@@ -10,92 +10,92 @@ Copyright \= \copyright{} 2014 \= \hspace{.2in} Bradley M. Kuhn. \\
Copyright \= \copyright{} 2014 \= \hspace{.2in} Free Software Foundation, Inc. \\
Copyright \> \copyright{} 2008 \> \hspace{.2in} Software Freedom Law Center. \\
\end{tabbing}
\vspace{1in}
\begin{center}
Authors of this part are: \\
Bradley M. Kuhn \\
Aaron Williamson \\
Karen M. Sandler \\
Copy editors of this part include: \\
Martin Michlmayr
\vspace{3in}
The copyright holders of this part hereby grant the freedom to copy, modify,
convey, Adapt, and/or redistribute this work under the terms of the Creative
Commons Attribution Share Alike 4.0 International License. A copy of that
license is available at
\verb=https://creativecommons.org/licenses/by-sa/4.0/legalcode=.
\url{https://creativecommons.org/licenses/by-sa/4.0/legalcode}.
\end{center}
}
\bigskip
\chapter*{Executive Summary}
This is a guide to effective compliance with the GNU General Public
License (GPL) and related licenses. Copyleft advocates
usually seek to assist the community with
GPL compliance cooperatively. This guide focuses on complying from the
start, so that readers can learn to avoid enforcement actions entirely, or, at
least, minimize the negative impact when enforcement actions occur.
This guide introduces and explains basic legal concepts related to the GPL and its
enforcement by copyright holders. It also outlines business practices and
methods that lead to better GPL compliance. Finally, it recommends proper
post-violation responses to the concerns of copyright holders.
\chapter{Background}
Early GPL enforcement efforts began soon after the GPL was written by
Richard M.~Stallman (RMS) in 1989, and consisted of informal community efforts,
often in public Usenet discussions.\footnote{One example is the public
outcry over NeXT's attempt to make the Objective-C front-end to GCC
proprietary. RMS, in fact, handled this enforcement action personally and
the Objective-C front-end is still part of upstream GCC today.} Over the next decade, the Free Software Foundation (FSF),
which holds copyrights in many GNU programs, was the only visible entity
actively enforcing its GPL'd copyrights on behalf of the software freedom
community.
FSF's enforcement
was generally a private process; the FSF contacted violators
confidentially and helped them to comply with the license. Most
violations were pursued this way until the early 2000's.
By that time, Linux-based systems such as GNU/Linux and BusyBox/Linux had become very common, particularly in
embedded devices such as wireless routers. During this period, public
ridicule of violators in the press and on Internet fora supplemented
ongoing private enforcement and increased pressure on businesses to
comply. In 2003, the FSF formalized its efforts into the GPL Compliance
Lab, increased the volume of enforcement, and built community coalitions
to encourage copyright holders to together settle amicably with violators.
Beginning in 2004, Harald Welte took a more organized public enforcement
approach and launched \verb0gpl-violations.org0, a website and mailing
approach and launched \url{gpl-violations.org}, a website and mailing
list for collecting reports of GPL violations. On the basis of these
reports, Welte successfully pursued many enforcements in Europe, including
formal legal action. Harald earns the permanent fame as the first copyright
holder to bring legal action in a court regarding GPL compliance.
In 2007, two copyright holders in BusyBox, in conjunction with the
Software Freedom Conservancy (``Conservancy''), filed the first copyright infringement lawsuit
based on a violation of the GPL\@ in the USA. While lawsuits are of course
quite public, the vast majority of Conservancy's enforcement actions
are resolved privately via
cooperative communications with violators. As both FSF and Conservancy have worked to bring
individual companies into compliance, both organizations have encountered numerous
violations resulting from preventable problems such as inadequate
attention to licensing of upstream software, misconceptions about the
GPL's terms, and poor communication between software developers and their
management. This document highlights these problems and describe
best practices to encourage corporate Free Software users to reevaluate their
approach to GPL'd software and avoid future violations.
Both FSF and Conservancy continue GPL enforcement and compliance efforts
for software under the GPL, the GNU Lesser
Public License (LGPL) and other copyleft licenses. In doing so, both organizations have
found that most violations stem from a few common, avoidable mistakes. All copyleft advocates hope to educate the community of
commercial distributors, redistributors, and resellers on how to avoid
@@ -404,49 +404,49 @@ fast network connections to get the source more quickly, and typically
decreases the number of physical media fulfillment requests.
(GPLv3~\S~6(b) permits provision of source with a public
network-accessible distribution only and no physical media. We discuss
this in detail at the end of this section.)
The following is a suggested compliant offer for source under GPLv2 (and
is also acceptable for GPLv3) that you would include in your printed
materials accompanying each binary distribution:
\begin{quote}
The software included in this product contains copyrighted software that
is licensed under the GPL\@. A copy of that license is included in this
document on page $X$\@. You may obtain the complete Corresponding Source
code from us for a period of three years after our last shipment of this
product, which will be no earlier than 2011-08-01, by sending a money
order or check for \$5 to: \\
GPL Compliance Division \\
Our Company \\
Any Town, US 99999 \\
\\
Please write ``source for product $Y$'' in the memo line of your
payment.
You may also find a copy of the source at
\verb0http://www.example.com/sources/Y/0.
\url{http://www.example.com/sources/Y/}.
This offer is valid to anyone in receipt of this information.
\end{quote}
There are a few important details about this offer. First, it requires a
copying fee. GPLv2 permits ``a charge no more than your cost of
physically performing source distribution''. This fee must be reasonable.
If your cost of copying and mailing a CD is more than around \$10, you
should perhaps find a cheaper CD stock and shipment method. It is simply
not in your interest to try to overcharge the community. Abuse of this
provision in order to make a for-profit enterprise of source code
provision will likely trigger enforcement action.
Second, note that the last line makes the offer valid to anyone who
requests the source. This is because v2~\S~3(b) requires that offers be
``to give any third party'' a copy of the Corresponding Source. GPLv3 has
a similar requirement, stating that an offer must be valid for ``anyone
who possesses the object code''. These requirements indicated in
v2~\S~3(c) and v3~\S~6(c) are so that noncommercial redistributors may
pass these offers along with their distributions. Therefore, the offers
must be valid not only to your customers, but also to anyone who received
a copy of the binaries from them. Many distributors overlook this
requirement and assume that they are only required to fulfill a request
from their direct customers.
@@ -489,49 +489,49 @@ remains active for three years from the last distribution of your product
or related spare part. Accordingly, you may satisfy your fulfillment
obligations via Internet-only distribution. This makes the ``offer for
source'' option less troublesome for v3-only distributions, easing
compliance for commercial redistributors. However, before you switch to a
purely Internet-based fulfillment process, you must first confirm that you
can actually distribute \emph{all} of the software under GPLv3. Some
programs are indeed licensed under ``GPLv2, \emph{or any later version}''
(often abbreviated ``GPLv2-or-later''). Such licensing gives you the
option to redistribute under GPLv3. However, a few popular programs are
only licensed under GPLv2 and not ``or any later version''
(``GPLv2-only''). You cannot provide only Internet-based source request
fulfillment for the latter programs.
If you determine that all GPL'd works in your whole product allow upgrade
to GPLv3 (or were already GPLv3'd to start), your offer for source may be
as simple as this:
is licensed under the GPLv3\@. A copy of that license is included in this
product and/or spare parts therefor, which will be no earlier than
2011-08-01, on our website at
\verb0http://www.example.com/sources/productnum/0.
\url{http://www.example.com/sources/productnum/}.
\medskip
Under both GPLv2 and GPLv3, source offers must be accompanied by a copy of
the license itself, either electronically or in print, with every
distribution.
Finally, it is unacceptable to use option (b) merely because you do not have
Corresponding Source ready. We find that some companies choose this option
because writing an offer is easy, but producing a source distribution as
an afterthought to a hasty development process is difficult. The offer
for source does not exist as a stop-gap solution for companies rushing to
market with an out-of-compliance product. If you ship an offer for source
with your product but cannot actually deliver \emph{immediately} on that
offer when your customers request it, you should expect an enforcement
action.
\subsection{Option (c): Noncommercial Offers}
As discussed in the last section, GPLv2~\S~3(c) and GPLv3~\S~6(c) apply
only to noncommercial use. These options are not available to businesses
distributing GPL'd software. Consequently, companies that redistribute
software packaged for them by an upstream vendor cannot merely pass along