Such a situation often requires use of a tool to ``catch up'' your knowledge

about what software your product includes.  Most commonly, companies choose

some software licensing scanning tool to inspect the codebase.  However,

there are few tools that are themselves Free Software.  Thus, GPL enforcers

usually recommend the GPL'd

\href{http://fossology.org/}{Fossology system}, which analyzes a

source code base and produces a list of Free Software licenses that may apply to

the code.  Fossology can help you build a catalog of the sources you have

already used to build your product.  You can then expand that into a more

structured inventory and process.

\section{Track Your Changes and Releases}

As explained in further detail below, the most important component of GPL

compliance is the one most often ignored: proper inclusion of CCS in all

distributions  of GPL'd

software.  To comply with GPL's CCS requirements, the distributor

\textit{must} always know precisely what sources generated a given binary

distribution.

In an unfortunately large number of our enforcement cases, the violating

company's engineering team had difficulty reconstructing the CCS

for binaries distributed by the company.  Here are three simple rules to

\begin{itemize}

\item Ensure that your

developers are using revision control systems properly.

\item Have developers mark or ``tag'' the full source tree corresponding to

  builds distributed to customers

\item Check that your developers store all parts of the software

development in the revision control system, including {\sc readme}s, build

scripts, engineers' notes, and documentation.

\end{itemize}

Your developers will benefit anyway from these rules.  Developers will be

happier in their jobs if their tools already track the precise version of

source that corresponds to any deployed binary.

\section{Avoid the ``Build Guru''}

Too many software projects rely on only one or a very few team members who

know how to build and assemble the final released product.  Such knowledge

centralization not only creates engineering redundancy issues, but also

thwarts GPL compliance.  Specifically, CCS does not just require source code,

GPLv2~\S8 is rarely used by copyright holders.  Its intention is that if a

particular country, say Unfreedonia, grants particular patents or allows

copyrighted interfaces (no country to our knowledge even permits those

yet), that the GPLv2'd software can continue in free and unabated

distribution in the countries where such controls do not exist.

As far as is currently known, GPLv2~\S8 has very rarely been formally used by

copyright holders.  Admittedly, some have used GPLv2~\S8 to explain various

odd special topics of distribution (usually related in some way to

GPLv2~\S7).  However, generally speaking, this section is not proven

particularly useful in the more than two decades of GPLv2 history.

Meanwhile, despite many calls by the FSF (and others) for those licensors who

explicitly use this section to come forward and explain their reasoning, no

one ever did.  Furthermore, research conducted during the GPLv3 drafting

process found exactly one licensor who had invoked this section to add an

explicit geographical distribution limitation, and the reasoning for that one

invocation was not fitting with FSF's intended spirit of GPLv2~\S8.  As such,

GPLv2~\S8 was not included at all in GPLv3.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\chapter{Odds, Ends, and Absolutely No Warranty}

GPLv2~\S\S0--7 constitute the freedom-defending terms of the GPLv2.  The remainder

liability.

\section{GPLv2~\S9: FSF as Stewards of GPL}

\label{GPLv2s9}

FSF reserves the exclusive right to publish future versions of the GPL\@;

GPLv2~\S9 expresses this.  While the stewardship of the copyrights on the body

of GPL'd software around the world is shared among thousands of

individuals and organizations, the license itself needs a single steward.

Forking of the code is often regrettable but basically innocuous.  Forking

of licensing is disastrous.

(Chapter~\ref{tale-of-two-copylefts} discusses more about the various

versions of GPL.)

\section{GPLv2~\S10: Relicensing Permitted}

\label{GPLv2s10}

GPLv2~\S10 reminds the licensee of what is already implied by the nature of

copyright law.  Namely, the copyright holder of a particular software

program has the prerogative to grant alternative agreements under separate

copyright licenses.

\section{GPLv2~\S11: No Warranty}

Ideally, this contributor patent policy will result in fairly frequent licensing of patent

claims by contributors.  A contributor is charged with awareness of the fact

that it has modified a work and provided it to others; no act of contribution

should be treated as inadvertent.  GPLv3's rule also requires no more work, for a

contributor, than the weaker rule proposed by the patent holders.  Under

their rule, the contributor must always compare the entire work against its

patent portfolio to determine whether the combination of the modifications

with the remainder of the work cause it to read on any of the contributor's

patent claims.

\subsection{Conveyors' Patent Licensing}

The remaining patent licensing in GPLv3 deals with patent licenses that are

granted by conveyance.  The licensing is not as complete or far reaching as

the contributor patent licenses discussed in the preceding section.

The term ``patent license,'' as used in GPLv3~\S11\P4--6, is not meant to be

confined to agreements formally identified or classified as patent licenses.

GPLv3~\S11\P3  makes this clear by defining ``patent

license,'' for purposes of the subsequent three paragraphs, as ``any express

agreement or commitment, however denominated, not to enforce a patent

(such as an express permission to practice a patent or covenant not to

sue for patent infringement)''

% The definition does not include patent licenses that arise by

% implication or operation of law, because the third through fifth paragraphs

% of section 11 are specifically concerned with explicit promises that purport

% to be legally enforceable.

GPLv3~\S11\P5 is commonly called GPLv3's downstream shielding provision.  It

responds particularly to the problem of exclusive deals between patent

holders and distributors, which threaten to distort the free software

distribution system in a manner adverse to developers and users.  The

fundamental idea is to make a trade-off between assuring a patent license for

downstream and making  (possibly patent-encumbered) CCS publicly available.

Simply put, in nearly all cases in which the ``knowingly relying'' test is

met, the patent license will indeed not be sublicensable or generally

available to all on free terms.  If, on the other hand, the patent license is

generally available under terms consistent with the requirements of the GPL,

the distributor is automatically in compliance, because the patent license

has already been extended to all downstream recipients.  Finally, if the

patent license is sublicensable on GPL-consistent terms, the distributor may

choose to grant sublicenses to downstream recipients instead of causing the

CCS to be publicly available.  (In such a case, if the distributor is also a

contributor, it will already have granted a patent sublicense anyway, and so

it need not do anything further to comply with the third paragraph.)