Are you requried to release the source code to your website?

[davidbarratt]

Since CiviCRM is licensed under the AGPL, which means that you must share the source code with any network user of your application, and the AGPL forces applications that use AGPL code (modified or not) to also be licensed under the AGPL, logically it sounds like any website that uses CiviCRM (since it's an application), must provide the source code to their site to any person who access's their site.

Is this correct? Are websites that use CiviCRM legally forced by the AGPL to provide their source code to anyone who accesses the site?

Thanks!

[totten]

https://civicrm.org/agpl-license-faqs

IANAL... Some of the comments in the FAQ are perhaps dated (eg the discussion of GPL-AGPL interplay reflects some interpretations of older versions), but the overarching point remains. As long as the various programs (eg Drupal and CiviCRM; or Joomla and CiviCRM) remain separate, then the answer is "no" -- it's mere aggregation and not derivation.  Aggregation does not trigger virality.

To be clear, though... If you make changes to the main CiviCRM code, then that needs to be shared under AGPL.

[davidbarratt]

Those FAQ's don't line up with what is in the GPL's FAQ:
http://www.gnu.org/licenses/gpl-faq.html#LinkingWithGPL
https://www.gnu.org/licenses/gpl-faq.html#IfLibraryIsGPL

Since the code of the site is "Linking" (i.e. it's using a php's require() or include() functions to build a siingle application from library code) to CiviCRM, and the AGPL does NOT have a Linking exception http://en.wikipedia.org/wiki/GPL_linking_exception . The only exception built into the AGPL is if the code is a System Library http://www.gnu.org/licenses/gpl-faq.html#SystemLibraryException but it doesn't look like CiviCRM would be considered a System Library (maybe Drupal would be, but it doesn't matter since it's GPL, not AGPL).

According to the AGPL, it's irrelevant if I modify CiviCRM or not, if I'm linking to it, I fall under the same terms as if I had modified it.

Anyways, what CiviCRM is saying seems inconsistent with what the license actually says.

I don't understand why CiviCRM is licensed under AGPL and not GPL (which makes a huge difference).

Thanks!

[totten]

(Again: IANAL)

Interesting that you quote the Wikipedia article. The article generally accepts FSF's framing of the issue, but even so it points out:

There is a public perception, unsupported by any legal precedent or citation, that without applying the linking exception, code linked with GPL code may only be done using a GPL-compatible license

This hints at the broader conflict over linking -- and there are a few schools of thought on it. FSF (and various vendors) in one school of thought assert that linking has some special significance which requires the copyright holder's permission. This serves their interests because it puts them (as copyright owner) in a stronger position, and I think it's gotten some traction in technical circles because it provides the kind of simple, mechanistic rule that programmers are accustomed to. But if you follow their arguments through, you find some weird results (like: "linking" two workflows with a C function triggers virality but linking the same workflows through a Unix pipe, network socket, or webhook would not).

There's a competing school of thought which argues that linking is merely a matter of referencing names for functional reasons - that you don't need a copyright holder's permission or license for linking. FWIW, I personally feel this theory has a better grounding in the spirit of copyright, that it better serves the policy goals of a healthy technology market, *and* that it better serves coders' interests of free and open development... But I understand how different opinions arise on that. And IANAL.

Regardless, IMHO, it's better to focus less on the legalistic question and more on the ethical and practical questions, like: "What is the intent of CiviCRM's license structure and how can I avoid a conflict with CiviCRM LLC?" My impression (based on the FAQ and discussions with community members): the intent is to provide copyleft without a SaaS-loophole. The intent is not to impose hard-line virality on folks who merely access documented APIs.

[davidbarratt]

The Wikipedia source used for that statement is this:
http://books.google.com/books?id=S4d9SzBjGIgC&pg=PA44&#v=onepage&q&f=false

Which says nothing of the sort. It does say:

This means if you use even a tiny bit of GPL code in the source code of another product, the resulting product becomes open-source carrying a GPL License.

So there is no citation for the statement in the Wikipedia and it can be disregarded as non-factual. It's entirely possible that there is no legal precedent for it, but that doesn't really mean anything other than that the concept has never been tried in court.

The term "linking" or "link" can be rather confusing. In some contexts it means "to reference" in others it means "to include". From here on out I'll use "reference" and "include".

Let's compare this to a book:

If I reference an existing book (in the footnotes for instance). I'm in no way violating copyright. I'm simply providing a citation for my own work. This is exactly what is done in the Wikipedia. It doesn't matter what the license is of the referenced work, I am still well within my rights to reference it (even if the reference is inaccurate). If the user wants to get the content of that reference they have to go and get the book (electronically or otherwise).

In software, referencing is done all the time. You can reference PHP by calling a PHP function. You could reference GD, Imagemagick, etc. (all of which would be system libraries). You could even use a dependency management tool (like Composer, https://getcomposer.org) to reference a dependency of your project, without actually including the project itself in your project. This would allow you to distribute your application to users without actually including the dependency itself. As an example, Drupal.org expressly forbids hosting third-party libraries in your contributed code on their website: https://www.drupal.org/node/422996 . Because of this, you must use either Libraries (https://www.drupal.org/project/libraries) or Composer Manager (https://www.drupal.org/project/composer_manager) to give the user an easy way to download your referenced libraries.

Back to books, I recognize there are instances where you can quote a small portion of a book and insert it into your own under the terms of Fair Use (http://en.wikipedia.org/wiki/Fair_use). What you cannot do though, is include the ENTIRE book in your book. In the same way, you are not allowed, under the GPL to include ANY portion of the code (I suppose other than what can be considered "Fair Use") in your code.

My website does not reference CiviCRM. When someone accesses my website, the server compiles & executes index.php. This file includes the entire code base of CiviCRM into index.php before it is compiled at runtime. It would be like me writing a book that consists of 80% of a complete Drupal book, 10% of a complete CiviCRM book, 9% of various complete children books, and 1% of my own work. I'd then slap my name on this book and distribute it to the world. Of course that would be violation of every person's (in that list) copyright. You can't compile a bunch of others people's work and call it your own. Well, actually, you CAN do this, but if you did, you can't distribute it. This of course works really well in GPL. I can use Drupal and a ton of modules and my custom code as one single application (index.php) and as long as I don't distribute the application to a third party, everyone is happy.

This is not the case with AGPL. With AGPL, network usage of index.php (i.e. anyone who goes to my website), constitutes distribution of my application to that user. Because of this, as I've explained above, I'm in violation of Copyright Law and the AGPL.

I understand why CiviCRM is licensed under the AGPL. It prevents someone from taking CiviCRM, modifying it to be a SaaS product and releasing it without having to release the modifications. However, from the same logic (and legal license) no one can include CiviCRM into their public project without sharing the source code to the whole project. The legal view of this is important, because the FAQ's are not going to hold up in court. The only thing that will is Copyright Law and CiviCRM's License (AGPL). I'm not worried about CiviCRM, LLC suing everyone for their source code. I can however, see CiviCRM, LLC either being payed to sue others (i.e. if Salesforce wanted to get everyone off of CiviCRM), or CiviCRM, LLC giving a 3rd Party the right to sue on their behalf (like the RIAA). If you break CiviCRM's copyright, they, at anytime in the future, have the right to force you to release your source code. This may not be a risk most companies can take.

Anyways, I think CiviCRM needs to amend their license as soon as possible.

Thanks!

[totten]

The Wikipedia source used for that statement is this:
http://books.google.com/books?id=S4d9SzBjGIgC&pg=PA44&#v=onepage&q&f=false

Which says nothing of the sort. It does say:

This means if you use even a tiny bit of GPL code in the source code of another product, the resulting product becomes open-source carrying a GPL License.

Agree, Wikipedia's citation sucks, but then... the whole frame of that Wikipedia article implies a certain conclusion. So instead:

http://lmgtfy.com/?q=software+copyright+and+linking

Links #1 and #2 are specifically about FSF's interpretation. Link #3 (from OSI's General Counsel) states an alternate view. #4 and #5 are academic articles (from the law journals of UC Berkeley and Boston University) which attempt to give more depth on the issue. They're a bit long, and IANAL, but they communicate one thing clearly: it's not just a question of copying two programs into the same memory bank.