Is there a loophole in the GPL allowing binary-only distribution?
<p>I asked this question a long time ago <a href="https://softwareengineering.stackexchange.com/questions/262720/does-releasing-a-binary-work-under-gpl-mean-source-must-be-provided">here</a>, which was the wrong place, and got a bunch of conflicting answers from a bunch of non-lawyers.</p>

<p>I'm hoping for a more definitive answer here, ideally from some actual lawyers. To be clear, I'm interested in understanding the <em>legal</em> truth - what would likely happen in a dispute that went to court, where a judgement would have to be based on the actual wording in the license - not what the goal of the GPL is, the meaning of software freedom, what's morally correct, etc.</p>

<p>To be clear, I'm not intending to exploit any such loophole, if it exists. My goal is to understand if the GPL could have a specific weakness in the face of a determined adversary, so that weakness could possibly be addressed.</p>

<p>Original question follows:</p>

<p>========================</p>

<p>I have two "dumb questions" but their combination is somewhat surprising ...</p>

<p>Suppose I create some new program from scratch by writing source code <strong>S</strong>, which I keep private, and then compiling <strong>S</strong> into a binary object <strong>X</strong>. Then I publicly release <strong>X</strong> (but not <strong>S</strong>) on my website under the GPLv3 license.</p>

<p>Dumb Question #1: am I in any way required to make <strong>S</strong> public?</p>

<p>Seems like here the answer is "no": the GPLv3 is a license, with restrictions, that is granted to, and applies to, the <em>recipients</em> of some work (in this case the work is <strong>X</strong>). The license does not apply to <em>me</em> because I'm the one offering the license, not accepting it.</p>

<p>So it appears there is absolutely no obligation for me to ever provide source code <strong>S</strong> to anyone. Of course, any recipient of <strong>X</strong> is still free to copy and distribute the binary <strong>X</strong> to anyone they want: the GPLv3 only requires them to also provide whatever source came with it, which is none.</p>

<p>So far so good... next consider this clause in the Affero GPLv3 (<a href="http://www.gnu.org/licenses/agpl-3.0.html#section13" rel="nofollow noreferrer">section 13</a>):</p>

<blockquote>
  <p>Notwithstanding any other provision of this License, you have
  permission to link or combine any covered work with a work licensed
  under version 3 of the GNU General Public License into a single
  combined work, and to convey the resulting work. The terms of this
  License will continue to apply to the part which is the covered work,
  but the work with which it is combined will remain governed by version
  3 of the GNU General Public License.</p>
</blockquote>

<p>So that sounds like I can take my binary file <strong>X</strong>, which is licensed under GPLv3, link it with an unmodified, third-party, AGPLv3 licensed library <strong>Y</strong>, creating a combined binary <strong>Z</strong>, and distribute <strong>Z</strong> under this clause.</p>

<p>When distributing <strong>Z</strong>, I will have to provide the source that came with <strong>Y</strong> of course per the AGPLv3, but by the above exception, the part of <strong>Z</strong> that is <strong>X</strong> is still under the GPLv3, and by the answer to Dumb Question #1, its source code can remain private.</p>

<p>Note that the GPLv3 has a <a href="http://www.gnu.org/copyleft/gpl.html#section13" rel="nofollow noreferrer">symmetrical clause</a> as well, this works with both GPLv3 or AGPLv3 third-party libraries:</p>

<blockquote>
  <p>Notwithstanding any other provision of this License, you have
  permission to link or combine any covered work with a work licensed
  under version 3 of the GNU Affero General Public License into a single
  combined work, and to convey the resulting work. The terms of this
  License will continue to apply to the part which is the covered work,
  but the special requirements of the GNU Affero General Public License,
  section 13, concerning interaction through a network will apply to the
  combination as such.</p>
</blockquote>

<p>Dumb Question #2: Does this logic not mean that there is a simple, legal way to combine (i.e., compile and link together) and distribute proprietary code with GPLv3 or AGPLv3 third-party libraries, without having to disclose the proprietary source code, as long as you are willing to allow your proprietary binary to be distributed freely?</p>

<p>Do any companies already do this, e.g., for binary firmware that can be incorporated into Linux?</p>

<p>There is no loophole because a work released in object code form only — without the Corresponding Source — is not released under GPLv3, even if you say it is.</p>

<blockquote>
  <p>GPLv3 only requires them to also provide whatever source came with it</p>
</blockquote>

<p>False. Providing the Corresponding Source is compulsory (§6 as pointed by @cHao). If they do not have access to it, it means the work has not been released under GPLv3.</p>

<p>The GPL doesn't just require the distribution of "whatever source came with it". 
See §1:</p>

<blockquote>
  <p>The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities.  </p>
</blockquote>

<p><em>That</em> is what is required in order for others to comply with the license. An empty <code>src</code> folder simply won't cut it. A recipient of your software must be able to give others access to enough code to rebuild it, or they can't comply with the license, and thus are not authorized to distribute the software.</p>

<p>As the sole creator of a not-already-covered work, you are not bound by that restriction. But assuming you're not just playing boneheaded legal games, you release such a work under the GPL precisely because <em>you want others to have the source code</em>. If you don't, then you picked the wrong license. The GPL doesn't prohibit linking to non-GPL code, so there's no requirement to work around.  (Some companies do indeed release binary-only software...but they don't release it under the GPL.)</p>

<p>Now, if your intent is to release software under the GPL in order to satisfy the requirements for derivative works, then tough luck. See §6:</p>

<blockquote>
  <p>You may convey a covered work in object code form under the terms of sections 4 and 5, <strong>provided that you also convey the machine-readable Corresponding Source under the terms of this License</strong>...</p>
</blockquote>

<p>A "covered work" is the program, or <em>a work based on the program</em> (ie: your derivative work), so your agreement with the prior author requires you provide enough source code to rebuild your software.</p>

<p>"The (GPL) license does not apply to me because I'm the one offering the license, not accepting it."</p>

<p>Sorry, but you're mistaken right there, and it's the core of the argument. You are not forced to offer the GPL license to sublicensees, as you are the original author. And you have the right to an any moment stop offering it. But when you do offer such a license, and anyone accepts the license, then the offer and its acceptance create a mutually binding contract. That is basic contract law.</p>

<p>Since the GPL license grants the receiver of binary code the right to source code, since you offered a GPL license and someone accepted your offer, you are therefore bound by your offer of source code.</p>

<p>The remainder of your question appears to build on this false premise, and is therefore unanswerable.</p>

<p>When you created a program (from scratch), you are the author of that program, aka the <em>copyright owner</em>. Such ownership comes with certain rights, granted to you by the Copyright Law of your country. If any other person or organization wants to use your program, they must obtain a permit from you, which you usually give in the form of a <em>license</em>.</p>
<p>Now, the text of the license is addressed to a user of your program, not to you the author. As such, the word &quot;You&quot; within the license means &quot;the user&quot;. Section 0 of GPLv3 even states this explicitly:</p>
<blockquote>
<p>Each licensee is addressed as “you”</p>
</blockquote>
<p>So, this is the first source of confusion that some have expressed: the GPL license puts the obligation to provide the source code on the <em>user</em>, not on the <em>author</em>. In fact, I do not see any kind of obligation that the license imposes on the author. So even if you live in a jurisdiction where a license can be considered a contract, this particular contract does not bind you in any way.</p>
<p>In short: <strong>no</strong>, you, the author, do not have to provide your source code if you don't want to.</p>
<p>One of the commenters mentioned that based on the preamble's statement that <code>Our GPLs are designed to make sure that ... you receive source code or can get it if you want it</code>, a judge may issue a ruling that this creates an obligation on the author to furnish the source code. However, I consider this to be very unlikely, as introductions typically have little legal weight. In fact, the introduction itself says as much at the end: <code>The precise terms and conditions for copying, distribution and modification follow.</code></p>
<p>Another point of interest is, as mentioned by @cHao, whether the users of your program will be able to create derivative versions based on your Program. Section 6 of GPL requires that the derivative (&quot;covered work&quot;) be conveyed in &quot;Corresponding Source&quot; form, which includes source code for both their and your code. Obviously, they wouldn't be able to satisfy this requirement. However, there's also Section 5, which allows the user to</p>
<blockquote>
<p>... convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4,</p>
</blockquote>
<p>whereas Section 4 does not require <em>Corresponding Source</em> but only</p>
<blockquote>
<p>You may convey verbatim copies of the Program's source code <strong>as you receive it</strong>.</p>
</blockquote>
<p>Thus, the users of your program will be able to create derivative works, but will be forced to distribute them in source form only.</p>
<p>Lastly, it is always useful to think who has the standing to sue in case the terms of the license are violated. For example, if the user of your program goes on and distributes his modified version under the terms of Section 6, then you (the author) will be the only party with the standing to sue, accusing your user of violating the terms of the license by not providing the source code of <em>your program</em> (which they never had). I have a feeling, however, that the judge will not find such a case persuasive.</p>

<p>The consequence of violating the GPL license is that the copyright holder can successfully sue you for copyright infringement.</p>
<p>If you, Mr. A, write some software and are the sole copyright holder, you can absolutely release it under the GPL license and not provide source code, because you yourself are the only one who can sue you for doing it, and you are not going to do that. Of course that is a rather pointless thing to do and doesn't serve any good purpose. (I can't distribute your software further under the GPL license because I have no way to give anyone the source code, I can only point them to your website. And I can't create any derived work, because I don't have the source code. So the GPL license doesn't make any difference. )</p>
<p>Now if you combine your software with my GPL licensed software, the result has two copyright holders: You and me. If you distributed the combined software without providing source code, or even just without the source code for your part, you are violating the GPL license and <em>I</em> can sue you for copyright infringement. So the answer to &quot;Dumb question 2&quot; is: Absolutely not.</p>

<p>you include an AGPL licensed library, which means that ALL your code, as well as ALL code linking to it, now MUST be released under AGPL. Which is impossible as you include libraries that are not AGPL licensed, so you're already violating the AGPL. Whether you also violate GPL3 is irrelevant by now.</p>
<p>And this doesn't just relate to using AGPL code in your application, even if you were to compile the AGPL dependent part into a web service and call that remotely (over a network connection) from the rest of your system that entire system now becomes infected by the AGPL. Even worse, if you call a service created by someone else that is AGPL licensed (even if they fail to disclose so! possibly because they don't realise it) your code is now infected by the AGPL as well.</p>
<p>Such is the toxic nature of the AGPL, and which is why any sane person would never allow it anywhere near their computers, and why you should always be extremely wary of calling any 3rd party web service or other resource from your software.</p>
<p>Note though that you don't have to actually make your source code publicly available for download. You just have to provide a means for people to receive it that is available for any interested party. So an email address where the code can be requested suffices, a physical mailing address where a CD-ROM can be requested MIGHT suffice as long as there are no shipping restrictions that prevent shipping those CDs to parts of the world.</p>

gpl