of the GPL, these possibilities are not mutually exclusive.

  • The company owns the new code created, and has agreed to release that code under the GPL. In that case, the company must follow the requirements of the GPL when using the library (because the original unmodified code is available to them only under the GPL), and it is free for the developer to use as it would be any other code written by a third party and released under the GPL.
  • The developer retained the rights to the code created (either in whole or the changes specific to the GPL code) and has released the changes under the GPL. The company must follow the requirements of the GPL when using the library, and the developer can do whatever they like with the code when it comes to other clients.
  • The company owns the new code created, has not released it under an open source license, and has been granted a separate license to use the code in the library (of course only possible if the developer has the right to do this, normally meaning they are the sole copyright holder of the code). The developer may not re-use the code.

The dramatically different conclusions above are exactly why IP ownership needs to explicitly covered in any software development contract.

Philip Kendall
  • 19,156
  • 1
  • 57
  • 82
  • Thank you. Let's change the scenario a bit. The company first downloads the library and agrees to the GPL license. Then the company contracts the developer of the library to develop the product using the library. Is the company then obligated to make the modified library available? – Michael Oct 18 '21 at 05:13
  • 4
    @michael, that makes it more likely that one of the first two options applies, but doesn't change the answer otherwise. – Bart van Ingen Schenau Oct 18 '21 at 05:38
  • 17
    Depending on the software, is there not also option 4) The company owns the code created, and has decided not to distribute the code at all. For internal tools or SaaS systems, that is an entirely viable choice. – user1937198 Oct 18 '21 at 11:24
  • 17
    There is a common misconception that the GPL requires you to always share source. It does not, it only requires you to share source and redistribution rights to someone you are giving the binaries to. If you don't give the binaries to anyone, you don't have to give anyone the source – user1937198 Oct 18 '21 at 11:36
  • Isn't there a fifth option: The company owns the code created, but is distributing it in a way that infringes the copyright of the work it was based on. That may mean the company can be successfully sued, it doesn't mean the GPL automatically applies to the code created. – bdsl Oct 18 '21 at 19:28
  • @bdsl: The company would have difficulty enforcing its copyright in that case, because of the doctrine of unclean hands. The defendant would have a GPL license from the company, but for the company's violation of the GPL. The company is acting in bad faith and cannot sue the defendant for copyright infringement, since that infringement only arises as a result of the company's own GPL violation. Or at least, that's what a lawyer would argue, anyway. I have no idea whether that defense would actually work. – Kevin Oct 18 '21 at 21:19
  • 3
    I'd add "the writer keeps all rights to the original library, company gets that one under GPL, modifies it (if by themselves, by hiring the author or somebody else doesn't really matter), and use it only internally. Author has no rights over the modifications in this case -- either she didn't write it or gave the rights to the company." – vonbrand Oct 19 '21 at 00:43
  • I think it also depends upon the legal system. Laws (or work contracts) in France are different than laws (or work contracts) in USA. See also https://april.org/ – Basile Starynkevitch Oct 20 '21 at 13:47
6

You can remove the GPL entirely from this question. So much that it may even fit better at law.stackexchange.com.

For instance, suppose that instead of a GPL library, Joe is the owner of some proprietary library he licenses to his customers. Then Joe is hired to do some work for a company, and in the scope of this work, he decides to include his library in the work he was hired to do, and as part of such work he had to modify the library. See? The problem is exactly the same.

Even if the library was originally under GPL, the company is not necessarily bound by it, because when Joe chose to use the library he owns, at very least he implicitly licensed it to the company (as part of the work contract) for whatever use it was the end goal of the company.

If Joe or the company later decide they care about the copyright ownership of either version of the library, if they can't come to an agreement, the court will have to decide.

lvella
  • 213
  • 1
  • 5
3

It's tricky. What would have been best if customer and author had figured out what exactly they want, and a contract had been signed to specify that. As it is, there are lots of unknowns; I would suggest the author should ask the company nicely for a gpl-licensed copy of the code and he is mostly in the clear (mostly because he is not the sole copyright holder anymore); if people get angry then in the worst case this ends in a costly court case. So be nice to save lots of money.

First, under which license did the company get the original software? If the author is the sole author or agrees with the other authors, it could be any license, including obviously the gpl. Whether the company downloaded the software themselves doesn't really matter, the copyright holder can always give permission to use a different license. I know of one case where a company ordered software with the intent to have all rights to the software, the developer gave them gpl-licensed software, and had to pay damages because that was not what was in the contract.

Second, who has the copyright on the changes? In the case of "work from hire" most likely the company that pays. But something that could be argued about in a court.

Is the company distributing the software by hiring someone to modify it? That can be argued for and against. Very good for increasing court cost. Obviously the author will have no rights until the software is distributed, so that makes a difference.

What if the author makes a copy of the software with his changes? He has no right to do this. Even if the gpl forced the company to give someone source code, that doesn't give anyone the right to take it.

So the author is fine if (a) the company understood that the delivered software would be gpl licensed, and (b) the company voluntarily allows the author to take a copy of the modified software.

All this is much better handled beforehand with a contract. And if there are disagreements between company and author, you'd have to be very careful to avoid ending up in court.

gnasher729
  • 1,265
  • 6
  • 7
1

This is really a question for a lawyer; however, some thoughts on how it should work out:

  1. Assuming the library was a preexisting work by you as the author, and the contract did not specify any additional licensing or assignment of copyright over that work aside from the existing public license, I think you're fairly safe using any minor changes, especially bug fixes, you made. Often these are not of sufficient magnitude and originality to even merit copyright consideration. (For example even the FSF is happy to overlook very small fix contributions for the purposes of copyright assignment policy, because their lawyers are confident that such small changes are not a legal risk.) Also, it's not like you could redo them "black box" without being "tainted" by already having done them before, and you almost certainly were not compensated well enough for "being locked out of fixing your own library" to be a consequence of the work you did.

  2. You really should spell this out ahead of time. (Next time, do that!) I have standard contract terms I use with any clients for open source work where it's specified that any changes made to open source software will follow the preferred licensing and copyright assignment policy of the upstream project for the software being modified (which, in many cases, happens to be me). If you don't have conflicting license obligations (to other contributors) not to do this and it's useful to the client, you can also offer a more permissive (basically unlimited) license to use and sublicense the result. This can help with concerns by their lawyers.

R.. GitHub STOP HELPING ICE
  • 2,033
  • 1
  • 10
  • 10
  • If author got hired specifically to make the requested changes, they are "work for hire" and belong to the company. – vonbrand Oct 19 '21 at 00:44
  • That does not seem to be the case. Rather, they got hired to do something else, and use of the existing library was incidental do doing that something-else. – R.. GitHub STOP HELPING ICE Oct 19 '21 at 01:15
  • If the contract makes no mention of licensing a library at all, and the programmer completed the work using a library he owns, it is quite irrelevant the licensing terms of this library to other parties (i.e. GPL). – lvella Oct 19 '21 at 14:11
0

To understand the problem, it makes sense to spell out the parties involved:

  • The original library author, who owns the copyright on the original library
  • The company who hired the library author for the enhancements
  • A third party

Between the first two parties, a contract exists (possibly verbal). The ownership of the enhancements is a matter of contract. Since the library author owns the copyright, this contract can ignore the GPL altogether, or it might explicitly reference the GPL. This is a private matter between those two parties, where the law gives them a lot of freedom. The GPL cannot possibly restrict the library author/copyright owner from exercising those legal rights.

For the third party, however, the GPL only covers the publicly distributed binary. Only that part of the source code is covered by the GPL grant. The third party is unaffected and generally unaware of that contract for enhancements.

MSalters
  • 1,151
  • 8
  • 10
0

This answer also depends on what laws apply. In Germany the author owns the changes but might grant the changes under a different license to their employer depending what stands in the employment contract.

worldsmithhelper
  • 101
-2

The other answers dance around this or only mention it in the comments:

The GPL only requires source code to be made available to those that receive binaries. If the binaries have not been distributed to you (outside the scope of your contract to modify the code), most likely you do not have permission to use the modifications you made.

Eric
  • 298
  • 2
  • 2
  • 1
    This is true, but doesn't actually answer the question at all. – Philip Kendall Oct 18 '21 at 22:47
  • @PhilipKendall Not sure what you mean. The question is: can the developer use the modified code and my answer is: no if there is no access to a binary distribution of the code. – Eric Oct 19 '21 at 01:25
  • Although the GPL doesn't require source to be distributed save to those who have received binaries, if someone chooses to distribute the source anyway, it generally has to be under GPL (see eg GPLv3 s5c). So "Do you have the binaries" is not a good basis for an answer to "was this source conveyed under GPL?". – MadHatter Oct 19 '21 at 05:32
  • @MadHatter Equally, though, merely having access to the source code is not enough to ensure that the source was conveyed under the GPL. I consider having legitimate access to a binary distribution to be a better indicator of whether the GPL applies, especially in situations like the OP’s question. – Eric Oct 19 '21 at 12:00
  • @Eric either the source will clearly and unambiguously state that it was conveyed under GPL, or the distributor's in violation of upstream's copyright - and if they're willing to violate that, having the binary's no guarantee of anything. – MadHatter Oct 19 '21 at 13:26
  • @MadHatter In the OP's question, it's much more ambiguous. It's clear that the dev has conveyed the code to the contracting company, but it's NOT clear that the code has been conveyed back to the dev. So, the dev has access to the source code, which IS covered by the GPL, but it's NOT clear that the dev has the right to use the code under the GPL. If the dev does have access to a binary distribution, it becomes much clearer. – Eric Oct 19 '21 at 14:46
  • @Eric you're right that there's an ambiguity in this case, but it doesn't affect this point. If the distributor is bound by the GPL with respect to the distributed code, my statement above stands. If the distributor isn't bound by the GPL with respect to the distributed code (by virtue of being the sole rightsholder, or some other way) then access to the binary is no guarantee of getting source on demand. – MadHatter Oct 19 '21 at 14:57
  • @MadHatter I disagree again in this instance. The code is clearly covered by the GPL so if the dev has access to legitimate access to the binaries OUTSIDE the scope of the contract to enhance it, then the company is obliged to honor the GPL and provide access to the code. Since the dev already has access to the code, I would argue that, in this specific question, with access to a binary distribution outside the scope of the dev contract, it would allow the dev in the OP to use the modified code as it would be clear to all that the dev's use of the code is covered by the GPL. – Eric Oct 19 '21 at 15:17
  • Let us continue this discussion in chat. – MadHatter Oct 19 '21 at 16:35