[Sorry, this ended up being longer than I'd hoped.]
Quoting Simon Hobson (li...@thehobsons.co.uk): > Indeed. If you have the source then they can't stop you forking the > (GPL) project. Or if you have the complete, buildable source code under any other open source / free software licence. This subject comes up occasionally on the OSI licence-discuss mailing list as 'What is the central idea of open source?' My traditional answer is 'The right to fork, accompanied by the means to do so.' Which is to say, forking (the right and means to do it) is the _defining_ trait of open source. > There was one other thing that came to mind earlier ... > If ${company} decided to do that, and they had previously distributed > binaries ... doesn't the GPL mean they are required to provide the > sources to anyone they've distributed the binaries to ? This is going to be one of those difficult conversations where people keep wanting to rely on wording that implies incorrect concepts embedded in the culture of technogeeks that cause them to get points of law wrong. I'm going to try to explain this precisely as a legal matter. (Note: This is not advocacy. I'm going to explain how the law works, and how businesses interact with the law.) Your term 'required' is problematically vague. Required by whom? Or else what? (Typically open source people don't bother to think about that.) Exampleco, Ltd. is distributing binaries of a codebased issued under (say) GPLv2 licensing terms, and then at some point ceases offering matching source code to all recipients (or never provided any). This divides into two subcases, and the difference is important: Case A: Exampleco owns copyright title over all GPL-covered components of what is being distributed. Case B: At least some GPL-covered components are owned by a third party and are being redistributed by Exampleco. Ever since adoption of the Berne Convention treaty (and national legislation to implement it), copyright title has vested in the creator's ownership automatically at the moment of creation, and automatically reserves certain 'exclusive' rights to the owner by default, unless the owner conveys ('licenses') them out to recipients, attached to instances of the covered work. Exclusive rights applicable to software[0] are: o to make copies o to distribute copies o to create derivative works[1] (There are also what are termed 'moral rights of authors' in many countries including yours, but I'll not cover that here.) For example, USA Federal law enumerates these exclusive rights in 17 U.S.C. section 106, aka the Copyright Act: https://www.law.cornell.edu/uscode/text/17/106 Applicable UK statute law is the Copyright, Designs and Patents Act 1988 (CDPA): http://www.legislation.gov.uk/ukpga/1988/48 Exclusive rights are covered in Chapter II. The enumeration of exclusive rights implicitly creates what one might call an implied 'default licence': If I give you an instance of a program I wrote but state no conveyance of permissions, I am implicitly authorising your acquisition of the code. (What I mean, for example, is that if I list my code as a tarball on my Web site for public access, and you download it, I am implying that your download is authorised.) Your _use_ of the code is outside the scope of copyright law, so you don't need my permission to do so. By contrast, in that hypothetical, you haven't received any of my exclusive rights, so, e.g., your redistributing the program would be a tort (civil wrong), the tort of copyright violation. Torts are not crimes, but I as copyright owner could haul you into court and enjoin you from further distribution, and possibly be awarded monetary damages. Getting back to Exampleco, in Case A, Exampleco's right to distribute its binaries with or without matching source code is inherent and not subject to objection on copyright grounds, as each binary is an instance of a work Exampleco owns, and the firm is merely exercising an exclusive right. The firm is free to distribute code instances with any license attached to each instance it wishes, including ones such as GPLv2 that say it promises to make matching source available, without bothering to actually do the latter. That sort of distribution might be odd and erratic behaviour, but it doesn't infringe anyone's rights. In Case A, if you download Exampleco's program, read the docs and notices, and notice GPLv2 terms, you could attempt to demand the matching source code, _but_ if Exampleco then ignores you and doesn't comply, you would have no legal recourse, because Exampleco is not subject to any obligation: It doesn't _need_ permissions granted to it by GPLv2 or anything else. Its right to make brokenly packaged copies (or unbroken ones) is an exclusive right. Moving on to Case B: Here, Exampleco has acquired code created and owned by Otherco. Otherco as owner offered its work on, say, its otherco.co.uk Web site, and Exampleco downloaded it. As detailed above, at this point Exampleco is _not_ required by any legal obligation to accept any licence. It enjoys the benefit of Otherco's implied licence inherent in the download offering to the public. Therefore, its possession of the code instance is lawful, and it may _use_ the code without violating anyone's rights. _If_ Otherco had merely offered the code instance without conveying any of its exclusive rights, that would be all Exampleco could do without committing a tort. _However_, in this hypothetical, Otherco attached GPLv2 permissions. To paraphrase, GPLv2 states 'You _don't_ need to accept this license to possess and use this work. However, if you want access to my exclusive rights to create derivative works and redistribute, you must comply with the following conditions in sections 2 & 3.' Continuing the hypothetical, Exampleco either creates a derivative work based on Otherco's copyrighted material and distributes that, or merely redistributes Otherco's creation. Either way, Exampleco has just exercised one or two or Otherco's exclusive rights. Let us say that you receive the derivative work or redistributed copy as a binary from _either_ Exampleco or from any other place whatsoever.[2] You determine that Exampleco had been publishing the work at some time within the preceding three years. You request matching source code from Exampleco, politely citing its act of distribution and the wording of GPLv2 clause 3b. Is Exampleco committing a tort if it fails comply? Yes, but there's a subtle but vital point to note: Its tort is not against _you_. If you attempt to haul Exampleco into court on a tort of copyright violation, your suit will be dismissed for _lack of standing_, because you are not the owner of the work in question. On the other hand, Otherco _could_ successfully haul Exampleco into court and seek relief. Please note that Otherco could _not_ get the court to order Exampleco to give you source code (at least in courts in the UK, USA, Canada, Australia, NZ, and other places with English-derived legal systems[3]), because 'specific performance' is not a remedy available for the tort of copyright violation. Courts will grant relief in the form of ordering that unauthorised distribution _cease_ (e.g., order Exampleco to disable download), and may order payment of monetary damages. > So removing the sources from public repositories would actually be a > breach of the GPL (given some limitations regarding timing). Again, the phrase 'breach of the GPL' is slightly misleading wording. That treats GPL as if it were a statute. It is not a law: It is a licence conveying exclusive rights under copyright law, subject to the licensee complying with certain conditions. If the licensee fails to meet those conditions, then the licence is terminated (GPLv2 close 4 & 5). _If_ the erstwhile licensee then continues to exercise exclusive rights, then the owner of the relevant copyright title (but not third parties such as you as a software user) may bring civil litigation for a copyright tort. The above is admittedly very detailed and picky in going through the mechanics, but I was attempting to dispel some very common misconceptions, such as the implication that violating a copyright is in any way like a traffic violation ('breach', 'required') and the common misconception that users who are _not_ copyright owners may somehow seek redress in court. > And that raises an interesting problem for other people distributing > binaries. If (say) I were distributing binaries for ${foo} and relying > on (say) a git repository for providing the source - where would that > leave me if those git sources suddenly disappear ? If you're talking about GPLv2, then please see clause 3c. (I was the unofficial software-licensing at VA Linux Systems, Inc. Note: I am not a lawyer, let alone _your_ lawyer. Accordingly, this is not legal advice, as witnessed by the fact that my name doesn't say 'Esq.' after it, and also that this posting isn't accompanied by a large bill. If anyone here has a specific legal situation needing advice, consult a qualified attorney and don't rely on mailing list postings.) [0] Software is covered by 'literary works', believe it or not. Other categories such as musical performances, dramatic, and choreographic works, pantomimes, and pictorial, graphic, or sculptural works reserve to their creator two additional rights: the right of public display and the right to perform. For USA details as an example, see http://www.bitlaw.com/copyright/scope.html . (In theory, actually, there's a right to perform that's applicable to software, but there's been no caselaw to clarify what that means.) [1] Because Linus Torvalds has frequently used the term 'derived work', many Linux people opt for that phrase, but the correct term from copyright law (within the English language) is 'derivative work'. [2] Exampleco is _not_, contrary to your upthread claim, obliged under GPLv2 clause 3b to furnish matching source only to people who've received binaries from Exampleco. Exampleco's licence obligation is invocable by 'any third party, for a charge no more than your cost of physically performing source distribution'. [3] Other groups of contries such as those using national legal systems based on the Napoleonic Code, like most of Europe, probably differ in the details of this. _______________________________________________ Dng mailing list Dng@lists.dyne.org https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng