GPL and storage requirements

[Luis Villa]

On 3/24/07, Mike McGrath <mmcgrath at redhat.com> wrote:
> My question is, who knows the finer details of what the GPL requires us
> to keep?

My quickie analysis follows. This is not legal advice, IANAL[1], and
I'm certainly not an expert on the GPL. To top it off, the GPL is
unfortunately vague on this point. But I think the analysis is likely
fundamentally sound.

I believe non-commercial mirrors are not required to keep source. They
need only "accompany  [the Program] with the information [they]
received as to the offer to distribute corresponding source code."
(Sec. 3(c)).

To allow mirrors to take advantage of Sec. 3(c), Fedora would need to
provide to the mirrors a 'written offer ... to give any third party
... a complete machine-readable copy of the corresponding source
code.' (Sec. 3(b)) This offer would need to be good for three years
from the date of distribution- presumably from the date of the last,
rather than the first, distribution, though the language is vague on
that point.

As to what constitutes a 'written' offer... I believe that an
email/web page would suffice to fulfill the spirit of the requirement.
The text could read something like 'In keeping with the requirements
of the GPL v2 Sec. 3(b), the Fedora Project offers a copy of the
corresponding source code to any third party who downloads these
binaries. This corresponding source code is available from the master
source server at __________.' You'd give this text to the mirrors to
put in any directories with binaries in them, and perhaps (to be safe)
put it in a text file on the top level of every ISO as well. The more
places you put the offer, the better off you likely are ;)

*****Note that the term 'written' may have magical/mystical legal
meanings in a license context. I strongly recommend asking a real
lawyer about that.*****

So, to summarize what I think to be the correct situation for minimum
storage requirements in keeping with GPL v2:

(1) the master server hosted by the party which created the new
binaries from the modified source (i.e., Fedora) must publicly host a
'written' offer to freely distribute source code to anyone who asks,
good for three years after the date of the *last* distribution of the
binaries.
(2) the master server must maintain a copy of that same source code
for three years after the date of the last distribution of the
binaries.
(3) assuming that mirrors are non-commercial and do not modify the
binaries, mirrors don't need to keep source, as long as they
prominently host a copy of the official 'written' offer mentioned in
(1).

Two further notes:
(1) Are you sure GPL is the only license with applicable source code
redistribution requirements? GPL may allow mirrors to not mirror
source, but other licenses may not be so forgiving. I have no idea
what breadth of licenses are in Fedora.

(2) Assuming the language in the latest draft stays roughly the same,
these instructions should be valid for GPL v3 as well. The
requirements there are slightly different, but overlap enough that
they should not pose a problem. (As a bonus, v3 clarifies 'written' in
the network mirror context to mean "clear directions next to the
object code saying where to find the Corresponding Source." I think
following that language would be a good guideline for fulfilling the
v2 requirements, though again IANAL and written may have special
magicolegalist[2] meanings.)

HTH, sorry it is a little rambling-
Luis

[1] I need a blog post explaining this in more detail.
[2] Yes, I just made that up. And I love it.