copyright laws of some countries, it may be necessary for a copyright license

to include an explicit provision setting forth the duration of the rights

being granted. In other countries, including the USA, such a provision is

unnecessary but permissible.

GPLv3~\S2\P1 also acknowledges that licensees under the GPL enjoy rights of

copyright fair use, or the equivalent under applicable law.  These rights are

compatible with, and not in conflict with, the freedoms that the GPL seeks to

protect, and the GPL cannot and should not restrict them.

However, note that (sadly to some copyleft advocates) the unlimited freedom

to run is confined to the \textit{unmodified} Program.  This confinement is

unfortunately necessary since Programs that do not qualify as a User Product

in GPLv3~\S6 (see \S~\ref{user-product} in this tutorial) might have certain

unfortunate restrictions on the freedom to run\footnote{See

  \S~ref{freedom-to-run} of this tutorial for the details on ``the freedom to

  run''.}

GPLv3~\S2\P2 distinguishes between activities of a licensee that are

permitted without limitation and activities that trigger additional

requirements.  Specifically, GPLv3~\S2\P2 guarantees the basic freedoms of

privately modifying and running the program.

Also, GPLv3~\S2\P2 gives an explicit permission for a client to provide a

copy of its modified software to a contractor exclusively for that contractor

to modify it further, or run it, on behalf of the client.  However, the

client can \textit{only} exercise this control over its own copyrighted

changes to the GPL-covered program.  The parts of the program it obtained

from other contributors must be provided to the contractor with the usual GPL

freedoms.  Thus, GPLv3 permits users to convey covered works to contractors

operating exclusively on the users' behalf, under the users' direction and

control, and to require the contractors to keep the users' copyrighted

changes confidential, but \textit{only if} the contractor is limited to acting

on the users' behalf (just as the users' employees would have to act).

The strict conditions in this ``contractors provision'' are needed so that it

cannot be twisted to fit other activities, such as making a program available

to downstream users or customers.  By making the limits on this provision

very narrow, GPLv3 ensures that, in all other cases, contractors gets the

full freedoms of the GPL that they deserve.

GPLv3~\S2's final paragraph includes an explicit prohibition of sublicensing.

This provision ensures that GPL enforcement is always by the copyright

holder.  Usually, sublicensing is regarded as a practical convenience or

necessity for the licensee, to avoid having to negotiate a license with each

licensor in a chain of distribution.  The GPL solves this problem in another

way --- through its automatic licensing provision found in GPLv3\~S10 (which

is discussed in more detail in \S\~ref{GPLv3s10} of this tutorial).

\section{GPLv3's views on DRM and Device Lock-Down}

\label{GPLv3-drm}

The issues of DRM, device lock-down and encryption key disclosure were the

most hotly debated during the GPLv3 process.  FSF's views on this were sadly

frequently misunderstood and, comparing the provisions related to these

issues in the earliest drafts of GPLv3 to  the final version of GPLv3 shows

the FSF's willingness to compromise on tactical issues to reach the larger

goal of software freedom.

Specifically, GPLv3 introduced provisions that respond to the growing

practice of distributing GPL-covered programs in devices that employ

technical means to restrict users from installing and running modified

versions.  This practice thwarts the expectations of developers and users

alike, because the right to modify is one of the core freedoms the GPL is

designed to secure.

Technological measures to defeat users' rights.  These measures are often

described by such Orwellian phrases, such as ``digital rights management,''

which actually means limitation or outright destruction of users' legal

rights, or ``trusted computing,'' which actually means selling people

computers they cannot trust.  However, these measures are alike in one basic

respect.  They all employ technical means to turn the system of copyright law

(where the powers of the copyright holder are limited exceptions to general

freedom) into a virtual prison, where everything not specifically permitted

is utterly forbidden.  This system of ``para-copyright'' was created well

after GPLv2 was written --- initially through legislation in the USA and the

EU, and later in other jurisdictions as well.  This legislation creates

serious civil or even criminal penalties to escape from these restrictions

(commonly and aptly called ``jail-breaking a device''), even where the

purpose in doing so is to restore the users' legal rights that the technology

wrongfully prevents them from exercising.

GPLv2 did not address the use of technical measures to take back the rights

that the GPL granted, because such measures did not exist in 1991, and would

have been irrelevant to the forms in which software was then delivered to

users.  GPLv3 addresses these issues, particularly because copylefted

software is ever more widely embedded in devices that impose technical

limitations on the user's freedom to change it.

However, FSF always made a clear distinction to avoid conflating these

``lock-down'' measures with legitimate applications that give users control,

as by enabling them to choose higher levels of system or data security within

their networks, or by allowing them to protect the security of their

communications using keys they can generate or copy to other devices for

sending or receiving messages.  Such technologies present no obstacles to

software freedom and the goals of copyleft.

The public GPLv3 drafting process sought to balance these positions of

copyleft advocates with various desperate views of the larger

Free-Software-using community.  Ultimately, FSF compromised to the GPLv3\S3

and GPLv3\S6 provisions that, taken together, are a minimalist set of terms

sufficient to protect the software freedom against the threat of invasive

para-copyright.

The compromises made were ultimately quite reasonable.  The primary one is

embodied in GPLv3\S6's ``User Product'' definition (see \S~\ref{user-product}

in this tutorial for details).  Additionally, some readers of early GPLv3

drafts seem to have assumed GPLv3 contained a blanket prohibition on DRM; but

it does not.  In fact, no part of GPLv3 forbids DRM regarding non-GPL'd

works; rather, GPLv3 forbids the use of DRM specifically to lock-down

restrictions on users' ability to install modified versions of the GPL'd

software itself, but again, \textit{only} with regard to User Products.

Large enterprise users of free software often contract with non-employee

developers, often working offsite, to make modifications intended for

the user's private or internal use, and often arrange with other

companies to operate their data centers.  Whether GPLv2 permits these

activities is not clear and may depend on variations in copyright law.

The practices seem basically harmless, so we have decided to make it

clear they are permitted.

\section{GPLv3~\S3: What Hath DMCA Wrought}

\label{GPLv3s3}

As discussed in \S~\ref{software-and-non-copyright} of this tutorial,

\href{http://www.law.cornell.edu/uscode/text/17/1201}{17 USC~\S1201} and

relate sections\footnote{These sections of the USC are often referred to as

  the ``Digital Millennium Copyright Act'', or ``DMCA'', as that was the name

  of the bill that so-modified these sections of the USC\@.} prohibits users

from circumventing technological measures that implement DRM\@.  Since this

is part of copyright law and the GPL is primarily a copyright license, and

since what the DMCA calls ``circumvention'' is simply ``modifying the

software'' under the GPL, GPLv3 must disclaim such anti-circumvention

provisions are not applicable to the GPLv3'd software.  GPLv3\S3 shields

users from being subjected to liability under anti-circumvention law for

exercising their rights under the GPL, so far as the GPL can do so.

First, GPLv3\S3\P1 declares that no GPL'd program is part of an effective

technological protection measure, regardless of what the program does.  Early

drafts of GPLv3\S3\P1 referred directly to the DMCA, but the final version

instead includes instead an international legal reference to

anticircumvention laws enacted pursuant to the 1996 WIPO treaty and any

similar laws.  Lawyers outside the USA worried that a USA statutory reference

could be read as indicating a choice for application of USA law to the

license as a whole.  While the FSF did not necessarily agree with that view,

the FSF decided anyway to refer to the WIPO treaty rather than DMCA, since

several national anticircumvention laws were (or will likely be) structured

more similarly to the anticircumvention provisions of the DMCA in their

implementation of WIPO\@.  Furthermore, the addition of ``or similar laws''

provides an appropriate catch-all.

Furthermore, GPLv3\S3\P2 states precisely that a conveying party waives the

power to forbid circumvention of technological measures only to the extent

that such circumvention is accomplished through the exercise of GPL rights in

the conveyed work.  GPLv3\S3\P2 makes clear that the referenced ``legal

rights'' are specifically rights arising under anticircumvention law.  and

refers to both the conveying party's rights and to third party rights, as in

some cases the conveying party will also be the party legally empowered to

enforce or invoke rights arising under anticircumvention law.

These disclaimers by each licensor of any intention to use GPL'd software to

stringently control access to other copyrighted works should effectively

prevent any private or public parties from invoking DMCA-like laws against

users who escape technical restriction measures implemented by GPL'd

software.

\section{GPLv3~\S4: Verbatim Copying}

\label{GPLv3s4}

GPLv3~\S4 is a revision of GPLv2\~S1 (as discussed in \S~\ref{GPLv2s1} of

this tutorial).   There is almost no changes to this section from the

GPLv2\~S1, other than to use the new defined terms.

The only notable change of ``a fee'' to ``any price or no price'' in the

first sentence of GPLv3\S4\P2.  The GPLv2\S1\P1 means that the GPL permits

one to charge money for the distribution of software.  Despite efforts by

copyleft advocates to explain this in GPLv2 itself and in other documents,

there are evidently some people who still believe that GPLv2 allows charging

for services but not for selling copies of software and/or that the GPL

requires downloads to be gratis.  Perhaps this is because GPLv2 referred to

charging a ``fee''; the term ``fee'' is generally used in connection with

services.

GPLv2's wording also referred to ``the physical act of transferring.''  The

intention was to distinguish charging for transfers from attempts to impose

licensing fees on all third parties.  ``Physical'' might be read, however, as

suggesting ``distribution in a physical medium only''.

To address these two issues, GPLv3 says ``price'' in place of ``fee,'' and

removes the term ``physical.''

% FIXME: needs context, needs match up to current text, and removal of stuff

%        that's no longer there

% FIXME: say more and tie it to the text

There is no harm in explicitly pointing out what ought to be obvious: that

those who convey GPL-covered software may offer commercial services for the

support of that software.

\section{GPLv3~\S5: Modified Source}

\label{GPLv3s5}

% FIXME: 5(a) is slightly different in final version

Section 5 contains a number of changes relative to the corresponding section

in GPLv2. Subsection 5a slightly relaxes the requirements regarding notice of

changes to the program. In particular, the modified files themselves need no

longer be marked. This reduces administrative burdens for developers of

modified versions of GPL'd software.

Under subsection 5a, as in the corresponding provision of GPLv2, the notices

must state ``the date of any change,'' which we interpret to mean the date of

one or more of the licensee's changes.  The best practice would be to include

the date of the latest change.  However, in order to avoid requiring revision

of programs distributed under ``GPL version 2 or later,'' we have retained

the existing wording.

% FIXME:  It's now (b) and (c).  Also, ``validity'' of proprietary

%         relicensing?  Give me a break.  I'll fix that.

Subsection 5b is the central copyleft provision of the license.  It now

states that the GPL applies to the whole of the work.  The license must be

unmodified, except as permitted by section 7, which allows GPL'd code to be

combined with parts covered by certain other kinds of free software licensing

terms. Another change in subsection 5b is the removal of the words ``at no

charge,'' which was often misinterpreted by commentators.  The last sentence

of subsection 5b explicitly recognizes the validity of disjunctive

dual-licensing.

%  FIXME: 5d.  Related to Appropriatey Legal notices

% follows 5d now, call it the ``final paragraph''

The paragraph following subsection 5c has been revised for clarity, but the

underlying meaning is unchanged. When independent non-derivative sections are

distributed for use in a combination that is a covered work, the whole of the

combination must be licensed under the GPL, regardless of the form in which

such combination occurs, including combination by dynamic linking. The final

sentence of the paragraph adapts this requirement to the new compatibility

provisions of section 7.

We have added these words to the aggregation clause to eliminate any question

that GPLv3 alters the scope of the copyleft as understood and applied under

GPLv2. In GPLv3, as in GPLv2, addition of modules or other parts to a program

results in a new program based on the old program, with different functional

characteristics created by the merger of two expressions: the original

program and the added parts.  Such added parts are ``by their nature

extensions of'' the old program, and therefore the entire new program which

they and the old program form must be licensed under the GPL.  As subsection

5c states, packaging of a work has no bearing on the scope of copyleft.

\section{GPLv3~\S6: Non-Source and Corresponding Source}

\label{GPLv3s6}

Section 6 of GPLv3, which clarifies and revises GPLv2 section 3, requires

distributors of GPL'd object code to provide access to the corresponding

source code, in one of four specified ways. As noted above, ``object code''

in GPLv3 is defined broadly to mean any non-source version of a work.

% FIXME:  probably mostly still right, needs some updates, though.

Subsections 6a and 6b now apply specifically to distribution of object code

in a physical product. Physical products include embedded systems, as well as

physical software distribution media such as CDs. As in GPLv2, the

distribution of object code may either be accompanied by the machine-readable

source code, or it may be accompanied by a written offer to provide the

machine-readable source code to any third party. GPLv3 clarifies that the

medium for software interchange on which the machine-readable source code is

provided must be a durable physical medium. Subsection 6b does not prevent a

distributor from offering to provide source code to a third party by some

other means, such as transmission over a network, so long as the option of

obtaining source code on a physical medium is presented.

% FIXME:  probably mostly still right, needs some updates, though.

Subsection 6b revises the requirements for the written offer to provide

source code. As before, the offer must remain valid for at least three

years. In addition, even after three years, a distributor of a product

containing GPL'd object code must offer to provide source code for as long as

the distributor also continues to offer spare parts or customer support for

the product model. We believe that this is a reasonable and appropriate

requirement; a distributor should be prepared to provide source code if he or

she is prepared to provide support for other aspects of a physical product.

% FIXME: 10x language is gone.

Subsection 6b also increases the maximum permitted price for providing a copy

of the source code. GPLv2 stated that the price could be no more than the

cost of physically performing source distribution; GPLv3 allows the price to

be up to ten times the distributor's cost. It may not be practical to expect

some organizations to provide such copies at cost. Moreover, permitting such

organizations to charge ten times the cost is not particularly harmful, since

some recipient of the code can be expected to make the code freely available

on a public network server. We also recognize that there is nothing wrong

with profiting from providing copies of source code, provided that the price

of a copy is not so unreasonably high as to make it effectively unavailable.

% FIXME:  probably mostly still right, needs some updates, though.

Subsection 6c gives narrower permission than the corresponding subsection in

GPLv2.  The option of including a copy of an offer received in accordance

with subsection 6b is available only for private distribution of object code;

moreover, such private distribution is restricted to ``occasional

non-commercial distribution.''  This subsection makes clear that a

distributor cannot comply with the GPL merely by making object code available

on a publicly-accessible network server accompanied by a copy of the written

offer to provide source code received from an upstream distributor.

% FIXME:  probably mostly still right, needs some updates, though.

New subsection 6d, which revises the final paragraph of GPLv2 section 3,

addresses distribution of object code by offering access to copy the code

from a designated place, such as by enabling electronic access to a network

server.  Subsection 6d clarifies that the distributor must offer equivalent

access to copy the source code ``in the same way through the same place.''

This wording permits a distributor to offer a third party access to both

object code and source code on a single network portal or web page, even

though the access may include links to different physical servers.  For

example, a downstream distributor may provide a link to an upstream

distributor's server and arrange with the operator of that server to keep the

source code available for copying for as long as the downstream distributor

enables access to the object code.  This codifies what has been our

interpretation of GPLv2.

% FIXME: where should this go?

We improved the wording of this sentence to provide a clearer expression of

the intended policy.  Under the 6d option, you may charge for the conveyed

object code. Those who pay to obtain the object code must be given equivalent

and gratis access to obtain the Corresponding Source.  (If you convey the

object code to them gratis, you must likewise make the Corresponding Source

available to them without charge.) Those who do not obtain the object code

from you, perhaps because they choose not to pay the fee you charge, are

outside the scope of the provision; you need not give them any kind of access

to the Corresponding Source.

%FIXME: 6e, peer-to-peer

Informing the peers is clearly enough; what seemed to be an additional

knowledge requirement was superfluous wording.

%  FIXME: Not final paragraph anymore. 

The final paragraph of section 6 takes account of the fact that the Complete

Corresponding Source Code may include added parts that carry non-GPL terms,

as permitted by section 7.

% FIXME: update lock-down section to work with more recent drafts

Though the definition of Complete Corresponding Source Code in the second

paragraph of section 1 is expansive, it is not sufficient to protect users'

freedoms in many circumstances. For example, a GPL'd program, or a modified

version of such a program, might need to be signed with a key or authorized

with a code in order for it to run on a particular machine and function

properly. Similarly, a program that produces digitally-restricted files might

require a decryption code in order to read the output.

The third paragraph of section 1 addresses this problem by making clear that

Complete Corresponding Source Code includes any such encryption,

authorization, and decryption codes. By requiring the inclusion of this

information whenever the GPL requires distribution of Complete Corresponding

Source Code, we thwart efforts to obstruct the goals of the GPL, and we

ensure that users will remain in control over their own machines. We

recognize an exception where use of the program normally implies that the

user already has the codes. For example, in secure systems a computer owner

might possess any keys needed to run a program, while the distributor of the

program might not have the keys.

% FIXME: installation information??

% FIXME: perhaps this additional information isn't needed, next 3 paras, but

%        there might be something good here

Another major goal for GPLv3 has been to thwart technical measures such as

signature checks in hardware to prevent modification of GPLed software on a

device.  Previous drafts attempted to accomplish this by defining

"Corresponding Source" to include any encryption or authorization keys

necessary to install new versions of the software.  A number of members of