[Sorry, this ended up being longer than I'd hoped.]


Quoting Simon Hobson (linux@???):

> Indeed. If you have the source then they can't stop you forking the
> (GPL) project.

Or if you have the complete, buildable source code under any other open
source / free software licence. This subject comes up occasionally on
the OSI licence-discuss mailing list as 'What is the central idea of
open source?' My traditional answer is 'The right to fork, accompanied
by the means to do so.' Which is to say, forking (the right and means
to do it) is the _defining_ trait of open source.


> There was one other thing that came to mind earlier ...
> If ${company} decided to do that, and they had previously distributed
> binaries ... doesn't the GPL mean they are required to provide the
> sources to anyone they've distributed the binaries to ?

This is going to be one of those difficult conversations where people
keep wanting to rely on wording that implies incorrect concepts embedded
in the culture of technogeeks that cause them to get points of law
wrong. I'm going to try to explain this precisely as a legal matter.
(Note: This is not advocacy. I'm going to explain how the law works,
and how businesses interact with the law.)

Your term 'required' is problematically vague. Required by whom? Or
else what? (Typically open source people don't bother to think about
that.)

Exampleco, Ltd. is distributing binaries of a codebased issued under
(say) GPLv2 licensing terms, and then at some point ceases offering
matching source code to all recipients (or never provided any). This
divides into two subcases, and the difference is important:

Case A: Exampleco owns copyright title over all GPL-covered components
of what is being distributed.

Case B: At least some GPL-covered components are owned by a third party
and are being redistributed by Exampleco.

Ever since adoption of the Berne Convention treaty (and national
legislation to implement it), copyright title has vested in the
creator's ownership automatically at the moment of creation, and
automatically reserves certain 'exclusive' rights to the owner by
default, unless the owner conveys ('licenses') them out to recipients,
attached to instances of the covered work.

Exclusive rights applicable to software[0] are:

o to make copies
o to distribute copies
o to create derivative works[1]

(There are also what are termed 'moral rights of authors' in many
countries including yours, but I'll not cover that here.)

For example, USA Federal law enumerates these exclusive rights in 17
U.S.C. section 106, aka the Copyright Act:
https://www.law.cornell.edu/uscode/text/17/106 Applicable UK statute
law is the Copyright, Designs and Patents Act 1988 (CDPA):
http://www.legislation.gov.uk/ukpga/1988/48 Exclusive rights are
covered in Chapter II.

The enumeration of exclusive rights implicitly creates what one might
call an implied 'default licence': If I give you an instance of a
program I wrote but state no conveyance of permissions, I am implicitly
authorising your acquisition of the code. (What I mean, for example, is
that if I list my code as a tarball on my Web site for public access,
and you download it, I am implying that your download is authorised.)
Your _use_ of the code is outside the scope of copyright law, so you
don't need my permission to do so. By contrast, in that hypothetical,
you haven't received any of my exclusive rights, so, e.g., your
redistributing the program would be a tort (civil wrong), the tort of
copyright violation. Torts are not crimes, but I as copyright owner
could haul you into court and enjoin you from further distribution, and
possibly be awarded monetary damages.


Getting back to Exampleco, in Case A, Exampleco's right to distribute
its binaries with or without matching source code is inherent and not
subject to objection on copyright grounds, as each binary is an instance
of a work Exampleco owns, and the firm is merely exercising an exclusive
right. The firm is free to distribute code instances with any license
attached to each instance it wishes, including ones such as GPLv2 that
say it promises to make matching source available, without bothering to
actually do the latter. That sort of distribution might be odd and
erratic behaviour, but it doesn't infringe anyone's rights.

In Case A, if you download Exampleco's program, read the docs and
notices, and notice GPLv2 terms, you could attempt to demand the
matching source code, _but_ if Exampleco then ignores you and doesn't
comply, you would have no legal recourse, because Exampleco is not
subject to any obligation: It doesn't _need_ permissions granted to it
by GPLv2 or anything else. Its right to make brokenly packaged copies
(or unbroken ones) is an exclusive right.


Moving on to Case B: Here, Exampleco has acquired code created and
owned by Otherco. Otherco as owner offered its work on, say, its
otherco.co.uk Web site, and Exampleco downloaded it. As detailed above,
at this point Exampleco is _not_ required by any legal obligation to
accept any licence. It enjoys the benefit of Otherco's implied licence
inherent in the download offering to the public. Therefore, its
possession of the code instance is lawful, and it may _use_ the code
without violating anyone's rights. _If_ Otherco had merely offered the
code instance without conveying any of its exclusive rights, that would
be all Exampleco could do without committing a tort. _However_, in this
hypothetical, Otherco attached GPLv2 permissions. To paraphrase, GPLv2
states 'You _don't_ need to accept this license to possess and use this
work. However, if you want access to my exclusive rights to create
derivative works and redistribute, you must comply with the following
conditions in sections 2 & 3.'

Continuing the hypothetical, Exampleco either creates a derivative work
based on Otherco's copyrighted material and distributes that, or merely
redistributes Otherco's creation. Either way, Exampleco has just
exercised one or two or Otherco's exclusive rights.

Let us say that you receive the derivative work or redistributed copy
as a binary from _either_ Exampleco or from any other place whatsoever.[2]
You determine that Exampleco had been publishing the work at some time
within the preceding three years. You request matching source code
from Exampleco, politely citing its act of distribution and the wording
of GPLv2 clause 3b.

Is Exampleco committing a tort if it fails comply? Yes, but there's a
subtle but vital point to note: Its tort is not against _you_. If you
attempt to haul Exampleco into court on a tort of copyright violation,
your suit will be dismissed for _lack of standing_, because you are not
the owner of the work in question.

On the other hand, Otherco _could_ successfully haul Exampleco into
court and seek relief. Please note that Otherco could _not_ get the
court to order Exampleco to give you source code (at least in courts in
the UK, USA, Canada, Australia, NZ, and other places with
English-derived legal systems[3]), because 'specific performance' is not a
remedy available for the tort of copyright violation. Courts will
grant relief in the form of ordering that unauthorised distribution
_cease_ (e.g., order Exampleco to disable download), and may order
payment of monetary damages.


> So removing the sources from public repositories would actually be a
> breach of the GPL (given some limitations regarding timing).

Again, the phrase 'breach of the GPL' is slightly misleading wording.
That treats GPL as if it were a statute. It is not a law: It is a
licence conveying exclusive rights under copyright law, subject to the
licensee complying with certain conditions. If the licensee fails to
meet those conditions, then the licence is terminated (GPLv2 close 4 & 5).
_If_ the erstwhile licensee then continues to exercise exclusive rights,
then the owner of the relevant copyright title (but not third parties
such as you as a software user) may bring civil litigation for a
copyright tort.


The above is admittedly very detailed and picky in going through the
mechanics, but I was attempting to dispel some very common
misconceptions, such as the implication that violating a copyright is
in any way like a traffic violation ('breach', 'required') and the
common misconception that users who are _not_ copyright owners may
somehow seek redress in court.


> And that raises an interesting problem for other people distributing
> binaries. If (say) I were distributing binaries for ${foo} and relying
> on (say) a git repository for providing the source - where would that
> leave me if those git sources suddenly disappear ?

If you're talking about GPLv2, then please see clause 3c.


(I was the unofficial software-licensing at VA Linux Systems, Inc.
Note: I am not a lawyer, let alone _your_ lawyer. Accordingly, this is
not legal advice, as witnessed by the fact that my name doesn't say
'Esq.' after it, and also that this posting isn't accompanied by a large
bill. If anyone here has a specific legal situation needing advice,
consult a qualified attorney and don't rely on mailing list postings.)


[0] Software is covered by 'literary works', believe it or not. Other
categories such as musical performances, dramatic, and choreographic
works, pantomimes, and pictorial, graphic, or sculptural works reserve
to their creator two additional rights: the right of public display
and the right to perform. For USA details as an example, see
http://www.bitlaw.com/copyright/scope.html . (In theory, actually,
there's a right to perform that's applicable to software, but there's
been no caselaw to clarify what that means.)

[1] Because Linus Torvalds has frequently used the term 'derived work',
many Linux people opt for that phrase, but the correct term from copyright
law (within the English language) is 'derivative work'.

[2] Exampleco is _not_, contrary to your upthread claim, obliged under
GPLv2 clause 3b to furnish matching source only to people who've
received binaries from Exampleco. Exampleco's licence obligation is
invocable by 'any third party, for a charge no more than your cost of
physically performing source distribution'.

[3] Other groups of contries such as those using national legal systems
based on the Napoleonic Code, like most of Europe, probably differ in
the details of this.