# Contributions Welcome!

The maintainers of this Copyleft Guide project encourage contribution from

the community.  Part of the impetus for this project was to create a

community around a "copyleft codebase" for information about copyleft.  In

other words, this project is a tutorial project about Copyleft that is like a

Free Software project.

## Who Is In Charge?

Currently, [Bradley M. Kuhn](http://ebb.org/bkuhn/) is the editor-in-chief of

this Guide project.  However, many other contributors have given patches and

improvements to the text.  Review the

[commit log in the Git repository](https://gitorious.org/copyleft-org/tutorial/commits/master)

for more details on who has contributed to the project.

## How Do I Get Involved?

The Guide is maintained in a copylefted distributed version control system called

[Git](http://git-scm.com/).  Currently, the project utilizes the services of

a  Git hosting website called [Gitorious](https://gitorious.org). (The

software which runs Gitorious is, itself, copylefted, too.)

Those who are comfortable with Gitorious can submit

[merge requests on copyleft.org's gitorious site](https://gitorious.org/copyleft-org/tutorial/merge_requests).

See the section "Merge Request and Patch Workflow" below for more information

on the details of doing that.

However, lack of Git and/or LaTeX knowledge is *not a barrier* for

contribution to this project.  Useful contributions will be accepted by the

following means as well:

  * Patches posted to

    [the mailing list](http://lists.copyleft.org/cgi-bin/mailman/listinfo/discuss).

  * New sections of text or simply ideas and input emailed to

    [the mailing list](http://lists.copyleft.org/cgi-bin/mailman/listinfo/discuss).

  * Ideas and suggestions mentioned on the

    [irc channel #copyleft on freenode](irc://irc.freenode.net/#copyleft).

Please, do not worry if your patches or new sections of text are not properly

formatted as patches and/or are not formatted in LaTeX properly.  Indeed,

feel free to offer patches that break LaTeX formatting, or to just write up

your suggestion in an email.  If the content is appropriate for the Guide,

the editor-in-chief or someone else will format your contribution properly

for LaTeX.

Note: by submitting contributions via any of these means, you agree to the

"Author's Certificate of Origin" (see below).

## How Do I Figure Out What To Contribute?

If you're looking for something to fix, just grep the *.tex files for "FIXME"

and you'll find plenty.  Many of them are simple and easy to do.  Some of

them are writing, and some of them are simply formatting-related.

If you want a larger, more involved writing project, take a look at the

[TODO list in this repository](TODO.md).  That list has bigger items that

other contributors have identified as necessary.  (BTW, the project

contributors are considering various possible copylefted bug-tracking

solutions, but admittedly haven't picked a bug-tracker yet.)

There is also a [TODO list on the website](https://copyleft.org/todo/), which

are mostly related to formatting, layout and infrastructure, but if you'd

like to help there, such help is also welcome.

## Merge Request and Patch Workflow

Currently, the main location for work on this project is

[on Gitorious](https://gitorious.org/copyleft-org/tutorial), and active new

development on the project happens on the

['next' branch](https://gitorious.org/copyleft-org/tutorial/source/next:)

(which is

[auto-published on the copyleft.org/guide-next URL](https://copyleft.org/guide-next/)).

Here is a suggested workflow for submitting patches — first doing so

*with* the Gitorious infrastructure, second *avoiding* the Gitorious

infrastructure but still using Git, and third avoiding Git altogether.

Merge requests and/or patches against

['next' branch](https://gitorious.org/copyleft-org/tutorial/source/next:) are

typically much preferred, and the workflow explanations below assume that.

However, merge requests and/or patches against

['master' branch](https://gitorious.org/copyleft-org/tutorial/source/master:)

are not necessarily rejected.  In fact, if your change is a fix for typo,

spelling, grammar, formatting or anything urgent, submitting a patch against

'master' may make more sense.

To use the instructions below for proposals against the 'master' branch, just

replace 'next' everywhere below with 'master'.

### Contributing via Gitorious

First-time contributors may want to do the following four items first:

0. [Create an account on Gitorious](https://gitorious.org/users/new)

1. [Visit gitorious.org/copyleft-org/tutorial](https://gitorious.org/copyleft-org/tutorial)

    and click "Clone".

    Instead of the default, you might call your clone

    "MYNAME-copyleft-tutorial-suggestions".

2. On the command line create a *local* clone of your Clone, by typing:

        $ git clone git@gitorious.org:copyleft-org/MYNAME-copyleft-tutorial-suggestions.git copyleft-tutorial

        $ cd copyleft-tutorial

        $ git remote rename origin MYNAME-copyleft-tutorial-suggestions

    (The last part isn't strictly necessary; you just might want to name the

    upstream repository a more descriptive name, since below you'll add the

    official repository as well).

3. Now, add to your clone a copy of the "real" Conservancy policies

   repository, and make a branch that tracks the official version:

        $ git remote add copyleft-tutorial-official git@gitorious.org:copyleft-org/tutorial.git

        $ git fetch copyleft-tutorial-official

        $ git branch --track official-next copyleft-tutorial-official/next

That completes the first-time setup.  Next is a workflow each proposed merge

request.

0. First, ensure the Git repository points at the right branch and all old

   changes are committed.

        $ git status

   The output of the last command should look like this:

        # On branch SOME_BRANCH

        nothing to commit (working directory clean)

   If you don't get that output, you probably have uncommitted changes from

   some other situation, which is beyond the scope of this document.

1. Now, get the most recent version of the 'next' branch:

        $ git checkout master

        $ git branch -D official-next

        $ git fetch copyleft-tutorial-official

        $ git branch --track official-next copyleft-tutorial-official/next

        $ git checkout official-next

        $ git pull

   (This step is more complicated than is typically found in a tutorial like

   this.  Experienced Git users will note the above is the easiest way to

   handle the fact that the 'next' branch is occasionally rebased against

   master.  If 'next' branch has not been rebased since the last time the

   operation was performed, the last two commands suffice for this step.)

1. Next, create a new branch to hold your changes:

        $ git checkout -b my-new-idea-for-tutorial official-next

   Use a name that briefly describes your planned proposal for

   "my-new-idea-for-tutorial".

2. Make your edits.  If you're editing the tutorial, you likely want to focus

   on the files ending in '.tex'.  Commit frequently while you're editing

   with:

        $ git commit -a

   Write useful and clear commit messages that explain the purpose of the

   changes.

3. When you are done all the changes related to 'my-new-idea-for-tutorial',

   verify they've all been committed this way:

        $ git status

        # On branch my-new-idea-for-tutorial

        nothing to commit (working directory clean)

4. Next, upload and publish those ideas to your own clone on Gitorious.

        $ git push MYNAME-copyleft-tutorial-suggestions my-new-idea-for-tutorial

    That's the end of the command-line part.

5. Now, visit Gitorious' merge-request creation web interface at

   https://gitorious.org/copyleft-org/MYNAME-copyleft-tutorial-suggestions/merge_requests/new

   Initiate your merge request with by setting:

        Summary:       Briefly describe your proposal

        Description:   More completely describe your proposal

        Target:        tutorial

        Target Branch: next

        Source Branch: my-new-idea-for-tutorial

6. While it's possible to discuss the details of the merge request via the

   web interface, for larger changes, it may be worthwhile to start a thread

   on

   [the mailing list](http://lists.copyleft.org/cgi-bin/mailman/listinfo/discuss)

   about the merge request.  Include the URL of the merge request in the

   post.

# Makefile for Copyleft Tutorial                      -*- GNUMakefile -*-

ifndef BOOK_BASE

BOOK_BASE=comprehensive-gpl-guide

endif

ifndef WEB_INSTALL_DIR

WEB_INSTALL_DIR = /path/to/html/install/directory

endif

BOOK_CLASS_FILE = gpl-book.cls

CSS_FILES = css/*.css

JAVASCRIPT_FILES = js/*.js

WEB_CONFIG_FILE = webhacks.cfg

HTML_OUTPUT_DIR = public_html

TEX4HT=tex4ht

T4HT=t4ht

HTLATEX=htlatex

PDFLATEX = pdflatex

LATEX = latex

BIBTEX = bibtex

FIG2DEV = fig2dev

DVIPS=dvips

all:	err $(BOOK_BASE).pdf $(BOOK_BASE).ps html

pdf:	err $(BOOK_BASE).pdf

html:	$(HTML_OUTPUT_DIR)/monolithic/$(BOOK_BASE).html $(HTML_OUTPUT_DIR)/$(BOOK_BASE).html pdf $(BOOK_BASE).ps jscssmonolitic jscss

	/bin/ln -f $(BOOK_BASE).ps $(HTML_OUTPUT_DIR)/$(BOOK_BASE).ps

	/bin/ln -f $(BOOK_BASE).pdf $(HTML_OUTPUT_DIR)/$(BOOK_BASE).pdf

.SUFFIXES: .fig .postscript .eps .pdf .pstex_t .pstex .ps .dvi .tex

.postscript.pdf:

	ps2pdf $< $@

.postscript.eps:

	ps2epsi $< $@

.dvi.ps:

	$(DVIPS) $< -o $@

.tex.dvi:

	$(LATEX) $<

.fig.pdf:

	$(FIG2DEV) -L pdf -p "portrait" -c $< > $@

.fig.pstex_t:

	$(FIG2DEV) -L pstex_t $< > $@

.fig.pstex:

	$(FIG2DEV) -L pstex $< > $@

$(BOOK_BASE).pdf: $(PDF_FIGS) $(LATEX_INPUT_FILES)

	$(PDFLATEX) $(BOOK_BASE)

	$(PDFLATEX) $(BOOK_BASE)

	$(PDFLATEX) $(BOOK_BASE)

$(HTML_OUTPUT_DIR)/monolithic/$(BOOK_BASE).html: $(LATEX_INPUT_FILES) $(WEB_CONFIG_FILE)

	mkdir -p $(HTML_OUTPUT_DIR)/monolithic/js

	mkdir -p $(HTML_OUTPUT_DIR)/monolithic/css

	/bin/rm -f $(BOOK_BASE)*.html

	/bin/rm -f $(BOOK_BASE)*.js

	$(HTLATEX) comprehensive-gpl-guide.tex "webhacks,xhtml,mouseover,fn-in,monolith"

	$(HTLATEX) comprehensive-gpl-guide.tex "webhacks,xhtml,mouseover,fn-in,monolith"

	mv ${BOOK_BASE}*js $(HTML_OUTPUT_DIR)/monolithic/js

	/bin/rm -f $(BOOK_BASE)*.html

	/bin/rm -f $(BOOK_BASE)*.js

	$(HTLATEX) comprehensive-gpl-guide.tex "webhacks,xhtml,fn-in,monolith"

	mv $(BOOK_BASE)*html $(HTML_OUTPUT_DIR)/monolithic

	mv cm*png $(HTML_OUTPUT_DIR)/monolithic

	mv ${BOOK_BASE}*css $(HTML_OUTPUT_DIR)/monolithic

	/bin/rm -f ${BOOK_BASE}*aux ${BOOK_BASE}*dvi ${BOOK_BASE}*idv ${BOOK_BASE}*lg ${BOOK_BASE}*tmp ${BOOK_BASE}*4ct ${BOOK_BASE}*4tc ${BOOK_BASE}*toc ${BOOK_BASE}*out ${BOOK_BASE}*xref

jscssmonolitic: $(CSS_FILES) $(JAVASCRIPT_FILES)

	cp -pa js/*js $(HTML_OUTPUT_DIR)/monolithic/js

	cp -pa css/*css $(HTML_OUTPUT_DIR)/monolithic/css

$(HTML_OUTPUT_DIR)/$(BOOK_BASE).html: $(LATEX_INPUT_FILES)  $(WEB_CONFIG_FILE)

	mkdir -p $(HTML_OUTPUT_DIR)/js

	mkdir -p $(HTML_OUTPUT_DIR)/css

	/bin/rm -f $(BOOK_BASE)*.html

	/bin/rm -f $(BOOK_BASE)*.js

	$(HTLATEX) comprehensive-gpl-guide.tex "webhacks,xhtml,2,next,mouseover,fn-in"

	mv ${BOOK_BASE}*js $(HTML_OUTPUT_DIR)/js

	/bin/rm -f $(BOOK_BASE)*.html

	/bin/rm -f $(BOOK_BASE)*.js

	$(HTLATEX) comprehensive-gpl-guide.tex "webhacks,2,next,fn-in"

	mv ${BOOK_BASE}*css $(HTML_OUTPUT_DIR)

	mv ${BOOK_BASE}*html $(HTML_OUTPUT_DIR)

	mv cm*png $(HTML_OUTPUT_DIR)

	/bin/rm -f ${BOOK_BASE}*aux ${BOOK_BASE}*dvi ${BOOK_BASE}*idv ${BOOK_BASE}*lg ${BOOK_BASE}*tmp ${BOOK_BASE}*4ct ${BOOK_BASE}*4tc ${BOOK_BASE}*toc ${BOOK_BASE}*out ${BOOK_BASE}*xref

jscss: $(CSS_FILE) $(JAVASCRIPT_FILES)

	cp -pa js/*js $(HTML_OUTPUT_DIR)/js

	cp -pa css/*css $(HTML_OUTPUT_DIR)/css

$(BOOK_BASE).dvi: $(LATEX_INPUT_FILES) $(EPS_FIGS)

	$(LATEX)  $(BOOK_BASE).tex

	$(LATEX)  $(BOOK_BASE).tex

install: all

	chmod -R oug+r $(HTML_OUTPUT_DIR)

	find $(HTML_OUTPUT_DIR) -type d -exec chmod gou+rx {} \;

	rsync -HavP --delete --delay-updates $(HTML_OUTPUT_DIR)/ $(WEB_INSTALL_DIR)/

	chmod -R oug+r $(WEB_INSTALL_DIR)

	find $(WEB_INSTALL_DIR) -type d -exec chmod gou+rx {} \;

	cd $(WEB_INSTALL_DIR); /bin/ln -sf comprehensive-gpl-guide.html index.html

	cd $(WEB_INSTALL_DIR)/monolithic/; /bin/ln -sf comprehensive-gpl-guide.html index.html

clean:

	/bin/rm -f $(BOOK_BASE).ps $(BOOK_BASE).pdf $(BOOK_BASE).log texput.log $(BOOK_BASE).lg $(BOOK_BASE).tmp $(BOOK_BASE).xref *.4ct *.4tc *.aux *.dvi $(BOOK_BASE)*.html *.idv *.lg *.tmp $(BOOK_BASE).css $(BOOK_BASE).log $(BOOK_BASE).out $(BOOK_BASE)-js.* cm*png

	/bin/rm -rf public_html

err: ; $(ERR)

% compliance-guide.tex                            -*- LaTeX -*-

\part{A Practical Guide to GPL Compliance}

\label{gpl-compliance-guide}

{\parindent 0in

This part is: \\

\begin{tabbing}

Copyright \= \copyright{} 2008, 2014 \= \hspace{.2in} Bradley M. Kuhn. \\

Copyright \= \copyright{} 2014 \> \hspace{.2in} Free Software Foundation, Inc. \\

Copyright \> \copyright{} 2008, 2014 \> \hspace{.2in} Software Freedom Law Center. \\

\end{tabbing}

\vspace{.1in}

\begin{center}

The copyright holders of this part hereby grant the freedom to copy, modify,

convey, Adapt, and/or redistribute this work under the terms of the Creative

Commons Attribution Share Alike 4.0 International License.  A copy of that

license is available at

\url{https://creativecommons.org/licenses/by-sa/4.0/legalcode}.

\vfill

receives as a public, collaborative project.  Please

\href{https://gitorious.org/copyleft-org/tutorial/history/master:compliance-guide.tex}{review

  its Git logs} for full documentation of all contributions.

\end{center}

}

\pagebreak

\chapter*{Executive Summary}

This is a guide to effective compliance with the GNU General Public

License (GPL) and related licenses.  Copyleft advocates

usually seek to assist the community with

GPL compliance cooperatively.   This guide focuses on complying from the

start, so that readers can learn to avoid enforcement actions entirely, or, at

least, minimize  the negative impact when enforcement actions occur.

This guide  introduces and explains basic legal concepts related to the GPL and its

enforcement by copyright holders. It also outlines business practices and

methods that lead to better GPL compliance.  Finally, it recommends proper

post-violation responses to the concerns of copyright holders.

\chapter{Background}

Copyright law grants exclusive rights to authors.  Authors who chose copyleft

seek to protect the freedom of users and developers to copy, share, modify

and redistribute the software.  However, copyleft is ultimately implemented

through copyright, and the GPL is primarily and by default a copyright

license.  (See \S~\ref{explaining-copyright} for more about the interaction

between copyright and copyleft.)  Copyright law grants an unnatural exclusive

control to copyright holders regarding copyright-controlled permissions

related to the work.  Therefore, copyright holders (or their agents) are the

ultimately the sole authorities to enforce copyleft and protect the rights of

users.  Actions for copyright infringement are the ultimate legal mechanism

for enforcement.  Therefore, copyright holders, or collaborative groups of

copyright holders, have historically been the actors in GPL enforcement.

The earliest of these efforts began soon after the GPL was written by

Richard M.~Stallman (RMS) in 1989, and consisted of informal community efforts,

often in public Usenet discussions.\footnote{One example is the public

  outcry over NeXT's attempt to make the Objective-C front-end to GCC

  proprietary.  RMS, in fact, handled this enforcement action personally and

  the Objective-C front-end is still part of upstream GCC today.}  Over the next decade, the Free Software Foundation (FSF),

which holds copyrights in many GNU programs, was the only visible entity

actively enforcing its GPL'd copyrights on behalf of the software freedom

community.

FSF's enforcement

was generally a private process; the FSF contacted violators

confidentially and helped them to comply with the license.  Most

violations were pursued this way until the early 2000's.

By that time, Linux-based systems such as GNU/Linux and BusyBox/Linux had become very common, particularly in

embedded devices such as wireless routers.  During this period, public

ridicule of violators in the press and on Internet fora supplemented

ongoing private enforcement and increased pressure on businesses to

comply.  In 2003, the FSF formalized its efforts into the GPL Compliance

Lab, increased the volume of enforcement, and built community coalitions

to encourage copyright holders to together settle amicably with violators.

Beginning in 2004, Harald Welte took a more organized public enforcement

approach and launched \href{http://gpl-violations.org/}{gpl-violations.org}, a website and mailing

list for collecting reports of GPL violations.  On the basis of these

reports, Welte successfully pursued many enforcement actions in Europe, including

formal legal action.  Harald earns the permanent fame as the first copyright

holder to bring legal action in a court regarding GPL compliance.

In 2007, two copyright holders in BusyBox, in conjunction with the

Software Freedom Conservancy (``Conservancy''), filed the first copyright infringement lawsuit

based on a violation of the GPL\@ in the USA. While  lawsuits are of course

quite public, the vast majority of Conservancy's enforcement actions 

are resolved privately via

cooperative communications with violators.  As both FSF and Conservancy have worked to bring

individual companies into compliance, both organizations have encountered numerous

violations resulting from preventable problems such as inadequate

attention to licensing of upstream software, misconceptions about the

GPL's terms, and poor communication between software developers and their

management.  This document highlights these problems and describe

best practices to encourage corporate Free Software users to reevaluate their

approach to GPL'd software and avoid future violations.

Both FSF and Conservancy continue GPL enforcement and compliance efforts

for software under the GPL, the GNU Lesser

Public License (LGPL) and other copyleft licenses.  In doing so, both organizations have

found that most violations stem from a few common, avoidable mistakes.  All copyleft advocates  hope to educate the community of

commercial distributors, redistributors, and resellers on how to avoid

violations in the first place, and to respond adequately and appropriately

when a violation occurs.

\section{Who Has Compliance Obligations?}

All distributors of modified or unmodified versions of copylefted works

unmodified versions of the works have compliance obligations.  Common methods

of modifying the works include innumerable common acts, such as:

\begin{itemize}

  \item embedding those works as executable copies

    into a device,

  \item transferring a digital copy of executable copies to someone else,

  \item posting a patch to the copylefted software to a public mailing list.

\end{itemize}

Such distributors have obligations to (at least) the users to whom they (or

intermediary parties) distribute those copies.  In some cases, distributors

have obligations to third parties not directly receiving their distribution

of the works (depending on the distributors chosen licensing options, as

described later in \S~\ref{binary-distribution-permission}).  In addition,

distributors have compliance obligations to upstream parties, such as

preservation of reasonable legal notices embedded in the code, and

appropriate labeling of modified versions.

Online service providers and distributors alike have other compliance

obligations.  In general, they must refrain from imposing any additional

restrictions on downstream parties. Most typically, such compliance problems

arise from ``umbrella licenses:'' EULAs, or sublicenses that restrict

downstream users' rights under copyleft. (See \S~\ref{GPLv2s6} and

\S~\ref{GPLv3s10}).

Patent holders having claims reading on GPL'd works they distribute must

refrain from enforcing those claims against parties to whom they distribute.

Furthermore, patent holders holding copyrights on GPLv3'd works must further

grant an explicit patent license for any patent claims reading on the version

they distributed, and therefore cannot enforce those specific patent claims

against anyone making, using or selling a work based on their distributed

version.  All parties must refrain from acting as a provider of services or

distributor of licensed works if they have accepted, or had imposed on them

by judicial action, any legal conditions that would prevent them from meeting

any obligation under GPL\@.  (See \S~\ref{GPLv2s7}, \S~\ref{GPLv3s11} and

\S~\ref{GPLv3s12}.

\section{What Are The Risks of Non-Compliance?}

Copyleft experts have for decades observed a significant mismatch between the

assumptions most businesses make about copyleft compliance and the realities.

Possibly due to excessive marketing of proprietary tools and services from

the for-profit compliance industry, businesses perennially focus on the wrong

concerns.  This tutorial seeks to educate those businesses about what

actually goes wrong, what causes disputes, and how to resolve those disputes.

Many businesses currently invest undue resources to avoid unlikely risks that

have low historical incidence of occurrence and low cost of remediation,

while leaving unmanaged the risks that have historically resulted in all the

litigation and other adverse outcomes.  For example, some ``compliance

industry''\footnote{``Compliance industry'' refers to third-party for-profit

  companies that market proprietary software tools and/or consulting services

  that purport to aid businesses with their Free Software license compliance

  obligations, such as those found in GPL and other copyleft licenses.  This

  tutorial leaves the term in quotes throughout, primarily to communicate the

  skepticism most of this tutorial's authors feel regarding the mere

  existence of this industry.  Not only do copyleft advocates object on

  principle to proprietary software tools in general, and to their ironic use

  specifically to comply with copyleft, but also to the ``compliance

  industry'' vendors' marketing messaging, which some copyleft advocates

  claim as a cause in the risk misassessments discussed herein.  Bradley

  M.~Kuhn, specifically, regularly uses the term ``compliance industrial

  complex''

  \href{http://en.wikipedia.org/wiki/Military-industrial_complex}{to

    analogize the types of problems in this industry to those warned against

    in the phrase of origin}.} vendors insist that great effort must be

expended to carefully list, in the menus or manuals of embedded electronics

products, copyright notices for every last copyright holder that contributed

to the Free Software included in the product.  While nearly all Free Software

licenses, including copylefts like GPL, require preservation and display of

copyright notices, failure to meet this specific requirement is trivially

remedied.  Therefore, businesses should spend just reasonable efforts to

properly display copyright notices, and note that failure to do so is simply

remedied: add the missing copyright notice!

\section{Understanding Who's Enforcing}

\label{compliance-understanding-whos-enforcing}

The mismatch between actual compliance risk and compliance risk management

typically results from a misunderstanding of licensor intentions.  For-profit

businesses often err by assuming other actors have kindred motivations.  The

primary enforcers of the GPL, however, have goals that for-profit businesses

will find strange and perhaps downright alien.

Specifically, community-oriented GPL enforcement organizations (called

``COGEOs'' throughout the remainder of this tutorial) are typically

non-profit charities (such as the FSF and Software Freedom Conservancy) who

declare, as part of their charitable mission, advancement of software freedom

for all users.  In the USA, these COGEOs are all classified as charitable

under the IRS's 501(c)(3) designation, which is reserved for organizations

that have a mission to enhance the public good.

As such, these COGEOs enforce GPL primarily to pursue the policy goals and

motivations discussed throughout this tutorial: to spread software freedom

further.  As such, COGEOs are unified in their primary goal to bring the

violator back into compliance as quickly as possible, and redress the damage

caused by the violation.  COGEOs are steadfast in their position in a

violation negotiation: comply with the license and respect freedom.

Certainly, other entities do not share the full ethos of software freedom as

institutionalized by COGEOs, and those entities pursue GPL violations

differently.  Oracle, a company that produces the GPL'd MySQL database, upon

discovering GPL violations typically negotiates a proprietary software

license separately for a fee.  While this practice is not one a COGEO would

undertake nor endorse, a copyleft license technically permits this

behavior.  To put a finer point on this practice already discussed

in~\S~\ref{Proprietary Relicensing}, copyleft advocates usually find copyleft

enforcement efforts focused on extract alternative proprietary licenses

distasteful at best, and a corrupt manipulation of copyleft at worst.  Much

to the advocates' chagrin, such for-profit enforcement efforts seem to

increase rather than decrease.

Thus, unsurprisingly, for-profit adopters of GPL'd software often incorrectly

assume that all copyright holders seek royalties.  Businesses therefore focus

on the risk of so-called ``accidental'' (typically as the result of

unsupervised activity by individual programmers) infringe copyright by

incorporating ``snippets'' of copylefted code into their own proprietary

computer program.  ``Compliance industry'' flagship products, therefore,

focus on ``code scanning'' services that purport to detect accidental

inclusions.  Such effort focuses on proprietary software development and view

Free Software as a foreign interloper.  Such approach not only ignores

current reality that many companies build their products directly on major

copylefted projects (e.g., Android vendor's use of the kernel named Linux),

but also creates a culture of fear among developers, leading them into a

downward spiral of further hiding their necessary reliance on copylefted

software in the company's products.

Fortunately, COGEOs regard GPL compliance failures as an opportunity to

improve compliance.  Every compliance failure downstream represents a loss of

rights by their users. The COGEOs are the guardian of its users' and

developers' rights.  Their activity seeks to restore those rights, and

to protect the project's contributors' intentions in the making of their

software. 

\chapter{Best Practices to Avoid Common Violations}

\label{best-practices}

Unlike highly permissive licenses (such as the ISC license), which

typically only require preservation of copyright notices, licensees face many

important requirements from the GPL.  These requirements are

carefully designed to uphold certain values and standards of the software

freedom community.  While the GPL's requirements may initially appear

counter-intuitive to those more familiar with proprietary software

licenses, by comparison, its terms are in fact clear and quite favorable to

licensees.  Indeed, the GPL's terms actually simplify compliance when

violations occur.

GPL violations occur (or, are compounded) most often when companies lack sound

practices for the incorporation of GPL'd components into their

internal development environment.  This section introduces some best

practices for software tool selection, integration and distribution,

inspired by and congruent with software freedom methodologies.  Companies should

establish such practices before building a product based on GPL'd

software.\footnote{This document addresses compliance with GPLv2,

  GPLv3, LGPLv2, and LGPLv3.  Advice on avoiding the most common

  errors differs little for compliance with these four licenses.

  \S~\ref{lgpl} discusses the key differences between GPL and LGPL

  compliance.}

\section{Evaluate License Applicability}

\label{derivative-works}

Political discussion about the GPL often centers around determining the

``work'' that must be licensed under GPL, or in other words, ``what is the

derivative and/or combined work that was created''.  Nearly ever esoteric

question asked by lawyers seek to consider that question

\footnote{\tutorialpartsplit{In fact, a companion work, \textit{Detailed Analysis of the GNU GPL and Related

      Licenses} contains an entire section discussing derivative works}{This tutorial in fact

  also addresses the issue at length in~\S~\ref{derivative-works}}.} (perhaps because

that question explores exciting legal issues while the majority of the GPL

deals with much more mundane ones).

Of course, GPL was designed

primarily to embody the licensing feature of copyleft.

However, most companies who add

complex features to and make combinations with GPL'd software

are already well aware of their

more complex obligations under the license that require complex legal

analysis.  And, there are few companies overall that engage in such

activities. Thus,  in practical reality, this issue is not relevant to the vast

majority of companies distributing GPL'd software.

Thus, experienced  GPL enforcers find that few redistributors'

compliance challenges relate directly to combined work issues in copyleft.

Instead, the distributions of GPL'd

systems most often encountered typically consist of a full operating system

including components under the GPL (e.g., Linux, BusyBox) and components

under the LGPL (e.g., the GNU C Library).  Sometimes, these programs have

been patched or slightly improved by direct modification of their sources,

and thus the result is unequivocally a modified version.  Alongside these programs,

companies often distribute fully independent, proprietary programs,

developed from scratch, which are designed to run on the Free Software operating

system but do not combine with, link to, modify, derive from, or otherwise

create a combined work with

the GPL'd components.\footnote{However, these programs do often combine

  with LGPL'd libraries. This is discussed in detail in \S~\ref{lgpl}.}

In the latter case, where the work is unquestionably a separate work of

creative expression, no copyleft provisions are invoked.

The core compliance issue faced, thus, in such a situation, is not an discussion of what is or is not a

combined, derivative, and/or modified version of the work, but rather, issues related to distribution and

conveyance of binary works based on GPL'd source, but without Complete,

Corresponding Source.

As such, issues of software delivery are the primary frustration for GPL

enforcers. In particular, the following short list accounts for at least 95\%

of the GPL violations ever encountered:

\begin{itemize}

\item The violator fails to provide required information about the presence

  of copylefted programs and their applicable license terms in the product

  they have purchased.

\item The violator fails to reliably deliver \hyperref[CCS

  Definition]{complete, corresponding source} (CCS) for copylefted programs

  the violator knew were included (i.e., the CCS is either delivered but

  incomplete, or is not delivered at all).

\item Requestors are ignored when they communicate with violator's published

  addresses requesting fulfillment of businesses' obligations.

\end{itemize}

This tutorial therefore focuses primarily on these issue.

Admittedly, a tiny

minority of compliance situations relate to question of derivative,

combined, or modified versions of the work.  Those

situations are so rare, and the details from situation to situation differ

greatly.  Thus, such situations require a highly

fact-dependent analysis and cannot be addressed in a general-purpose

document such as this one.

\medskip

Most companies accused of violations lack a basic understanding

of how to comply even in the straightforward scenario.  This document

provides those companies with the fundamental and generally applicable prerequisite knowledge.

For answers to rarer and more complicated legal questions, such as whether

your software is a derivative or combined work of some copylefted software, consult

with an attorney.\footnote{If you would like more information on the

  application of derivative works doctrine to software, a detailed legal

  discussion is presented in our colleague Dan Ravicher's article,

  \textit{Software Derivative Work: A Circuit Dependent Determination} and in

  \tutorialpartsplit{\textit{Detailed Analysis of the GNU GPL and Related

      Licenses}'s Section on derivative works}{\S~\ref{derivative-works} of

    this tutorial}.}

This discussion thus assumes that you have already identified the

``work'' covered by the license, and that any components not under the GPL

(e.g., applications written entirely by your developers that merely happen

to run on a Linux-based operating system) distributed in conjunction with

those works are separate works within the meaning of copyright law and the GPL\@.  In

such a case, the GPL requires you to provide complete corresponding

source (CCS)\footnote{For more on CCS,  see

\tutorialpartsplit{\textit{Detailed Analysis of the GNU GPL and Related

      Licenses}'s Section on GPLv2~\S2 and GPLv3~\S1.}{\S~\ref{GPLv2s2} and \S~\ref{GPLv3s1} of

    this tutorial}.}

for the GPL'd components and your modifications thereto, but not

for independent proprietary applications.  The procedures described in

this document address this typical scenario.

\section{Monitor Software Acquisition}

Software engineers deserve the freedom to innovate and import useful

software components to improve products.  However, along with that

freedom should come rules and reporting procedures to make sure that you

are aware of what software that you include with your product.

The most typical response to an initial enforcement action is: ``We

didn't know there was GPL'd stuff in there''.  This answer indicates

failure in the software acquisition and procurement process.  Integration

of third-party proprietary software typically requires a formal

arrangement and management/legal oversight before the developers

incorporate the software.  By contrast, developers often obtain and

integrate Free Software without intervention nor oversight. That ease of acquisition, however,

does not mean the oversight is any less necessary.  Just as your legal

and/or management team negotiates terms for inclusion of any proprietary

software, they should gently facilitate all decisions to bring Free Software into your

product.

Simple, engineering-oriented rules help provide a stable foundation for

Free Software integration.  For example, simply ask your software developers to send an email to a

standard place describing each new Free Software component they add to the system,

and have them include a brief description of how they will incorporate it

into the product.  Further, make sure developers use a revision control

system (such as Git or Mercurial), and

store the upstream versions of all software in a ``vendor branch'' or

similar mechanism, whereby they can easily track and find the main version

of the software and, separately, any local changes.

% comprehensive-gpl-guide.tex                                    -*- LaTeX -*-

%

% Toplevel file to build the entire book.

\documentclass[10pt, letterpaper, openany, oneside]{book}

% I'm somewhat convinced that this book would be better formatted using

%  the memoir class :

%    http://www.ctan.org/pkg/memoir

%   http://mirror.unl.edu/ctan/macros/latex/contrib/memoir/memman.pdf

% For the moment, I've thrown in fancychap because I don't have time to

% research memoir.

% FIXME: Some overall formatting hacks that would really help:

%   * I have started using  \hyperref[LABEL]{text} extensively, which seems

%     to work great in the PDF and HTML versions, but in the Postscript

%     version, the link lost entirely.  I think we need an additional command

%     to replace \hyperref which takes an optional third argument that will

%     insert additional text only when generating print versions, such as:

%      \newhyperref[GPLv2s3]{the requirements for binary distribution under

%      GPLv2}{(see section~\ref*{GPLv2s3} for more information)}

%

%     This is a careful balance, because it'd be all too easy to over-pepper

%     the printed version with back/forward references, but there are

%     probably times when this is useful.

%   * Similar issue: \href{} is well known not to carry the URLs in the print

%     versions.  Adding a footnote with the URL for the print version is

%     probably right.  (or maybe a References page?)

%   * The text is extremely inconsistent regarding formatting of code and

%     commands.  The following varied different methods have been used:

%         + the \verb%..% inline form

%         + verbatim environment (i.e., \begin{verbatim}

%         + {\tt }

%         + \texttt{}

%         + the lstlisting environment (i.e., \begin{lstlisting}

%     These should be made consistent, using only two forms: one for line and

%     one for a long quoted section.

% FIXME: s/GPL enforcers/COGEOs/g

%        (the term coined later but not used throughout) This can't be done

%        by rote, since it may not be appropriate everywhere and shouldn't be

%        used *before* it's coined in the early portions of

%        compliance-guide.tex (and it's probably difficult to coin it earlier

%        anyway).  BTW, I admit COGEOs isn't the best acronym, but I started

%        with ``Community Enforcement Organizations'', which makes CEO, which

%        is worse. :)  My other opting was   COEO, which seemed too close to

%        CEO.  Suggestions welcome.

\usepackage{hyperref}

\usepackage{listings}

\usepackage{enumerate}

\usepackage{enumitem}

\usepackage[Conny]{fncychap}

\usepackage[dvips]{graphicx}

\usepackage[verbose, twoside, dvips,

              paperwidth=8.5in, paperheight=11in,

              left=1in, right=1in, top=1.25in, bottom=.75in,

           ]{geometry}

\newcommand{\tutorialpartsplit}[2]{#2}

%\input{no-numbers-on-table-of-contents}

\providecommand{\hrefnofollow}[2]{\href{#1}{#2}}

\hypersetup{pdfinfo={Title={Copyleft and the GNU General Public License: A Comprehensive Tutorial and Guide}}}

    \begin{document}

\pagestyle{plain}

\pagenumbering{roman}

\frontmatter

\begin{titlepage}

\begin{center}

{\Huge

{\sc Copyleft and the  \\

GNU General Public License:

\vspace{.25in}

A Comprehensive Tutorial \\

\vspace{.1in}

and Guide

}}

\vfill

{\parindent 0in

\begin{tabbing}

Copyright \= \copyright{} 2003--2007, 2014 \hspace{1.mm} \=  \kill

Copyright \> \copyright{} 2014 \>  Bradley M. Kuhn. \\

Copyright \> \copyright{} 2014 \>  Anthony K. Sebro, Jr. \\

Copyright \= \copyright{} 2014 \> Denver Gingerich \\

Copyright \= \copyright{} 2003--2007, 2014 \> \hspace{.2in} Free Software Foundation, Inc. \\

Copyright \> \copyright{} 2008, 2014 \>  Software Freedom Law Center. \\

\end{tabbing}

\vspace{.3in}

The copyright holders hereby grant the freedom to copy, modify, convey,

Adapt, and/or redistribute this work under the terms of the Creative Commons