GPL vs. NDA dilemma

Speak to a lawyer in your jurisdiction, but I would say that this falls under section 6 of the GPL at least (my asterisks for emphasis):

"6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. **You may not impose any further restrictions on the recipients' exercise of the rights granted herein**. You are not responsible for enforcing compliance by third parties to this License."

Therefore, the companies you work for may not impose an NDA on you as far as any work on GPL projects goes, or that's what I would assume from it.

Blane.

I've been modifying GPLd programs for my own use. Can you *demand* that I give you my modifications? I don't think so.

Only if *you* distribute the binaries. From GPL Preamble:

For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.

Cheers,

Not really.

Yup.

Wrong. You are only required by the GPL to provide sources to people to whom you have provided binaries. You have done that.

Then don't.

Under the standard GPL, you're not obligated to give source code to anybody except those to whom you've given binaries.

I assume that means only the modified binaries. i.e. does the source code have to match the binaries? So if he gives a copy of the original binary set to someone else, he has to give them the original source as well.

Bob McConnell N2SPP

Yes. If you give somebody a binary of a GPL program, you have to give them the sources _for_that_binary_. Giving them sources for some other program would be pretty silly.

Correct.

Grant Edwards enlightened us with:

Clarification: you're required by the GPL to provide sources to people to whom you have provided binaries *provided that* you distribute the sources with binaries. Otherwise if you distribute binaries without sources, then any third party may ask for sources.

I know that doesn't apply in this specific case, but just wanted to be clear :-).

Jifl

That's not quite true either. You have to give it to a third party who gets the binary from the party you distributed to. I know the words in the GPL say "any third party", but the FSF has clarified in the GNU FAQ that the third party will have to present a copy of your written offer to distribute.

The idea is that the party you gave the binary to will be obliged to supply source code if they distribute. They can satisfy their obligation by giving the third party a copy of the written offer you made to provide source code to third parties. The third party then comes to you for the source code.

Isaac

In this case, I think it's all a purely "internal" modification anyway. The company in question modified the program for it's own internal use. The fact that the person who did it was a contractor rather than a "regular" employee probably doesn't matter.

Of course IANAL...

I once asked this during a discussion on GPL.

The result was quite clear: GPL requests that you offer to deliver the unrestricted source code with the binaries. Responsible for the procedure is the one who delivers the binaries.

You _do_ deliver the source code to _your_ contractor.

If _he_ refuses to deliver your source code to the clients _he_ delivers binaries made from your source code to, or tries to restrict them from redistributing it, _he_ is violating the GPL.

-Michael

I was talking about a company that distributes (sells) a product containing binaries from GPL source code modified by a contractor.

The company and contractor are two separate parties. The contractor distributed the binaries/source to his client. The client (company) in turn distributes just the binaries to customers in whatever product they're selling.

Let's say someone who has never heard of the company but has heard of the contractor tells the contractor to surrender all modified GPL source. The contractor is forced to say, "My NDA prevents me from disclosing my work".

The GPL doesn't require the contractor to redistribute his work. It says

So he can comply with the NDA by not distributing the binaries to that third party. Then he doesn't have to give them sources, either.

If they managed to get the binaries from someone else, they should go to them to get the sources as well (the GPL should ensure that this is possible).

That's the part I'm not too sure about.

I guess it depends on the contract. When I did contract work, the work done under contract belongs entirely to the contractor, just like work done by a regular employee. I didn't have any rights to the work and didn't "distribute" it to anybody: the owner of the work just used it. When I build a program here in my office for use by others in my company, I'm not distributing it to anybody (legally).

My point is that it probably was never "his work" at all. It always belonged to the contracting company if his contracts read anything like mine used to.

I believe the legal phrase for this is "work for hire".

They are in a legal context, and by corollary, in the GPL context.

With all due resp, I believe you mean the contracted work belongs to the company, not the contractor.

Yes, a contractor doesn't have rights to non-GPL source. That's legal and typical.

But in the spirit of the GPL, everybody on the planet has rights to GPL source whether in original or modified form. So a contract clause where "source code is the exclusive property of Company ABC" isn't binding if the source is protected by the GPL. But tech companies can and invariably do stipulate an NDA clause.

Yes, reasonably, there shouldn't be any GPL issues if you're just letting people use your GPL binaries on your machines.

No they don't. They have a pseudo-right demand source code if they receive a binary. Their position falls short of a right because they cannot enforce it at all other than by asking. Only the copyright holder of the original source code has any real ability to enforce the GPL.

And the pseudo right doesn't belong to everyone. No one can require that someone give them code merely because the code was licensed under the GPL. They have to be distributed a binary first.

Isaac

Yea, That's what I meant. I was using contractor (probably incorrectly) to refer to the "employer" and contractee to refer to the "coder".

Only if they've been given a binary.

So IMHO the real problem is whether selling "products" (embedded devices) that internally use software (i.e. binaries hidden somewhere in the device and not extractable with normal means) can be seen as _distributing_binaries_.

Diabolic question: if I send a binary to a customer in a sealed envelope, do I distribute it to the _postman_ wo carries the envelope ?

VictorVS enlightened us with:

Very much so. Anyone who uses the board is using the GPL'd code (or has the potential to). A postman merely transports the media - he doesn't use the code.

If they didn't they would be breaking contract law, and could have damages against them by the copyright holders as well as being forced to recall all their products, advertise to their customers, open up all their source code, etc.etc. You could also be criminally prosecuted under any anti-piracy laws in your country: breaking the EULA of a shrink-wrapped proprietary product is no different than breaking that of a GPL'd product IMHO.

The GPL is quite clear... if you distribute a binary based on the code you *must* accompany with it the source code, or an offer to receive the source code (or alternatively the offer you received to get the source code, assuming you didn't make any modifications). So the recipients *must* be informed.

Jifl

You mean like TiVo?