24

I have a client who sent me his source code for me to review. It was a non-paying job. His source code was clearly a heavy modification from a popular GPL-licensed software which I part-authored. I can see the original code (including GPL license headers) everywhere in the project. We didn't have any contract or agreement, simply email exchanges.

His application is commercial and he charges few dollars per download. However, he never stated his project is GPL, so nobody had asked him for the code.

Q: I have a copy of his application (I'm also his customer). Can I enforce GPL and distribute the application and source code?

NOTE: I'm 100% sure the seller isn't going to acknowledge his GPL commitment. It's a commercial software and he's selling it.

EDIT: I partly owned some of the original code (that was how I recognized the code) but I won't sue anything. It's just a tiny iOS app, I don't have time and money.

ArtOfCode
  • 9,396
  • 2
  • 28
  • 70
SmallChess
  • 666
  • 4
  • 13
  • 2
    Are they distributing the source with what they are selling? – Honest Abe Oct 24 '16 at 05:27
  • 2
    @HonestAbe No. Just the application, no source, no mention about GPL. – SmallChess Oct 24 '16 at 05:28
  • GPL is a commercial licence: you can sell copies of the software, however the distribute must give all of the freedoms to the distribute. – ctrl-alt-delor Oct 24 '16 at 17:08
  • 1
    Side note: I don't believe the GPL requires you to put a download link to the source code next to your app, just to provide the source on request. I could be wrong on that, but I'm not sure. –  Oct 25 '16 at 15:55
  • 3
    @QPaysTaxes They are at least required to tell you of your right to request the source code. It's been stated that they don't even mention the GPL, which is a violation. – Honest Abe Oct 25 '16 at 17:05
  • @HonestAbe Oh, alright. I haven't read through the GPL in a while, and I didn't read this post carefully enough to see that. –  Oct 25 '16 at 17:06
  • 1
    If you and your co-authors don't seem intent to enforce GPL, I wonder why you would license the software with GPL in the first place. If none of the co-authors want to take this up for this company or any other future companies either, then perhaps, with the approval of your co-authors, you might have wanted to relicense the work with a more liberal license like MIT or BSD. Then you might want to work out a notice to the company to get them formally relicensed. – Lie Ryan Oct 26 '16 at 07:20
  • 1
    Note that just because the person in question is selling his software does not mean that he necessarily will resist licensing it under the GPL. Plenty of GPL software is sold commercially (with appropriate licensing); typically this works because there is some kind of value-add in the deal. Look at RedHat, for example. – PellMel Oct 26 '16 at 15:32
  • What version of the GPL is being used? Did they distribute the program (violating the terms) before they sent you code to review? – Honest Abe Oct 26 '16 at 19:25
  • Does the code contain a LICENSE file including the GPL text? – Andrea Lazzarotto Oct 28 '16 at 10:49
  • @AndreaLazzarotto no – SmallChess Oct 28 '16 at 10:50

7 Answers7

34

I don't think you can distribute the code, but I think you can sue the guy. You're the copyright owner ("you" meaning you and your co-authors), and he's a licensee, under the gpl. He violated his license agreement, and that gives you a civil cause of action against him. But I'm not a lawyer (though my father, brother, ex all are), so you might want to check with the free software foundation about exactly how to go about all that.

And by the way, stop calling the guy your "client". He's an acquaintance for whom you're doing a favor, reviewing his code. For him to be a bona fide client, there must exist a contract between the two of you. And you said he's not paying you. One of the requirements for a contract to exist is called "consideration", an exchange of goods and/or services. But you got nothing in return for your code review service. Hence, no contract and no client, period. And you have no professional obligation to the guy, period.

John Forkosh
  • 845
  • 6
  • 11
  • 2
    The OP never said they were the copyright owner. And frankly what are the benefits of suing when things could be resolved other ways? – Philippe Ombredanne Oct 24 '16 at 15:32
  • 3
    My bad, it is actually mentioned further down in a comment ... this makes the question's answers rather weird for sure. – Philippe Ombredanne Oct 24 '16 at 15:35
  • If I don't have professional obligation, that means I can redistribute the modified code without asking for permission? – SmallChess Oct 25 '16 at 09:12
  • 2
    @StudentT: No because then you would be infringing on his copyright (the fact that he infringes on your copyright does not give you any legal right on his). – Zimm i48 Oct 25 '16 at 12:28
  • Why do you say a civil cause? Isn't copyright infringement criminal? – user541686 Oct 25 '16 at 22:41
  • @StudentT Ditto Zimm's answer. Just because you have no professional obligation (and I reiterate that you have none), doesn't mean you can do anything you want. For example, you have no professional obligation to me, but neverthless can't blow my brains out -- a somewhat extreme example, just to emphasize the point. "No professional obligation" just means no special contractual obligation beyond ordinary law, e.g., most such contracts have a no-compete clause. But it doesn't mean you can do anything you please. – John Forkosh Oct 26 '16 at 08:03
  • @Mehrdad No, copyright violation's typically not criminal. But I suppose that's ultimately a jurisdictional question. It could conceivably be criminal somewhere, but I'm not offhand aware anywhere it is. Anybody know of any such place??? – John Forkosh Oct 26 '16 at 08:07
  • 1
    So I just looked this up and apparently it can be either, depending on the case (even in the US). – user541686 Oct 27 '16 at 00:00
26

If he's distributing software derived from GPL code, one of the following must be true:

  1. The derivative work is licensed under the GPL.
  2. He's using the GPL code under some other license from the original author.
  3. He's violating the GPL.

If it's the second or third possibility, then you have no license to redistribute his changes to the project.

Edit: If he's violating the GPL, his violation doesn't automatically put his code under the GPL. But as a copyright holder of the GPL code he modified, you could demand that he either license his version under the GPL, or stop distributing it. Or you could propose licensing the original version to him under different terms, if your co-authors agree.

Kevin Krumwiede
  • 409
  • 3
  • 6
  • 8
    This can't be (2) because I'm one of the original authors and he never asked me. That's why I recognized the code. – SmallChess Oct 24 '16 at 05:23
  • 3
    @StudentT Are you also a copyright holder on the original code? (You are by default unless it was a work for hire or you assigned your copyright to someone else.) – Kevin Krumwiede Oct 24 '16 at 05:34
  • 1
    I'm the secondary author. I licensed it out the source code with GPL. I partly own the original code, but not the new modification. – SmallChess Oct 24 '16 at 05:35
  • @StudentT See my edit. – Kevin Krumwiede Oct 24 '16 at 05:44
  • @StudentT Maybe you feel bad about "throwing him under the bus", but please, tell the creator of this software what's going on. – deviantfan Oct 24 '16 at 08:16
  • That should be, license his version under the GPL, or stop distributing it and pay damages. – ctrl-alt-delor Oct 24 '16 at 17:13
  • You missed option 4 -- while he's physically distributing the software, that distribution does not legally qualify as distribution. For example, it might be fair use, it might be a necessary step to use the software in the customary manner, or otherwise not legally qualify as the distribution that requires permission. – David Schwartz Oct 24 '16 at 20:22
  • "...doesn't automatically put his code under the GPL." To avoid your GPL obligations the changes made to the GPL'd source would have to be huge, enough to make the original code virtually unrecognisable in fact. – James Snell Oct 24 '16 at 21:48
  • 2
    @JamesSnell I believe the point is that code does not become covered by a license "automagically," or "on its own." A license has to be applied to it explicitly. Of course, distributing without having applied the GPL is a suable license breach, but if you receive such a distribution, you have not received it under terms of the GPL and cannot thus use it as such. – Angew is no longer proud of SO Oct 25 '16 at 06:56
  • @Angew - actually that's one of the big problems with the GPL, especially GPL3, that the viral nature means anything that touches or uses it must become GPL unless it's done in a way that the GPL code/module can be replaced easily (so dynamically linked) - which is in no way indicated by the question, in fact quite the opposite. – James Snell Oct 25 '16 at 09:16
  • 2
    @JamesSnell Yes, if you distribute it, you must do so under the GPL, otherwise you're breaching it. But you still can distribute it not under the GPL, just like you can break the law, event though you must not. The distribution act itself does not apply GPL to the code, that's what I meant. – Angew is no longer proud of SO Oct 25 '16 at 09:42
  • The OP wrote that he can see the original code «including GPL license headers», ergo the modified files still retain the GPL headers → this means they are effectively marked as GPLed. – Andrea Lazzarotto Oct 25 '16 at 12:52
  • @AndreaLazzarotto It's hard to imagine that a heavily modified project would not contain at least one new file, without which it could not function. – Kevin Krumwiede Oct 25 '16 at 16:38
  • @KevinKrumwiede whether the notice must be added to each file is a matter quite open to debate. The FSF recommends it, it doesn't mandate it. Moreover, we would also need to know if the project contains a LICENSE file. – Andrea Lazzarotto Oct 25 '16 at 18:08
11

I have a client who sent me his source code for me to review.

If I have a "client", then this means I have likely some commercial contractual relationship with this company. And if this client sent me the source code for review, there is likely some trust and strong relationship in place.

Therefore I will consider both the open source aspects and my business relationship in this context.

It was a non-paying job. His source code was clearly a heavy modification from a popular GPL-licensed software. I can see the original code (including GPL license headers) everywhere in the project. We didn't have any contract or agreement, simply email exchanges.

If we did not have any agreement in place either explicit or implied, I am wondering how this could be a client of mine in this context.

His application is commercial and he charges few dollars per download. However, he never stated his project is GPL, so nobody had asked him for the code. Q: I have a copy of his application (I'm also his customer). Can I enforce GPL and distribute the application and source code? NOTE: I'm 100% sure the seller isn't going to acknowledge his GPL commitment. It's a commercial software and he's selling it.

The context is rather unclear: I do not seem to be sure that I am the customer of this business or that this business is my client, or both.

In this context, I can do two things:

  1. Do the right thing: I could advise my client about this possible GPL compliance issues they are likely facing. I would not assume anything about their willingness to comply. I would contact them and alert them to the facts I have noted and tell them I want to ensure that I can use the rights granted my by the GPL. From experience most companies want to do the right thing and are just unaware about the fact there are things to do to be compliant. I would also note that there are no conflicts with the software being sold: this is fully allowed by the GPL.

  2. Do the mean thing: I could ignore anything about any relationship I have with my client and I can use the rights granted to me by the GPL license and redistribute the application and source code. Doing this without a discussion would likely be rather irresponsible though. It is likely to be illegal as pointed by MSalters. This is likely to draw me in unwarranted problems and conflicts and damage my relationship with this client or customer. So unless I have a strong reason to enter such a conflict, I would take the high road and use approach 1.

Now, your question is missing a rather important point that you only mentioned in a comment to another answer so far:

@StudentT Are you also a copyright holder on the original code? (You are by default unless it was a work for hire or you assigned your copyright to someone else.) – Kevin Krumwiede

I'm the secondary author. I licensed it out the source code with GPL. I partly own the original code, but not the new modification

So I am after all the original author or a significant author. If I am the original author, then things are rather different. The first thing I would do is contact the culprit in all cases as explained in 1. above.

Then the other important thing is which version of the GPL is used. With a GPL 2.0, the license terminates immediately with no easy way to reinstate it. With GPL 3.0, there is a bit more flexibility and no immediate termination. What really happens/can happen depends a lot on this.

A third possibility to consider could be that in conjunction with 1. I could thank my client/customer for their contribution back to my GPL-license codebase and say I will integrate this in future releases...

Community
  • 1
Philippe Ombredanne
  • 14,441
  • 2
  • 32
  • 87
  • 1
    "With a GPL 2.0, the license terminates immediately with no easy way to reinstate it." Under what conditions? Are you saying that the OP contacting the company causes the GPL license to terminate? – Ajedi32 Oct 24 '16 at 18:40
  • 2
    @Ajedi32: A GPL 2.0 license terminates when the distributing party does not obey the terms of the license. Hence, even if the company was a GPL v2 licensee at any point, they no longer were at the moment they first sold the software without acknowledging its origins. (This applies only to the particular work; they might still have a GPL v2 license for e.g. Linux). This is important : the author is one of the co-authors, and cannot reinstate the GPL v2 license on behalf of the other copyright owners. The company has a serious problem. – MSalters Oct 24 '16 at 22:48
  • 3
    Option two is illegal, if I understand your proposal correctly. The company is distributing copyrighted content, in violation of national law. Since no contract exists (the GPL v2 license auto-terminated), only the legal violation remains, and only a legal remedy according to national law is possible. And I'm pretty sure the law does not allow option 2. – MSalters Oct 24 '16 at 22:54
  • Right, what your propose in option 2, and in your third possibility, is a plain copyright infringement. If the company sued the OP, the OP could counter-sue but their position would be weakened. – Zimm i48 Oct 25 '16 at 12:32
  • Paragraph 4 of GPL clearly states that violating GPL does not void rights of clients that received the code. – Marcin Raczkowski Oct 26 '16 at 17:47
  • @MarcinRaczkowski correct. But it terminates the right of a violator immediately with the GPL 2.0 – Philippe Ombredanne Oct 26 '16 at 18:02
  • @Zimmi48 which is why I do not recommend and would never use option 2. – Philippe Ombredanne Oct 26 '16 at 18:03
6

If you did not receive his code under the understanding it is licensed under the GPL, you have no right to redistribute it. Period. Not even if you are one of the original copyright holders (as you explain in comments rather than the original question: please update the question).

Your acquaintance has every right to use GPLed software for internal use (including running publicly accessible servers unless we are talking the Affero GPL in particular) without making sources accessible. The point when he is selling or otherwise distributing software to third parties is where the GPL kicks in and demands that he gives the recipients the source code or access to the source code of the whole, modified software under the conditions of the GPL.

As you describe it, he is in breach of this requirement of the license he received the source code under. The only legal consequence of this is that the original license holders (apparently including you) can sue him to cease and desist distributing copies in violation of the license he can avail himself of.

If you were no copyright holder yourself but noticed this, the only option would be to contact one of the copyright holders and inform him of the breach and leave any further action to him. This would be a breach of confidentiality and you'd have to judge what that means for your business.

As you actually are one of the copyright holders, this particular worry does not apply to you.

However, the person in question would be abysmally stupid not to notice your name in the license notices and still ask you for changes, so what is up with that? Are you sure you are an actual copyright holder in a sense that is strong enough to make your legal claim stick well?

At any rate, you don't seem like the sole copyright holder anyway. You might ask the FSF's copyright clerk for some advice on how to proceed: the FSF has particular experience in getting people to comply with the GPL without dragging them to court. This saves time, money, bad blood. And particular in your situation, you might want to get the issue resolved in as professional and amicable manner as possible if there is any chance since it also talks about your professional behavior and how you behave in business matters.

user6548
  • 61
  • 1
2

I'll be refering to Version 2.0 from here: http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt But it should apply to 3.0 as well.

Following facts things are important here, and my answer is based on those:

  1. Code was sent to the Author on purpose (he didn't gain access to the code illegaly).
  2. The code contains GPL headers.

Regardless if you bought it or not, the important part is that the code was received. Paragraph 1 of GPL clearly states that:

You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty;

Now on top of that:

  • The fact that they broke the GPL does not void your rights (See Paragraph 4).
  • They couldn't even restrict you from redistributing it even if they thought of it! (see paragraph 6).
  • You don't have to buy the GPL code to be bound by the licence, you're bound by GPL every time you download Linux for free. The important part is receiving the code, by any legal means.

So the moment you've received the code (you don't even have to buy it!) you've been granted all the rights given to you by a licence. Congrats.

Now for the rights:

  • Make copies of the application and resell them (Paragraph 1).
  • You can resell your application.
  • Publish the application for free.

So to summarize: yes. You can do anything you want with it. You can publish it for free, you can sell it compile (as long as you keep GPL terms from paragraph 3), it's irrelevant how you've received GPL code, or if you've paid for it.

PS. One last gotcha, and as usual the devil is in the details. As some of the other answers stated the fact that he's breaking GPL does not automatically license his code as GPL. So again it all comes down to: Does the file and/or project have GPL licence/headers. If the project you've received include GPL licence and in README for example it's stated that project (as a whole) is under GPL, then you're good. If it does not it's more tricky. It can be assumed that if the file was modified and in the header there's a GPL licence then the modifications were bound by GPL, however new files without the header, are not, and you cannot redistribute them unless given permission.

Marcin Raczkowski
  • 387
  • 1
  • 6
  • 2
    That's not because this is the answer you would like that this is the right answer. This answer is assuming that the application that you bought was licensed under GPL. If it did not come with a GPL license notice, which was obviously the case that you described, then the app is not GPL. It is just in breach of the license of the software it is based on. – Zimm i48 Oct 27 '16 at 11:00
  • I can see the original code (including GPL license headers) If it does include GPL headers, then it's licensed under GPL. Most GPL headers clearly state this code is licensed under GPL and you can get a full copy of licence here-and-here. I was operating under that assumption, and my answer is based on that. Again Paragraph 6 - the fact that The seler broke licence does not mean the licence lost its validity for clients. And again you don't have to buy the code. You just need to receive it as the author did. – Marcin Raczkowski Oct 27 '16 at 11:25
  • You are giving a different argument in your comment than in your answer: in your answer you are saying "you are the customer..." AFAIU as the customer, he did not get the code. He did get the code as the "unpaid contractor". That's right that it should allow him to redistribute the source further under normal circumstances. But here, it is clear that this was "accidental licensing". I wouldn't be too sure of what a court would say in such case. – Zimm i48 Oct 27 '16 at 11:31
  • It doesn't matter at all how he got a code. He received it. It was sent for him on purpose. The case would certainly be different if it wasn't sent to him on purpose or he got it illegally. However that's not the case, the code was sent to him for review, he received it, and by that process he is now bound by GPL. Again it doesn't matter at all if he was paid for it, or if he paid for it, it doesn't matter. He received the copy of the code covered by GPL (as stated in headers). I'll adjust the answer. – Marcin Raczkowski Oct 27 '16 at 11:36
  • 1
    @MarcinRaczkowski well it does matter. If the OP were working internally for the company that wouldn't be considered receiving the code. Of course this is not the case and your answer stands because there is no contract between the two parties. – Andrea Lazzarotto Oct 28 '16 at 10:54
  • Warning the answer of Marcin Raczkowski is not necessarily true. The code you received could not be under the GPL! The costumer could have put your code together with some third party code, which is incompatible with the GPL. (For example any proprietary code of a third party). Then the code you received will not be under the GPL. –  Oct 27 '16 at 07:49
  • @user6574, in that case OP's mandant wouldn't be allowed to distribute, period. In any case, OP got the code as part of a job (as I understand this post), so legally OP is in some way part of the organization, and giving them code would not count as "distribution". – vonbrand Feb 20 '20 at 13:39
1

As a customer, whatever you got through a purchase may be redistributed per the terms of the GPL. Make sure the seller acknowledges it is GPL licensed before you do so, to ensure you aren't mistaken about it being GPL.

As for redistributing code that you got for review, that is a definite fuzzy ground that isn't a clear answer to, and is beyond the scope of this site's capacity to answer.

whatsisname
  • 692
  • 3
  • 7
  • Unfortunately, a commercial seller will never acknowledge GPL. This isn't going to work. – SmallChess Oct 24 '16 at 01:11
  • 1
    That's not true. Regardless, if the seller is violating the GPL, then see https://www.gnu.org/licenses/gpl-violation.en.html – whatsisname Oct 24 '16 at 01:18
  • 1
    @StudentT Well they have to either do that, stop selling it, or risk getting sued. Which of those options do you think is best for them? (Actually in practice "risk getting sued" tends to be a good option because most GPL copyright holders can't be bothered to sue them...) – user253751 Oct 24 '16 at 08:34
  • 1
    @immibis Going to court for GPL only exists in corporations. I don't have time and money to do that. – SmallChess Oct 24 '16 at 08:35
  • 2
    @StudentT: A former employer of mine - billion dollar plus turnover - settled a GPL case out of court, which was brought by an individual. It's fundamentally not a very complex lawsuit. The company cannot argue that they have a license (which?), they cannot argue they wrote the software themselves (they sent you your own source code!), so the copyright violation is a given. Getting the ball rolling might take a few letters; once you pay to file a suit you can start to look into recovering legal costs as well (this is a real additional threat; recovery is likely) – MSalters Oct 24 '16 at 23:13
  • @StudentT Your client probably doesn't want to go to court any more than you do. – user253751 Oct 25 '16 at 21:52
0

Note: The OP said in some comment that he does partly own the copy-right of the code questioned.

"NOTE: I'm 100% sure the seller isn't going to acknowledge his GPL commitment. It's a commercial software and he's selling it."

Sorry but this does not make any sense. Note that selling the software this is allowed under GPL https://www.gnu.org/philosophy/selling.html Probably it is worth reading https://www.gnu.org/philosophy/categories.html But it is of course bad style not share the money he is making and moreover, not even paying you for code review.

The question is does he ship his software under the GPL?

You said it is some app. I do not know how this then works. But putting the code (with license) in some online repository (could be only accessible to the paying customer) and linking to it should be allowed. At least I saw this with other GPL'ed apps (although I am no lawyer).

Question, are the GPL licenses headers in every file he sent you?
Is there maybe even the GPL copy right text as a file in it?

If this is both true then I see no problem, the code is under GPL and you can use it. If the license file is missing then this is bad style, but it should still be under the GPL (but again I am no lawyer). Tell him he needs to put license file in. Both of the answers to the last two questions are negative, then he does violate the GPL. You should tell him to get the copy-left right. And then resend you the files.

If he refuses then sue him.

ArtOfCode
  • 9,396
  • 2
  • 28
  • 70
GNU
  • 9
  • 1
  • You miss the point. The seller isn't going to acknowledge it, no matter what GPL license we can get on the Internet. The GPL headers are in some of the files. – SmallChess Oct 25 '16 at 11:55
  • I'm not a lawyer, but as far as I know, courts have been pretty reluctant to enforce "accidental licensing". That is to say, even if someone sent you their code with a GPL header attached, and even if the code was a derivative of GPLed code (and so they were legally forbidden from distributing the it except under the GPL), if it wasn't clear that they intended to release it under the GPL, a court would be more likely to find them in breach of copyright (due to violating the GPL) than to find that they had unintentionally GPLed their own code by distributing it. – Ilmari Karonen Oct 25 '16 at 12:38
  • 1
    ... That said, a simple way for the OP to settle that issue would be for them to email the "client" and ask if they really meant to distribute the code under the GPL. The OP might also want to note that, if the answer is "no" and they still keep distributing the app even after having the GPL requirements pointed out to them, that puts them in willful violation of the GPL, and allows the OP to sue them (or, say, assign their copyright to the FSF and let them handle the potential lawsuit) with a fair chance of winning. – Ilmari Karonen Oct 25 '16 at 12:46