Reports of GPLv3 and AGPLv3 "virality" are greatly exaggerated
Case 1:
If you
- use a library X that comes under GPLv3 or AGPLv3,
- use it as a library (that is, keeping it as a separate
entity without copying source code from the library into
your own source code),
- and do not modify it,
you do not have to make available any part of your own source code.
Case 2: If you
- use a library X that comes under GPLv3 or AGPLv3,
- modify its source code, but still
- use it as a library (that is, keeping it as a separate
entity without copying source code from the library into
your own source code),
you have to make available the modified source code of X (but not any other part of your overall application)
if you distribute your own application and X has GPLv3 or AGPLv3.
The same holds if you make available the service provided by your
application via a network e.g. as a web application and
X has AGPL.
Why is that so?
Both GPLv3 and AGPLv3 are based on the following definitions (in Section 0):
"The Program" refers to any copyrightable work licensed
under this License. [...]
To "modify" a work means to copy from or adapt all or
part of the work in a fashion requiring copyright permission,
other than the making of an exact copy.
The resulting work is called a "modified version"
of the earlier work or a work "based on" the earlier work.
The remainder of the licenses only talks about "the program",
"the work", or "the modified work".
It does not talk about your software that is merely using the work.
Subsequent terms of the licenses allow you
- to modify the work (Section 2)
- to distribute the source code of the modified or unmodified work
(Sections 4 and 5)
- to distribute object code of the modified or unmodified work
(Section 6)
These subsequent terms of the licenses require you
- to also make available the "Corresponding Source" of the work
if you distribute object code of the modified or unmodified
work (Section 6)
- to even do this if you do not distribute a modified work at all,
but rather only make its services available via a network
(Section 13, AGPL only)
They do not require you to make available anything else,
such as the source code of any software in which you hold
the copyright.
Really???
Yes.
The above rules become critical only if you copy any source code
from library X into your own software in such a way that the
distinction of the two will blur.
This is the only case when your software may be "infected" by
the GPL/AGPL code.
The best short legal source I could find that confirms this
view is Patrice-Emmanuel Schmitz'
"Why viral licensing is a ghost".
It explains that interfaces have long been recognized
in law as suitable boundaries of copyright claims.
A note on "derivative works"
Note the above details are about version 3 of the GPL and AGPL
only.
The situation in those cases appears fairly clear.
However,
GPLv1 and GPLv2 used the notion of "derivative work" in
roughly the places where GPLv3 talks of "modified work".
Much of the discussion regarding virality still uses that
notion of "derivative work" (or sometimes falsely "derived work").
Are things different in case of GPLv1 or GPLv2?
No. "Derivative work" is a
technical term from copyright law
and refers to a work that is itself worthy of copyright.
It does not apply to the combination of library X plus
your own software using it:
- Object code (if that is what you distribute) is in itself
never worthy of copyright, because it is produced by mindless
compilers and such, not human beings.
Only the underlying source code is in itself the reason to
consider copyright. (That copyright extends to the object
code, but only to the respective parts.)
- The same holds for "less binary" representations such
as JAR files containing bytecode or even the ZIP files
holding source code distributions for PHP, Python, or Ruby
applications.
- The source code of your software is worthy of copyright
independent of library X: Take X away and the remainder
is clearly and necessarily still a copyrightable work.
So you have not derived from X, you have only combined with it.
(Compare this to the image of Mona Lisa with a moustache:
The moustache alone would not be a comparable work any more.)
See also lawyer Lawrence Rosen's explanation and again
Why viral licensing is a ghost.
"But Richard Stallman says..."
Yes, indeed: In light of this discussion,
some of the statements one can find in the
GPL FAQs on the GNU/FSF website are misleading.
In particular, one FAQ says (as of 2017-03-22) that
linking your software
with a GPLed library (even linking it dynamically) will create
a "combined work". Oooh. Sounds viral? Yes, it does.
But the GPL does not talk about "combined works",
it only talks about "modified works", so this statement
has no consequence license-wise.
Want more detail?
The above-mentioned FAQ states that
"Linking a GPL covered work statically or
dynamically with other modules is making a combined work
based on the GPL covered work." and concludes that the whole
result will be covered by GPL.
However, "based on" (as you already learned above)
is a legal term in the GPL and is equivalent
to "modified work".
In the GPL (as you already learned above),
to "modify" means
"to copy from or adapt all or part of the work in a fashion
requiring copyright permission, other than the making of an
exact copy." [emphasis added]
Obviously, if you are only linking to a library you are only
making an exact copy (at the source code level, the binary level
is irrelevant), so the FAQ formulation is misleading.
You find all these terms in Section 0 of the GPL.
What does Richard Stallman say himself?
Richard Stallman likes the idea that all software
should be free, but he does not claim infectiousness
of GPL code. He says
"The GPL's domain does not spread by proximity or contact,
only by deliberate inclusion of GPL-covered code in your program."
Stallman considers the notion of GPL virality to be derogatory
and indeed the term is highly misleading.
Disclaimer
When you encounter a sufficiently odd
judge, your mileage may still vary.
Edit 2018-08-13:
"Why does the LGPL exist, then?" you might ask.
The LGPL
was introduced
when GPL was in Version 2
(using the term "derivative work",
not yet "modified work" as in GPLv3) and the copyright situation
was hence less clear.
