![[RSS]](/static/img/feed-icon-14x14.2168a573d0d4.png){kind=icon}
Conservancy BlogDisplaying posts
by Bradley M. Kühn
by on August 12, 2026
I had the honor of giving the introduction for the 2026 Distinguished Service Award in Software Freedom. The video of ceremony will be available in the coming weeks, but I share below that introduction now. Congratulations to Mark on this well-deserved award.
I'm up here now to announce the second annual winner of the Distinguished Service Award for Software Freedom.
In preparation, I'll tell you the story of one of the dozens of incidents in my FOSS career that convinced me that FOSS events like this one are essential to advance communities that spend 99% of its time collaborating over the Internet.
16 years ago — almost to the day — I stood in line to register for GUADEC 2010 in The Hague in the Netherlands. This was my first GNOME conference,and frankly as a command-line geek who only uses a GUI to make more xterms and Emacs frames on a screen, I was feeling nervous about attending.
Behind me in registration line, I heard exclamations from a young Dutch man with rosy cheeks and huge smile. He couldn't contain his excitement in blurting out: “You are … You must be … Bradley Kuhn!!!!”
I turned to face him fully and said: “wait, you, you are mjw, aren't you? You are the guy who wrote Classpath!”
Mark answered with what I'd soon learn was his true humility: “Well, you know, I didn't write Classpath, I mean, YOU are the one who named it Classpath … and well, there was already a lot of code when I took over.”
I already knew Mark Wielaard to be a dedicated, kind, and humble FOSS developer from our email exchanges in the early 2000s. But spending time with him at GUADEC 2010 — really getting to know the whole person who is “mjw” — was one of the best experiences of my career.
I boarded the flight back home thinking: “What a joy it is to have such people in the FOSS community! What great work we will all do together if all of us are like mjw!”
Mark didn't rest on his laurels after his Classpath work. He worked on the GCC front-end for Java. Then, when Sun (and later Oracle) released some of their Java code, he lead the IcedTea project that integrated the Sun OpenJDK code-dumps with existing Classpath work.
Today, he continues work in FOSS by maintaining the low-level key infrastructural project elfutils, and the Valgrind dynamic software analysis tool. Even with all that funded work, he still finds the time to serve the community as an essential volunteer maintaining the oldest and most prestigious Free Software code-hosting site, Sourceware.org.
For me, the only sad part about this moment for is that there is only one Mark, not a thousand. No, I am not trying cloning experiments in my basement to make more Marks! But I had hoped that day — 16 years ago on that plane — that the FOSS community would be filled with people like Mark. I have come to realize that his optimism, dedication, focus, and care are EXCEEDINGLY rare traits in our community. We should all aspire to approach FOSS in the manner that Mark does, and I hope all of you will take time at this event to learn from Mark how to improve as a FOSS contributor! He has a wealth of knowledge and wisdom to share — and he will share it with us willingly with kindness.
It's for that reason that I nominated — and easily received wholehearted, universal agreement from everyone at Software Freedom Conservancy — that Mark receive this second annual Distinguished Service award.
In addition to this lucite award, this honor includes a ten billion binary US Dollar cash prize. (For those that prefer decimal, that's USD $1,024. Mark's contributions are so significant that I deeply wish we could wave a magic wand and dub him a DECIMAL billionaire, because people as wonderful as Mark really should rule the world.
Mark, please come up on stage!
I am proud and honored to present you with this Second Annual FOSS Distinguished Service Award.
by on July 3, 2026
Last week, Microsoft's GitHub1 announced they'd joined a coalition of other LLM-gen-AI for-profit entities who oppose updates to the California Artificial Intelligence Transparency Act (“Cal. Bus. & Prof. Code § 22757”). In their statement, GitHub mistakenly claims that the licensing termination requirements of §22757 run contrary to Free and Open Source Software (“FOSS”) licensing principles. This article explains why these statements made on behalf of Microsoft & GitHub incorrectly represents how FOSS licenses work, and why the entire point is moot since the LLM-gen-AI systems in question are not FOSS themselves anyway!
Cal. Bus. & Prof. Code §22757 (and its updates currently under debate in the current session's SB 1000) are — like most legislation we see around new technologies in USA State and Commonwealth legislatures — well meaning and seeks reasonable goals, but remains confused about some details that are obvious to those who deeply understand the technology. Regardless, the law's aim is good policy. Definitely read through its interesting terms found in the amended §§22757.{1,2,3(a)} proposed in SB 1000. I suspect anyone who uses a for-profit, proprietary LLM-gen-AIs (perhaps by choice, or perhaps under mandate from their employer) would strongly prefer LLM-gen-AI vendors to provide the tools and information that §22757 mandates.
These policy goals — mandating transparency and allowing users to “trust but verify” these systems — are precisely the requirements that we want deployed widely for any LLM-gen-AI. SFC's own recommendations on LLM-gen-AI, in fact, correlate with and encourage “after market” implementation of some of §22757's requirements. While this law is of course not written the way technology policy wonks would likely write it, on balance, the law is a good one.
Of course, GitHub, Mozilla, Hugging Face, Black Forest Labs, (and likely other companies) hate this law. It requires them to do work to treat their users better. No one in the business of proprietary technology wants to do any more of that than is absolutely necessary to keep the customer. After all, it cuts into profits if companies do anything nice for their users that the customers have not directly demanded through a contractual requirement.
These for-profit corporations use misdirection and disinformation to convince the public that this law is bad for FOSS. Cal. Bus. & Prof. Code §22757 (both as on-the-books now, and as proposed for amendment) is not bad for FOSS, and, is generally good for the software right to repair.
Complaints regarding SB 1000 from Big Tech (and their cronies) focus on a narrow point in the amendments (found in §22757.3(b)(1-3)). Herein, I analyze this clause, and refute these companies' falsehoods about how it impacts FOSS. The key portion found in the proposed-amended §22757.3(b)(1-3) reads:
[22757.3](b)On the surface, their argument that claims that text contradicts the irrevocability of FOSS licenses has truthiness. Nevertheless, their argument is sophistry. Here's why:
- If a covered provider licenses its GenAI system to a third party, the covered provider shall require both of the following as terms of the license:
- That the system remains in compliance with this chapter, to the extent it is technically feasible.
- That the covered provider may revoke, suspend, or terminate the licensee’s authorization to use the GenAI system if the licensee modifies the GenAI system such that it no longer complies with this chapter.
- If a covered provider knows that an identifiable third-party licensee modified a licensed GenAI system such that it no longer complies with this chapter, the covered provider shall terminate the licensee’s authorization to use the GenAI system within 72 hours of discovering the licensee’s action.
- A third-party licensee shall cease using or making available a licensed GenAI system, including a copy or modified version of the GenAI system, after the licensee’s authorization to use the GenAI system has been terminated by the covered provider pursuant to paragraph (2).
- This subdivision does not require a covered provider to monitor, investigate, or otherwise inquire into a third-party licensee’s use or modification of a licensed GenAI system.
SFC called our statement seeking a FOSS-friendly LLM-gen-AI system aspirational precisely because none of the current publicly deployed LLM-gen-AIs in wide use are anywhere near FOSS. The portions installed on the users' computers are of course, proprietary. Those on-system UIs are thin layers that access a service (via an API) — which lives on some server running trade-secret software. Unsurprisingly, GitHub's statement gives not a single example of a specific LLM-gen-AI whose distribution is already thwarted by the existing Cal. Bus. & Prof. Code §22757, nor one that was not thwarted by the existing law but would be thwarted if the amendments in SB 1000 are adopted. They didn't name one because there isn't one!
While non-copyleft licenses such as the MIT and 3-Clause-BSD licenses are indeed irrevocable, they also permit redistributors of the software to impose additional terms that are not accounted for in the upstream license text. Therefore, even if Microsoft's GitHub were to release all of Copilot (model, server-side code, on-system UI) under the MIT license, they could do so with an additional term that complied with either formulation of Cal. Bus. & Prof. Code § 22757.
I highly doubt that Microsoft, GitHub or the other entities (who deploy these systems in California) would ever willingly release one of their LLM-gen-AIs under a copyleft license. However, even if they did, the GPL Agreements already account for such situations.
First, nothing in SB 1000's amended § 2757.{1,2,3(a)}) conflicts or contradicts anything in any version of the GPL Agreements. Any entity that might someday release a GPL'd LLM-gen-AI can both simultaneously comply with GPL's requirements and meet all the requirements in §2757.{1,2,3(a)}). Nothing in GPL prohibits a redistributor from doing extra nice things for their customers and users beyond copyleft — as long as they don't directly contradict a requirement already in the GPL.
SB 1000 2757.3(b) requires some complex analysis, but causes no problem. All versions of the GPL Agreements had to consider that software patent licensing might impose additional restrictions outside of the GPL. Specifically, the GPL has no real mechanism to force a third party2 who has never copied, modified, distributed, installed, and/or deployed the GPL'd software to issue a GPL-compatible patent license. All versions of the GPL Agreements therefore have a catch-all clause to deal with situations where external conditions make it impossible to comply with the license. Here's that clause from GPLv3:
12. … If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
This clause was specifically designed to catch situations like we have with Cal. Bus. & Prof. Code § 2757.3(c) (and SB 1000 §2757.3(b)'s amendments). Imagine that this series of exceedingly unlikely events come to pass. Some Big Tech company:
condition imposed onthis company that
contradict[s] the conditions of [the GPLv3]. This company now
cannot convey [the] covered work so as to satisfy simultaneously [their] objections under [GPLv3] and … other pertinent obligationsimposed by §2757.3. The GPL Agreements planned for this possibility: in the end, GPLv3 requires everyone in the distribution chain from the original company down to all its licensees to stop conveying the work. (NB: GPLv2§7 is nearly identical to GPLv3§12.)
Furthermore, note that the GPL Agreements terminate on their own when any entity in the distribution chain violates any term — including GPLv3§12 / GPLv2§7. So, yes, GPL Agreements are irrevocable, but only as long as everyone remains in compliance with the license. Termination for reasons of non-compliance is fully accounted for, and thus the SB 1000 changes to Cal Bus. & Prof. Code § 22757.3, despite GitHub's misdirection, actually make the law more copyleft-compatible by changing the term ”revoke” to ”terminate“ — which tracks GPL's language exactly!
Even if the analysis above fails, and a Court rules that there is an irreconcilable incompatibility in California between the GPL Agreements and Cal. Bus. & Prof. Code § 22757 (as it currently stands, or as amended by SB 1000), a simple addition to GPLv3§7 can account for this. That section, entitled Additional Terms is designed to explicitly incorporate pro-user policy terms that might not be explicitly available in GPL Agreements. Regardless, there is no need to rush to update the GPL Agreements on this front, as the above analysis likely holds.
Below we include our own template letter that we urge you to download, modify into your own words, and send it to Senator Becker. It's particularly important to do this if you live or work in California, and be sure to Cc your own senator as well.
The letter is available in LaTeX, Markdown, and PDF.
1 In June 2018, Microsoft acquired Github for US$7.5 billion — at which time Github became a wholly owned subsidary (effectively, just a separate division within Microsoft). Many Github users did not realize that even before acquisition, Github was on a sustained anti-copyleft campaign, and the merger solidified that work with Microsoft's 20 year sustained anti-copyleft campaign. Thus, the announcement last week — wherein Microsoft's Github appears to be standing up for the irrevocable nature of copyleft (given that non-copyleft always allowed further restrictions that took away the irrevocability anyway) — is even more disingenuous.
2 Various terms of the GPL Agreements can bind patent holders in various ways to keep the code safe from patent infringement claims for downstream users when the patent holder has actually engaged with the software in some way. However, it is common (particularly in a non-practicing-entity situation) that the patent holder demanding licensing fees has never even made a single copy of the copylefted software in question, much less installed, distributed, and/or deployed it.
by on June 2, 2026
In this philosophical essay, I explore the question: “When (if at all) is it ethically and morally acceptable to use proprietary software in the production and/or improvement of urgently needed copylefted FOSS?”
The question presents a complex conundrum. I attempt herein to rigoriously examine it through both a priori ethical analysis and a posteriori (and folksy) consideration of my personal experience and the shared experiences of the early software freedom movement.
I surprised myself at the outcome of my analysis. I conclude that under some circumstances (of which we have already witnessed in key historical examples), use of proprietary software by FOSS contributors to create/improve FOSS becomes a moral imperative. And, that imperitive often supersedes the moral imperative to avoid using that proprietary software.
I grew up lower middle class in the USA — which is quite privileged by global standards. As such, I never went hungry, but most meals did not include second helpings. My family were early adopters of “extreme couponing”. My earliest childhood memories are climbing through (on Monday mornings) the gigantic bin of recycled Sunday newspapers behind the grocery store. My job in this endeavor was “Sunday insert extraction”. Back then, more than half of all households received the Sunday paper. That Sunday insert was the goldmine. The insert paid for the paper subscription (and much more) through its colorful 30-40-page advertisements filled with coupons. Get your hands on 10–20 more of those inserts freely from the recycle bin, and you could get “Extreeeme!”.
The late 1970s and early 1980s were the wild west of extreme couponing. There were nearly no restrictions on how many identical coupons one shopper could use. A shopper could use 50¢-off coupons for 49¢ trial-sized products. I remember once my mother filled the entire checkout belt with 30+ trial size dishwashing liquids — for which my mother paid ≈65¢ (i.e., just the sales tax).
My young indoctrination to extreme couponing now feels as if it’s part of my DNA. If you’re ever on on mute during a voice call with me and I don’t reply quickly, it might be because I’m currently standing in a grocery store aisle — comparing value per volume of different sizes and cross-referencing that with a coupon’s fine print.
I actually miss having my hands covered in newspaper ink every Monday — as that analog way was superior to digital. For much of my life, I enjoyed “extreme couponing” as one of the few activities that put aside my worries about the future of users’ software freedom, rights, and privacy. Sadly, about ten years ago, everything started to change. Now, using any coupon is a constant battle with proprietary, bait-and-switch spyware.
Major grocery chains in the USA provide proprietary apps — now the primary place providing coupons. Most chains have parallel websites that allow account holders to “clip” them digitally. Printed ads still exist, but are rife with phrases like “Digital Deal only”. Shoppers now collide in the grocery aisles while navigating the Kafkaesque apps and websites to figure out how to (virtually) clip a good coupon.
The once relaxing process of watching television on a Sunday afternoon while clipping paper coupons slowly morphed into a two-hour ordeal of figuring out the minimum proprietary Javascript required, then building a text cross-list noting the discounts, screenshotting the bigger discounts, and then using the list and screenshots to prove to the grocery manager that I really was supposed to get $1-off of 4+ avocados this week. And, yes, I clipped it in the web browser. And, no, I can’t install the app on this device to “check it in the app”. 🙄
Most of my life, I couponed due to absolute financial necessity. I can fortunately now afford to pay full price, but frugality is part of my moral code. While the correct moral action for these grocery chains is to simply reduce prices for all shoppers automatically, they behave unethically. They prefer to use proprietary software to track you, to attempt to manipulate you into buying items you don’t need, and all the other obvious anti-features. In response to their unethical affront to the public, I feel the moral imperative to exploit that system by not falling for the manipulation tactics, maximizing my grocery budget, and acting as a watchdog when the digital coupons just seem to “not work”.
My colleague Karen Sandler and I have keynoted three times regarding our own ethical and moral analysis of software freedom in today’s digitized world. Our primary thesis: one must constantly compromise some software freedom purity to merely participate as a normal citizen. My lifelong grocery shopping experience exemplifies one situation of hundreds where tasks that once included no software interaction now mandate proprietary software usage. I lament this reality; it annoys me. But annoyance isn’t immorality, and software freedom activism was founded on pragmatic idealism. I fear that recent hard-core FOSS rhetoric has forgotten what that means.
As a fan of Kantian moral frameworks, my formulation of pragmatic
idealism focuses on ranking the competing moral imperatives. While “use
no proprietary software myself” is a noble moral tenet, its value
remains paltry when viewed comparatively.
The moral imperative to avoid writing proprietary software
towers over the moral imperative to avoid using it.
The conclusion is similar in a Utilitarian ethical analysis: provided one does not encourage others to join them, using proprietary software harms only the self. Writing proprietary software harms everyone who ever uses it — perhaps into the distant future.
The reverse situation yields similar analysis. Often, an individual, by using proprietary software today, can assure that many others will ultimately use less proprietary software in the future. In such situations, use of proprietary software by the individual is clearly a higher-ranked moral imperative (because it prevents many others from facing similar moral dilemmas). This also serves the greatest good for the greatest number: one person uses proprietary software so that many others won’t.
SFC lives this truth every day we operate. As part of SFC’s fiscal sponsorship of our member projects, we use a lot of annoying proprietary and/or trade-secret software (including banking systems, corporate donation and purchase order systems, third-party donation services, etc.). Yet, if SFC didn’t use those systems on our member projects’ behalf, at least one individual (possibly many) from each project would use them, instead.
Application of pragmatic idealism shows that using proprietary software is occasionally the right ethical choice for at least three reasons: (a) serving a higher moral imperative outside the scope of FOSS, (b) limiting the number of people who use proprietary software (now or in the future), and (c) increasing the efficiency and/or efficacy of urgently needed FOSS advancement.
While my opening example of using proprietary software to increase efficiency for FOSS’ advancement focused on the non-FOSS imperative of frugality, the principle expands well beyond that. In fact, the earliest FOSS contributors clearly believed that other imperatives sometimes justify proprietary software use.
By the time Richard M. Stallman (RMS)1 began to formulate software freedom as an essential right in the mid-1980s, proprietary software was the norm. Most computer users were using a Microsoft, Apple, or proprietary Unix system. RMS chose to write a copylefted Unix-like system (GNU) to replace proprietary Unix on its existing hardware.
But consider how RMS and the other early GNU contributors approached that work. If the goal was to minimize the developers’ use of proprietary software, the obvious approach would have been as follows: write a small bootable kernel on the existing ITS computers for the new hardware. Then, one could painstakingly write the basics of a C library in assembler (because, no FOSS cross-compilers existed in those days). After probably a decade of fulltime work by 3–5 people, there might have then been enough of a C library, a C compiler, a shell, and a text editor that others might also have software freedom.
I’m quite glad that the early GNU contributors did not take this approach. In fact, RMS started by writing the key program he knew best how to write quickly: another Emacs implementation — designed for existing proprietary Unix systems. And, GNU Emacs was working nicely in less than one year!2 Next, the GNU contributors tackled GCC — but not by bootstrapping in assembler. Instead, they used existing, proprietary C compilers to bootstrap. That too brought software freedom to C programming much more quickly than the “pure” approach.
Nearly all readers already know how the story ends: these early contributors quickly brought most of a working POSIX system to users — all licensed under copyleft licenses — except for the kernel. That story is often told, yet so rarely is the most important point the focus: the entire FOSS community used part-FOSS/part-proprietary systems for at least 15 years. Our (correct) focus was to deliver as much software freedom to other users as we could — as quickly as possible. Our overarching moral imperative was “create as much copylefted software as possible” — even if we used proprietary software as part of FOSS’ production.
The users’ software freedom matters much more than the developers’ software freedom. If FOSS developers find a path that accelerates software freedom for their users, then that higher moral imperative demands that path.
We dream of a world without proprietary software — where every byte of code on every piece of hardware provides complete, Corresponding Source to its users. Despite our best efforts, we drift further from that world every day. We race against the wealthy people whose wealth grows faster when they produce more proprietary software. We will not beat them in our lifetimes, but we can make progress. Along the way, we must constantly reconsider: Should we use some proprietary software to accelerate urgent improvements to FOSS? Willingness to sometimes answer that with “yes” (pursuant to rigorious criteria) epitomizes pragmatic idealism!
Every day, I find that I’m using more proprietary software than I did in the early 2000s. I’ve been on that unfortunate trajectory since the mid-2010s. I was one of the last hold-outs who using only X200 and T500 laptops — the last laptops ever made that could run all FOSS code from the up-top to the down-deep. Nevertheless, in November 2025, I switched to a Novacustom V54 that requires so many blobs for the internal devices that 77.5% of the packages contained in the firmware distribution are proprietary.
Today, my personal software freedom on my own laptop (at boot-time)
is measurably 77.5% less than it was when I lugged around the
T500. However, everything I do for SFC now happens quicker. I spend
substantially less time waiting for beancount to load SFC’s
books. I can attach three additional external displays (instead of just
one). I stopped injuring myself every time I travel from the T500’s
weight (as my X200 became too slow many years before). These and so many
other efficiency improvements from my Novacustom laptop made my work at
SFC (at least) 50% more efficient.
I gladly take that trade-off all day long. My job is to preserve, protect, and promote users’ software right to repair. That moral imperative outranks my moral squeamishness every time the blob on my wireless card processes a network packet.
Frankly, the software freedom and rights of computer users of the future deserve priority over activists’ and developers’ preference to use only FOSS. We should reluctantly but doggedly use any proprietary software that assuredly accelerates creation of and improvements to essential and urgently-needed copylefted FOSS.
1 RMS deserves substantial credit for formulating the first ethical framework for software freedom, his invention of copyleft, and his authorship of the earliest GNU programs. I am however not comfortable mentioning RMS and his work without noting his bad behavior that I frequently witnessed and his ongoing refusals to curtail or apologize for that behavior.
2 Free Software, Free Society: Selected Essays of Richard M. Stallman, 3ʳᵈ edition (2015). GNU Press, Boston, MA. Page 21.
by on May 17, 2026
Years ago, copyleft violations were often a mere misunderstanding; vendors intended to comply but made mistakes. In those “before times”, a simple request and short discussion often led to the complete, Corresponding Source (“CCS”) for the the distributed binary works (or, in the case of network-service copyleft, the deployed systems).
Today, nearly all copyleft violations are done with forethought (and frequently nefarious) intent. As such, the most common form of violation is not what we call “no-source-or-offer” or even “offer-fail”, but rather “incomplete-ccs”. That last form of violation is unforunately most complicated to resolve.
An “incomplete-ccs” violation means that the vendor has released some subset of required copylefted materials, but has purposely held back some necessary parts. For example, vendors sometimes provide byte-for-byte upstream source versions (absent their own changes entirely). Upstream sources obviously lack the vendors' “scripts used to control compilation and installation of the executable”. Even when some scripts are included, they are often not the actual scripts used to compile and install, but instead they're an alternative, incomplete version — often created specifically to thrwart efforts to recompile and install. Occasionally, vendors also withhold source code for some key modules, libraries, or other components governed by the copyleft license. Unsurprisingly — in general — vendors withhold the most interesting and most difficult to reimplement parts of the complete, Corresponding Source. Users are left with mere pieces of what the license agreement promises; users have immense difficulty reproducing the build and installing it. In network-service copyleft licenses (like the AGPLv3), users further struggle to properly deploy the service for self-hosting — a right that AGPLv3 guarantees.
These incomplete CCS “candidates” often exhibit “truthiness”. (Stephen Colbert wittily dubbed “truthiness” to refer to false or misleading material that appears to have the quality of truth at first glance — just enough that most won't bother to “trust but verify”.) When we enforce copyleft licenses in “incomplete-ccs” scenarios, we face a protracted argument with most vendors who insist — usually for some seemingly plausible but actually altogether specious reason — that the previous CCS candidate that they provided truly is complete and Corresponding Source. The average number of “rounds” of incompleteness reports that we send until reaching actual, valid CCS is approximately fifteen (on average).
We have spent many years pondering and refining advice for the users and consumers of these products. The users face the worst conundrum here: they sit confused with a copylefted binary and/or object code — yet they cannot effectively exercise their own rights under copyleft nor can they redistribute any object code to anyone else until they have proper CCS.
Fortunately, all is not lost. Here are a few simple facts (which apply to all known copyleft licenses — including the AGPL, LGPL, GPL, and copyleft-next):
For example,
AGPLv3§1
states You may make, run and propagate covered works that you do not
convey, without conditions … a "covered work" [is defined as]
either the unmodified Program or a work based on the Program
.
AGPLv3§4 goes on to state: [y]ou may convey verbatim copies of the
Program's source code as you receive it, in any medium
.
AGPLv3§5 grants that you may convey a work based on the Program, or
the modifications to produce it from the Program, in the form of source
code under the terms of section 4
. The list of requirements you must
meet when doing so under AGPLv3§5 are easy. (Summarizing AGPLv3§5(a-d): they
require that you add/maintain certain required textual notices,
and outbound-license the whole Covered Work under AGPLv3 itself.)
In short, there's no need to think twice if all you're doing is redistributing a copylefted work in pure Source Code form.
This License explicitly affirms your unlimited permission to run
the unmodified Program … You may make, run and propagate covered
works that you do not convey, without conditions
(AGPLv3§2). Other copyleft licenses have similar language.
Do take care not to give someone else direct access to the machine where you do this, and firewall the system so only you can access it via a network. If you distribute and/or convey the software to third parties (or deploy to others a network-service-copylefted system), there may be other parts of the copyleft license that will create obligations for you.
This concept can be counter-intuitive at first, but is extremely important when a vendor continues to provide incomplete/non-corresponding source code for a long time. If the vendor shipped portions of the work in non-source form only (for example, Linux modules in Object Code (i.e., .ko file) format), those files must be distributed under the copyleft license pursuant to its terms. While you face difficulty1 if you personally want to redistribute the non-source form of the software, your rights to analyze, modify, examine, reverse-engineer, or “figure out” those non-source components remain unimpeded due to your rights under the copyleft license.
Similarly, if the violator is withholding (all or some of) “the scripts used to control compilation and installation” — and you have the patience to painstakingly reproduce the build and install the software — you are fully permitted to try.
If you are lucky enough to succeed in your reverse-engineering effort and yield a non-source form that has clear and correct CCS that you can provide yourself, then you can make your own binary/Object Code distribution and redistribute2 all of it together (i.e., pursuant to AGPLv3§6).
These are three of the ways you can still exercise a few of your software freedoms and rights even when vendors have curtailed them by a copyleft violation. This isn't an exhaustive list; rather, it represents the most common “real world” scenarios that users and consumers face against badly behaved vendors.
Keep in mind that vendors will regularly bully users and inaccurately claim these rights don't exist. And it can get nasty!: we've seen violating vendors send DMCA takedown notices, get lawyers to send cease and desist letters, and even publicly shame the brave users who engage in the activities above. If this happens to you, keep your nerve, and remember that all copyleft licenses are irrevocable — vendors don't get to change their mind about your rights after the fact.
Finally, please never hesitate to reach out to us at SFC if you have other scenarios that you face and wonder what your rights are under copyleft, or if you face bullying, harassment, or other further bad behavior from vendors who refuse to grant users the rights they deserve under copyleft. ∎
As always, the usual disclaimers apply: Software Freedom Conservancy is not a law firm, I am not a lawyer, and the advice in this post is not legal advice. You may indeed face legal action by violators even if the rights and permissions that you exercise are obvious. You may wish to consult legal counsel in these situations, and we particularly recommend that you do so if you engage in any distribution and/or software deployment commercially.
1 Note that most copyleft licenses give extra rights to users who wish to non-commerically redistribute object code forms received from their upstream. With most copyleft licenses (and certainly with the GPL Agreements), if you want to redistribute Object Code components just as a vendor gave them to you, you are permitted to simply pass along the offer for CCS from the upstream commercial entity (e.g., see AGPLv3§6(c)). As such, we at SFC usually feel comfortable freely redistributing non-source forms of software that we know are violating; and, we simply point to the upstream violator. When we do so, we encourage users to demand source from the vendor. However, we at SFC do this kind of work every day. We urge anyone who wants to imitate our behavior in this regard to discuss privately with us first, and also consult legal counsel. (NB: Since we're not a law firm, we can't be your legal counsel).
2 The
OpenWrt origin story provides an
excellent historical example of a burgeoning
FOSS project following
these three guidelines. In early 2004, Cisco's Linksys
released incomplete and non-corresponding source code for its
WRT54G router (— following a six-month copyleft enforcement action that I led).
While that release was not CCS, it was juuust enough to allow the newly
formed OpenWrt project to reverse-engineer the build and installation
systems (by making their own with buildroot). Furthermore,
OpenWrt redistributed a binary Linux module (.ko file) for which Broadcom
(Linksys' vendor) refused to release CCS. To my knowledge,
Broadcom never took any action against OpenWrt on this matter —
likely because Broadcom itself violated GPLv2, and they did not want to draw attention
to their own nefarious behavior. Furthermore, OpenWrt's distribution was
non-commercial and therefore Broadcom had no “profits” to go
after. (By contrast, for SFC's OpenWrt One router, we made sure that no third-party
upstream non-compliant binaries were included — not only because we'd never
sell (or even encourage use) of a product that violated, but also because it's
very
risky to sell software that violates copyleft.)