Do I need to provide access to source code under the AGPLv3 license?

549 readers like this.
Platform wars: software patents in a new light
Image by:

Opensource.com

The GNU Affero General Public License version 3 (AGPLv3) is a copyleft license nearly identical to the GPLv3. Both licenses have the same copyleft scope, but materially differ in one important way. The AGPLv3's Section 13 states an additional condition not present in GPLv2 or GPLv3:

Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software.

This condition was intended to apply mainly to what would now be considered SaaS deployments, although the reach of "interacting remotely through a computer network" should perhaps be read to cover situations going beyond conventional SaaS. The objective was to close a perceived loophole in the ordinary GPL in environments where users make use of functionality provided as a web service, but no distribution of the code providing the functionality occurs. Hence, Section 13 provides an additional source code disclosure requirement beyond the object code distribution triggered requirement contained in GPLv2 Section 3 and GPLv3 and AGPLv3 Section 6.

What is often misunderstood is that the source code requirement in AGPLv3 Section 13 is triggered only where the AGPLv3 software has been modified by "you" (for example, the entity providing the network service). My interpretation is that, so long as "you" do not modify the AGPLv3 code, the license should not be read as requiring access to the Corresponding Source in the manner prescribed by Section 13. As I see it, many unmodified and standard deployments of software modules under AGPL simply do not trigger Section 13, although making the source code available even if not required under the license is a good idea.

How terms and conditions of the AGPL could be interpreted, including whether the AGPL software has been modified, may require legal analysis depending on the facts and details of the specific use case.

Tags
Licensing
Jeffrey Robert Kaufman
Picture of Jeffrey Robert Kaufman
Jeffrey R. Kaufman is Senior Commercial Counsel (Open Source Legal Team) for Red Hat, Inc., the world’s leading provider of open source software solutions. Jeffrey also serves as Adjunct Professor of Law at the University of North Carolina.
More about me

9 Comments

Avatar
Amol Khiste | January 18, 2017
No readers like this yet.

Since GPL requires providing access to source code, and AGPLv3 Section 13 is an *additional* condition (specifically added to plug the loophole in SaaS-like software), does not it imply that AGPLv3 also requires providing source code access, irrespective of whether it is modified or not?

Avatar
Philippe Ombredanne | January 22, 2017
No readers like this yet.

See my other comments. If there is no Section 13 provision in place to download the corresponding source code and you use the code unmodified, the AGPLv3 is not different from the GPLv3: you are may be propagating but you are not conveying and the copyleft is triggered by conveying not by propagating when you are not distributing a copy IMHO.

Avatar
Bruno Lowagie | January 23, 2017
No readers like this yet.

Two examples: a Document Management System comes as a war file covered by the AGPL. In that case, you are using the copyrighted work as-is. You add documents to the system, maybe you change some settings, and so on. This use does not lead to any of these documents or settings to become open source. However, suppose that you are creating your own Document Management System using an AGPL library as an essential component, you are creating a work based on that AGPL library in a way that requires copyright permission. According to article 0, this qualifies as modification because you are creating a work "based on" the earlier work. I quote: To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. Asking "where in the AGPL does it say that..." doesn't make sense in this case, because the AGPL refers to copyright law where it says "in a fashion requiring copyright permission."

Avatar
Purple Library Guy | January 23, 2017
No readers like this yet.

Ohhhh, now I get it--this is an attempt to make "modify" in the AGPL mean something different from "modify" in the GPL itself, such that you can do things that would be considered "modifying" in the GPL (and hence trigger copyleft) and claim they don't constitute "modifying" for purposes of the extra proviso in the AGPL (and hence won't trigger copyleft), so you can incorporate AGPL code into larger closed programs and still keep them closed.

Yeah, good luck with that. Actually, no, bad luck with that--if anyone tries that and tries to defend it in court I hope they crash, burn, and lose all their money. I think we can be fairly definite that the authors of the AGPL would hope something similar confronted with this sophistry, and if it looks like there's the slightest chance the dodge would work legally they will patch the license to block it in future.

Avatar
Purple Library Guy | January 23, 2017
No readers like this yet.

No. It is plugging a different "loophole" from that. If you didn't modify it, there is nothing for you to have a duty to provide source to. The users can get the source wherever you got it.

That said, if you didn't modify it, you have nothing to protect either, so it costs you nothing and would be a neighbourly gesture to at least provide a link to the Github or whatever.

Avatar
jk | January 19, 2017
No readers like this yet.

In my humble opinion it is not as simple as you are saying.
"Not modifying" still does not take away the copy left effect of the AGPL if it's a part of your program.
Hence the conveyed work (meaning your program) if linked with AGPL libraries still has to be available in a source code as a whole. Section 13 mentions that linking and in my perception relates to section 1 “Corresponding Source” (basically anything that is need for the program to run...).

Coming from that you really don't modify the original AGPL part but still you are obliged to reveal the source code of a whole combined work :)

All the above is required unless the original AGPL parts are aggregated (Section 5) or they are not a “Corresponding Source” as per Section 1.

I'm happy to discuss if you disagree the license is pretty complex...!

Avatar
Philippe Ombredanne | January 22, 2017
No readers like this yet.

The key point is that AGPL's "network copyleft" is triggered by conveying. And using unmodified (even in a public web app) is not conveying but at best merely propagating and is in this case the copyleft is not triggered. This is a subtle but essential difference IMHO.

Avatar
Bruno Lowagie | January 23, 2017
No readers like this yet.

If your interpretation is correct, you "degrade" the AGPL to the LGPL, and that's not what the AGPL is about. I am not a lawyer, but I know Math. In Math, you can prove or disprove something with a "reductio ad absurdum." Let's suppose that you are right, and that company A can use an AGPL library X inside a closed source web application, as long as company A does not modify a single byte of library X. If that is the case, modification of any AGPL library would never lead to the obligation of sharing source code, because one could always introduce a middleman to apply the modification. Company A could use middleman B to apply the desired modification. Middleman B creates library Y, which is library X with the modification. Middleman B releases library Y under the AGPL (as he should). Now if what you claim is true, company A can now use the modified library X (aka library Y) in a closed source application, and you have shot a hole in the AGPL that reduces it to the LGPL in the context of server-side applications. Since it is absurd that the AGPL is equal to the LGPL when used in a web application, your initial premise must be wrong, wouldn't you agree? Don't you agree that there is no such loophole in the AGPL?

Related Content

Creative Commons LicenseThis work is licensed under a Creative Commons Attribution-Share Alike 4.0 International License.