Outsourcing Your GPL Obligations
Thu, 25 Oct 2012
Version 3 of the GNU General Public License updated a free software license that was, at that point, sixteen years old since version 2 and 18 years since version 1.
There had been numerous legal and technological changes since these older versions were published and it was time for a new version to address these matters.
One improvement clarified the distribution of source code. If you were distributing software licensed under version 2 of the GPL solely over the internet, version 2 said in part that
...offering equivalent access to copy the source code
from the same place counts as distribution of the source
code, even though third parties are not compelled to copy
the source along with the object code.
I know some that take this to mean they can tell their users to "get the source code from my upstream provider", in the cases where is one, but that's not really what it says. When someone has to go somewhere else to get the source code for the program then you're not really offering "access to copy the source code from the same place" which is what the license says. I read this that the source code and object code need to be available from the same place, side by side.
Version 3 provides additional flexibility for source code fulfillment in section 6 by saying that the source code can be on a different server and that server can be operated by a third party (your upstream for example.) This isn't something that GPLv2 says, so this is yet another an example of how version 3 has improved the license when compared to version 2.
Although version 3 may permit someone to refer their users to their upstream provider it's not a requirement. When someone does this I say that they're "outsourcing" their GPL obligations and it raises certain concerns. For example: Can you guarantee that your upstream will still be available in the future, at least long enough to satisfy your obligations under the license? Depending on the specifics your obligation to provide the complete and corresponding source code for that particular version of the program could last for many years if you're using #2 from section 6b.
Even if they are still around can you guarantee that they will still have that particular version of the software available for download later on?
Although version 3 permits you to outsource fulfillment of the source code to someone else this can't be used as a way to get out of your obligations. You remain responsible for ensuring that there is source code available but how can you ensure it will be if you're outsourcing the fulfillment of that critical component to someone else? Yes you can save some disk space and bandwidth by referring people to somewhere else - which is worth exactly a penny and a half at the current price of each - but the potential savings are so small while the potential costs for non-compliance are so high that outsourcing your GPL obligations really doesn't make sense.