8

An open source project licensed under BSD, MIT or another permissive license accepts code contributions from the community.

How can I prevent someone from taking GPL-licensed code that they don't own and submitting it to my BSD-licensed project? I do not know that the contribution was stolen from a GPL-licensed project and accept it.

I do not wish to accept such contributions, so as not to make the entire project GPL. But I have no way of knowing whether the contributor actually holds the copyright to code they are contributing. So if someone illegally contributes GPL-licensed code to my project I do not know of any way to stop them (short of not accepting any contributions at all).

Surely, there are plenty of BSD and MIT licensed project out there, so there must be a solution.

Thanks!

  • 1
    probably because question seeking legal advice are generally frowned upon as being off-topic – Newtopian Mar 9 '18 at 20:32
  • 3
    @Newtopian How is this legal advice? It's about managing an open source project. I don't see how this is off-topic here at all. It may be better suited for Open Source, though, but managing a project is good here. – Thomas Owens Mar 9 '18 at 20:35
  • 3
    @ThomasOwens: I don't see how any attempt to answer doesn't touch on legal issues. At the end of the day, you are relying on the word of the contributor unless you ask for proof of copyright of some sort, making it a legal issue again. – Robert Harvey Mar 9 '18 at 21:03
  • 3
    I was not a downvoter neither did I vote to close. It is a legitimate question but one for which is difficult to answer without, as Robert said, falling back on the legal side of it. Best I could hope for here is to rely on the good faith of the contributors while at the same time keeping excellent records of the what, when, whom of the comited code and prepare for eventual lengthy rollbacks and re-writes should any pieces slip through the cracks. – Newtopian Mar 9 '18 at 21:07
  • 5
    Be aware that improperly adding GPL code to a BSD project without including the proper attribution etc doesn't automatically make the project GPL. Instead it makes the project impossible to lawfully distribute. That can be fixed by either removing the GPL code or properly attributing it etc and converting the entire project to GPL. – bdsl Mar 9 '18 at 21:56
6

enter image description here

One does not simply "guard against" illegal contributions.

You never accept blindly a contribution, and should have a process to vet contributions (including yours) for several kinds of troubles:

  • unit tests (automated)
  • backdoors and security flaws (static analysis might help, other tools exist)
  • code smells (automated)
  • poor code logic (peer review, "enough eyes to make bugs shallow", etc. - the story of OpenSSL shows that this might not be enough)
  • I'm sure I missed several others - contributions welcome

"All" that you need to do would be to add a check for plagiarism. This can be done, to a point, with automatic tools by just googling the relevant lines of code.

I've tried just now by lifting some samples of code from projects, and it works. I have simply extracted strings, formats, comments and function names and prototypes from the code, then googled them all, and looked at where a single site appeared in multiple matches. In 17 tests out of 19 the source site was the first of five candidates; in all cases, the site did appear among the first five. By contrast, pieces of my own code only triggered false positives in three (four) cases out of twenty, with very low quality targets, so by quickly perusing a half dozen of sites I was able to dismiss the alert. With the GPL code, moreover, the snippet from Google Search was visibly the same as the code I had test-filked.

At this point I'm confident that you could do that by hand. Take a look at the code, look at the comments (do they make sense? If not, that's another kind of red light. If yes, either they've been all reworded(!) or you'll find them), try a couple of text strings, plug them in Google and/or other search engines.

And you only need to this for sizeable contributions.

From a legal point of view - I am quickly wading out of my depth - I imagine that you need your contributors to accept some form of waiver or agreement in which they state that they're going to contribute honestly.

When they don't, and you missed that (e.g. they morphed/obfuscated some GPL code so that it isn't found by googling), IMHO chances are that it'll never be found out unless it was done for entrapment purposes, and they themselves blow the whistle. At that point your project will be in violation of the GPL and you can:

  • remove the GPL code from the project
  • declare the rest of the project to fall under the GPL

For the whole scenario to be any kind of realistic trouble, the "contributor" should need to:

  • locate a meaningful GPL code section of useful proportions,
  • remove all licensing information,
  • thoroughly rewrite it - comments, function names, non-trivial variable names, text strings - so that a search won't find the code, and yet leave it recognizably the same, and at the same time leave it working
  • let the code "stew" in the codebase and other contributors rely on its functionality, to the point where removing it would be an issue

The whole scenario, especially the last point, seems to me really far-fetched. Once the plagiarism check is in place, I would cease worrying.

  • 1
    Very interesting and comprehensive answer ! Yes some googling could help to identify some undesired copy&paste. However this works only for literal copies: if someone takes the same code and replaces some variable names, or changes the order of some statements, you wouldn't find it, although it's still a plagiarism. But you're right: it can at least help to reduce the risks. The contributor agreement should make obligations clear and transfer the residual risk to the contributor. – Christophe Mar 10 '18 at 15:21
  • 1
    To add on to this answer, I was an instructor at a coding bootcamp for a little while. Plagiarism wasn't common, but it happened. It was usually pretty obvious to me when it happened because a student would submit code that was much different than what I was used to seeing from them. When that happened, I would take a few lines of somewhat distinguishing code, and search in GitHub for the code. If I didn't find it in GitHub, Google would be next, but I was always able to find the original code in GitHub. – Dan Jones Mar 13 '18 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.