Understanding Copyleft Licenses: GPL, LGPL, and AGPL

# Triggers GPL obligations
./configure && make && make install
cp binary /usr/bin/  # Distribution!

# Does NOT trigger (internal use)
./configure && make
./binary  # Internal use only

// GPL v3 prevents this:
if (verify_signature(binary) != OFFICIAL_SIGNATURE) {
    refuse_to_run();  // GPL v3 forbids this restriction
}

// Dynamic linking - Usually OK
#include <lgpl_library.h>
dlopen("liblgpl.so", RTLD_LAZY);

// Static linking - Triggers LGPL
#include "lgpl_source.c"  // Now your code has obligations

// Regular GPL - No source obligation for SaaS
app.get('/api', (req, res) => {
    useGPLCode();  // No distribution, no obligation
});

// AGPL - Must provide source to network users!
app.get('/api', (req, res) => {
    useAGPLCode();  // Network use triggers obligations
});

// AGPL compliance
app.get('/source', (req, res) => {
    res.download('source-code.tar.gz');  // Required!
});

# main.py (Your code)
import gpl_module  # Strong copyleft

class YourApp:  # Must be GPL now!
    def method(self):
        gpl_module.function()

// mpl-file.js (MPL 2.0) - Must stay open
export function mplFunction() {
    // Modifications must be shared
}

// your-file.js (Proprietary) - Can stay closed
import { mplFunction } from './mpl-file.js';

function proprietaryFunction() {
    mplFunction();  // OK to keep this file proprietary
}

// EPL Module - Must stay open
package org.eclipse.eplmodule;

public class EPLClass {
    // Modifications must be shared
}

// Your Module - Can be proprietary
package com.yourcompany.proprietary;

import org.eclipse.eplmodule.EPLClass;

public class ProprietaryClass extends EPLClass {
    // Can remain proprietary if separate module
}

graph LR
    MIT --> GPL2[GPL v2]
    MIT --> GPL3[GPL v3]
    MIT --> AGPL[AGPL v3]
    BSD --> GPL2
    BSD --> GPL3
    Apache2[Apache 2.0] --> GPL3
    GPL2 --> GPL3[GPL v3 if "or later"]
    GPL3 --> AGPL

## Source Code Distribution

### Method 1: Accompany with Source
- [ ] Include complete source code
- [ ] Include build scripts
- [ ] Include installation instructions
- [ ] Match binary version exactly

### Method 2: Written Offer
- [ ] Valid for 3 years
- [ ] Available to any third party
- [ ] Nominal fee for physical media only
- [ ] Include contact information

### Method 3: Network Distribution
- [ ] Provide download link
- [ ] Same location as binary
- [ ] No additional barriers
- [ ] Equivalent access method

# Required for LGPL compliance
provide_source_code()
enable_relinking()  # User must be able to relink
provide_object_files()  # If statically linked
preserve_lgpl_notices()
document_modifications()

// server.js - AGPL compliance
app.use('/source', (req, res) => {
    // Must provide corresponding source
    const sourceArchive = generateSourceArchive({
        includeModifications: true,
        includeBuildScripts: true,
        includeDocumentation: true
    });

    res.download(sourceArchive);
});

// Display in UI
function AGPLNotice() {
    return (
        <footer>
            <a href="/source">
                Source code available (AGPL v3)
            </a>
        </footer>
    );
}

Project Structure:
  License: GPL v3
  Benefits:
    - Competitor improvements returned
    - Strong community contributions
    - No proprietary forks
  Examples:
    - Linux Kernel
    - GCC
    - GIMP

# Process Isolation
import subprocess

# GPL code in separate process
result = subprocess.run(['gpl-tool', '--process', data],
                       capture_output=True)
# Your code remains proprietary

# Service Isolation
import requests

# GPL service running separately
response = requests.post('http://gpl-service/api', json=data)
# No license contamination

// Commercial license for paying customers
if (customer.hasPaid()) {
    return commercialLicense;
}

// GPL for open source users
return GPLv3License;

# Totally legal under GPL
sell_gpl_software() {
    price="$500"
    provide_source_code="yes"
    offer_support="optional"
}

// Dynamic linking - Generally OK
void* lib = dlopen("lgpl.so", RTLD_LAZY);

// Static linking - Obligations!
#include "lgpl_library.c"  // Must enable relinking

# No obligations - Internal use
def internal_system():
    use_gpl_code()  # No distribution, no obligations

# Obligations triggered - Distribution
def distributed_product():
    use_gpl_code()  # Must provide source

# Dual licensing model
if use_case == "open_source":
    license = "GPL"
elif use_case == "commercial":
    license = "Proprietary"  # For fee

# Service model (AGPL doesn't affect)
if deployment == "internal_service":
    agpl_ok = True  # Provide source via API

## Copyleft Enforcement Process

1. **Discovery**
   - Community reports
   - Compliance testing
   - Market monitoring

2. **Notification**
   - Private contact
   - Compliance opportunity
   - Documentation request

3. **Resolution**
   - Source code release
   - Compliance plan
   - Ongoing monitoring

4. **Legal Action** (Last Resort)
   - Cease and desist
   - Litigation
   - Injunction

## Copyleft Project Best Practices

1. **Clear Documentation**
   - LICENSE file in root
   - COPYING for GPL tradition
   - README with license section

2. **Contributor Agreement**
   - CLA or DCO
   - Clear contribution terms
   - Patent grants if applicable

3. **Compliance Help**
   - HOW-TO-COMPLY.md
   - Build instructions
   - Contact information

Compliance Process:
  1. Inventory:
     - List all copyleft dependencies
     - Track versions
     - Note modifications

  2. Analysis:
     - Determine obligations
     - Check compatibility
     - Identify boundaries

  3. Implementation:
     - Source provision mechanism
     - Attribution requirements
     - Build reproducibility

  4. Verification:
     - Regular audits
     - Automated checking
     - Legal review

# Scan for copyleft licenses
scancode --license --copyleft project/

# Check GPL compliance
gpl-compliance-checker --strict

# SPDX generation with copyleft flags
spdx-sbom --flag-copyleft --output sbom.spdx

# compliance_check.py
import license_checker

def check_copyleft_compliance(project_path):
    """Automated copyleft compliance verification"""

    licenses = license_checker.scan(project_path)

    copyleft_licenses = [
        'GPL-2.0', 'GPL-3.0', 'AGPL-3.0',
        'LGPL-2.1', 'LGPL-3.0', 'MPL-2.0'
    ]

    issues = []
    for package, license in licenses.items():
        if license in copyleft_licenses:
            if not has_source_provision(package):
                issues.append(f"{package}: Missing source provision")
            if not has_attribution(package):
                issues.append(f"{package}: Missing attribution")

    return issues