58

Since Git is licensed under GPLv2, and, to my understanding, GitHub interacts with Git, shouldn't the whole GitHub codebase be open-sourced in a GPL-compatible license?

GBF_Gabriel
  • 551
  • 4
  • 7
  • 59
    Can you please point to the specific paragraph in the GPL which talks about interacting? Hint: there isn't one. – Jörg W Mittag Jan 25 '17 at 20:56
  • 14
    @JörgWMittag: confusion to someone who isn't well versed in the subject over whether network access constitutes 'releasing' or propagating isn't unreasonable. – whatsisname Jan 25 '17 at 20:59
  • 1
    It's simple: github are not handing you anyone's licensed work -- or rather, to whatever extent they do do that, they follow the license terms. Can you point to some work "fixed in a tangible medium" that they hand you that contains work they licensed from others under the GPL? – jthill Jan 26 '17 at 00:15
  • @jthill: the OP is talking about the GitHub Inc's software itself, not the projects that they host. – whatsisname Jan 26 '17 at 03:18
  • 1
    @whatsisname . . . assume that I knew that, please, then reread what I wrote. – jthill Jan 26 '17 at 03:21
  • @jthill It would be sufficient to show that they hand you code that is derivative of something licensed to them under the GPL. One could make an (admittedly very weak) argument that their client-side Javascript or dynamic HTML might qualify. – David Schwartz Jan 26 '17 at 03:47
  • @DavidSchwartz I'd think if anybody thought they could get away with anything like that it'd have been tried somewhere at least once. The Judge rained scathing mockery down on SCO for a line not half that ... weak. Please try to find some, _any_, of what the Judge excoriated SCO for not having any of (that would be "actual evidence") before repeating that claim again. – jthill Jan 26 '17 at 05:07
  • 1
    Maybe if git were under the [AGPL](https://en.wikipedia.org/wiki/GNU_Affero_General_Public_License)... – Tobias Kienzler Jan 26 '17 at 07:46
  • Whatever other arguments there are, you have no standing to sue unless _your_ copyright has been infringed, that is if you are one of the developers of git. If the git developers are fine with it, github can do what they want. – gnasher729 Jan 26 '17 at 09:04
  • Shouldn't not should't – Tim Jan 26 '17 at 09:45
  • 3
    @TobiasKienzler it should be noted that "git" is two separate but related things - firstly its a standard defining a particular method of source code versioning, and secondly its a reference implementation of that standard. Both things have the same name - git. Only one of those things can be licensed under the GPL, AGPL etc - if you create your own implementation from the standard, you can license it any way you want and the creators of the standards or reference implementation have no leg to stand on with regard to your code. – Moo Jan 26 '17 at 12:09
  • @Moo Interesting point. Though if the _standard_ git were published under an "Affero CC-BY-NC-SA" license... – Tobias Kienzler Jan 26 '17 at 12:15
  • 6
    @TobiasKienzler the recent Oracle-Google court case over the Java spec basically means there is no license you can use to prevent a *reimplementation* of the standard. – Moo Jan 26 '17 at 12:47
  • Owned.... I so like it that it shouldn't be open source! – Menelaos Jan 26 '17 at 16:16
  • 1
    This question belongs on http://opensource.stackexchange.com/ though I personally believe this type of problem is inherent with having too many (overlapping) SE sites. – Celeritas Jan 27 '17 at 11:53
  • @MenelaosBakopoulos It certainly should be, but isn't required to be. – Miles Rout Jan 31 '17 at 21:18

3 Answers3

110

3 reasons why:

  1. According to the terms of the GPL, people accessing GitHub via the web is not considered releasing (or propagating in GPLv3 terms), and so GitHub is not required to share their source code. If GitHub was to sell a version of their service (which they might do, I haven't bothered to look) where they send you their software and you run an instance of GitHub internally on your own network, then they might be required to also ship the source code, unless:

  2. GitHub may very well be accessing the Git client through command-line invocations, in which case that is considered communicating "at arms-length", and thus does not make GitHub a derivative work and therefore not subject to the requirements of the GPL.

  3. Additionally, GitHub may very well not even be using the Git software and has written their own core "git implementation" and has re-implemented its interfaces to maintain compatibility, in which case again the GPL's requirements would not come into play.

Martin Schröder
  • 354
  • 1
  • 4
  • 19
whatsisname
  • 27,463
  • 14
  • 73
  • 93
  • 47
    Actually, AFAIK, GitHub has their own implementation of Git, so the license of Linus Torvald's implementation of Git is irrelevant anyway. – Jörg W Mittag Jan 25 '17 at 21:00
  • 2
    @JörgWMittag: I mentioned that in my answer. I edited the answer to make that reasoning it's own rather than part of reason 2. – whatsisname Jan 25 '17 at 21:04
  • 4
    @whatsisname you should probably mention the concept of "linking" explicitly and describe how it is relevant to GitHub using Git. –  Jan 25 '17 at 23:32
  • 18
    Github does release their software. https://enterprise.github.com – Bryan Chen Jan 26 '17 at 01:36
  • 8
    "3) Additionally, GitHub may very well not even be using the Git software and has written their own core "git implementation" and has re-implemented its interfaces to maintain compatibility, in which case again the GPL's requirements would not come into play." I think @whatsisname was right because Github uses libgit2. links: https://libgit2.github.com/, source: https://github.com/libgit2/libgit2 – andytime Jan 26 '17 at 02:40
  • 8
    It's important to note that LibGit2 is licensed under GPL2 ***with linking exception***. – RubberDuck Jan 26 '17 at 10:39
  • 1
    Github does distribute a version of their product to customers. It's called Github Enterprise. Installation instructions at https://help.github.com/enterprise/2.8/admin/guides/installation/installing-github-enterprise-on-openstack-kvm/ – bdsl Jan 26 '17 at 13:50
  • 8
    @RubberDuck: It's important to note that libGit2 is owned by github and thus they don't need a license to use it therefore they don't need to comply with whatever it's licensed under. Even if one were to argue with that they, as the owner of libgit2, can license it to themselves under a custom license. – slebetman Jan 26 '17 at 14:43
  • 3
    Please update the answer to point to libgit2, since this is the right and clear answer to my question. – GBF_Gabriel Jan 26 '17 at 14:59
  • @andytime would you please post your comment as an answer? It is really helpful! – Michael Dorner Jan 26 '17 at 18:59
  • @slebetman do you have a source for that? I know at least one guy (formerly) at Github worked on the project, but was unaware the project was owned by them. – RubberDuck Jan 26 '17 at 22:41
6

In addition to the other answers, I would add that the FSF's views on when two cooperating programs form a single work are quite vague:

Furthermore, these views have never been tested in court, except in Germany:

It's an ongoing case but so far the judge has opined that one of the key considerations listed by the FSF for determining whether two programs form a single work, namely, sharing the same address space, has no relevance to (German) copyright law. It should be noted that the FSF is not involved in the lawsuit but the litigating party has been advocating for the FSF view on aggregation/derivation.

So, for persons writing the next Github, I would say, don't assume you are on the wrong side of the law when the FSF says you are (and vice versa).

DepressedDaniel
  • 936
  • 5
  • 6
  • I'd have to presume it's infrequency in court owes to it being something that can't be enforced. I remember a talk of Stallman were he mentioned some technology company DRM'ing software on a disk and the software was build with copy-left Free components on the disk. Stallman himself in the presentation noted that the vendor never faced legal action against that. – Lan Jan 26 '17 at 12:16
  • 1
    @Lan Well, DRM is a separate issue which comes into play only with the newer GPLv3 and not with the older GPLv2. By any interpretation of GPLv2, a vendor is in their right to supply you with the source for GPLv2 copyleft components without giving you any practical way to execute modifications on their proprietary hardware. – DepressedDaniel Jan 26 '17 at 18:39
  • @Lan Don't assume that. A view *at least* as plausible, looking at the enforcement history, is that violators facing legal action typically get into compliance. Whether it *can* be enforced is not the same as whether someone takes the time to do so, and Busybox is in an interesting spot where it's very likely to be included in non-compliant products and the author is up for a challenge. – chrylis -cautiouslyoptimistic- Jan 26 '17 at 21:45
  • @chrylis Not sure which author of BusyBox you mean. Rob Landley started the lawsuits but he was disgusted by the results, and eventually left BusyBox to work on ToyBox (which avoids GPL entirely by being BSD licensed): http://brownrudnick.com/blog/emerging-technologies/is-busybox-too-dangerous-to-use/. Basically, rather than stopping at getting any modifications to BusyBox made public (there never were any), the situation was abused to demand money for financing future lawsuits and the opening up of proprietary components completely unrelated by BusyBox by any legal theory. Sad. Simply sad. – DepressedDaniel Jan 26 '17 at 22:38
  • Moreover, the FSF explanations of what they mean by "linking" make no technical sense. For example anyone who uses Java knows that the sentence "If modules are designed to run linked together in a shared address space, that almost surely means combining them into one program." is nonsense. – Michael Kay Jan 27 '17 at 09:09
  • @MichaelKay Well, linking in Java is always going to mean dynamic linking. But the FSF's position is that the difference between dynamic and static linking is purely technical, and I would tend to agree with this view. However, rather than agreeing with the FSF position that a derivate work always results from linking, my personal inclination is to say that it depends on the nature of the interface between the components, and that a library with a well-designed API almost always forms an aggregate work with its consumer, regardless of whether it is linked statically or dynamically. – DepressedDaniel Jan 27 '17 at 19:21
  • @DepressedDaniel So if my product uses an XML parser API and there are three parsers that implement that API and one of them is GPL and I tell the user they can use any of the three, am I linked to a GPL product or not? What happens if the GPL parser was developed after I shipped my code? The whole story is completely incoherent and I did well to stay well clear of it. – Michael Kay Jan 27 '17 at 22:40
1

GitHub doesn't use Git. They use their own implementation, libgit2, which is released under the GPLv2 with Linking Exception. Therefore, it is not necessary for GitHub to release the source code to comply with the license.

Nathan Osman
  • 710
  • 6
  • 16