So, I know that if you use GPLv2 code in some server side code, you do not need to release that code (as long as you're not distributing it, of course :). However, let's assume that you accidentally make a file from your server side codebase available... but it's a totally unintentional mistake.

Would you then need to release all of the code, if that is "distribution"?

Further, what if a malicious employee (I know, I know, but this is what law resolves!) puts a jar of some of your server code on the internet. You do what you can to take it down and take actions against that employee, but does that count as "distribution"?

  • 3
    Ask your lawyer, or the FSF. – Basile Starynkevitch May 21 '15 at 15:57
  • 2
    this is the sort of thing you need a lawyer for. – user1666620 May 21 '15 at 15:58
  • 1
    Before looking further, you must first determine that your entire company is in full compliance (except the accidental distribution or theft part). That is, that your entire company does not otherwise distribute any GPLv2-licensed material without also making their source code available in GPLv2-license. Then, be rest assured that "theft" is not distribution. However, it is not sure whether "accidental release" could be used for "discovery" or not. Discovery is what FSF can use to catch that your company is violating GPLv2, so that's why you should first make sure compliance. IANAL. – rwong May 21 '15 at 16:47
  • 2
    I'm voting to close this question as off-topic because this sort of licensing advice ought to be for lawyers, not programmers. – durron597 May 22 '15 at 0:45
  • This question might fare better on the proposed open source stackexchange site which still needs 53 people to commit to it before it can go into public beta. – Philipp May 28 '15 at 3:37

In the first case, for a bona fide accident, you are in all likelihood fine. If it's served up by accident, no one has any authorization to download the file in the first place, and so therefore it likely wouldn't be considered a distribution. If someone has a beef with the company though, it may take going to court to decide that, as this issue hasn't been tested in court to my knowledge.

In the case of the malicious employee, the employee has no authorization to propagate the work. The company will not be 'required' to distribute their software per the GPL from then on, as it wasn't really distributed according to the GPL in the first place.

Punishing the employee or cleaning up what to do after is a question for a law firm.


If a rogue employee takes your source code and distributes it, then it is the rogue employee and not you who does the distributing. The rogue employee has to provide source code or is guilty of a GPL violation. However, since he doesn't have the right to distribute the source code (because that source code is yours), he can't distribute it and is guilty of that GPL violation. That's his problem, not yours.

(You may have a problem if the rogue employee is high enough in the company that he actually has authorisation to distribute the software. Say your VP for software development distributes the software, then the company is quite likely responsible for his actions. That would also depend on the country where this happens).

Not the answer you're looking for? Browse other questions tagged or ask your own question.