4 ms·
I'm going to split hairs the other answers don't: you specify you have modified Postgres. My answer is, it entirely depends if your application is considered a
by zmmmmm 6y ago
I'm going to split hairs the other answers don't: you specify you have modified Postgres. My answer is, it entirely depends if your application is considered a "derivative work" of Postgres. This hinges on a couple of things:
- does your application directly include AGPL postgres code in any form (headers, binary, etc etc) to its own source or its own runtime process?
- keep in mind, in answering the above, that your application probably does have to include a postgresql driver of some kind. Is the driver licensed AGPL too? If yes, your answer to the above is probably yes. This was the problem for years with MySQL, because they licensed their driver code GPL along with the actual database code.
- a final consideration that only comes into play if there is genuine ambiguity on the other points: is your application able to perform its functions if Postgresql is missing or swapped out for another database? To the extent it depends on Postgresql functionality, this will sway a jury towards considering it is in fact a derivative work of Postresql. If you on the other hand support 6 different databases and Postgresql is just one of them - it will be much less likely your application is considered a derivative work of it. As I said, this only comes into play if the other factors can't be decided decisively.
- hnick 6y agoDoesn't it also depend to some degree on how much code sits between the user and AGPL code? IIRC AGPL was created to bypass a thin wrapper frontend type situation. I make a website that takes PDFs, it lets users extract pages. In the backend I'm just running a modified Ghostscript command line and sending back what it makes. From my discussions with other people, this type of direct coupling automation is what is intended to trigger the AGPL. Is this incorrect? If that doesn't trigger it, the 'users interacting with it remotely' clause is all but useless because firewalls and service chains like this are really easy to construct. Not all AGPL software is able to natively run as a server itself. And if it does trigger it, a simple ToDo CRUD app that relies on a database is pretty much the same thing in my eyes.
- lmm 6y agoIt depends on whether a court considers it to legally be a derivative work or not. Some (but not all) circuits apply the "Abstraction, Filtration, Comparison Test", under which thin wrappers should make no difference. Other courts might have their own ways of deciding. The whole area is murky and untested, mainly because companies haven't really hammered out the cases in court.
- hnick 6y agoHow is the court venue decided? Is it based on where the copyright holder is based? That just adds a whole other layer of murky, now I can decide whether or not to infringe based on where the project is headquartered :)
- lmm 6y agoApparently not, it's "either (1) in the district “where the defendant resides” or (2) in the district “where the defendant has committed acts of infringement and has a regular and established place of business.”" That's US specific of course.
- zmmmmm 6y agoThe key part of the AGPL is phrased: > if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source So note the "interacting with it remotely" language isn't specific to just a network connection. So a reasonable interpretation would absolutely be that your users are "interacting remotely" with the PDF tool in the scenario you describe, no matter how many thin layers you put in between. So this then goes to the question of how a court would decide the boundary ... clearly the connectivity of the internet means nearly every computer and software on earth is theoretically linked by a network. So that is where they would look at how direct the interaction with the AGPL software was, and how critically and specifically dependent on that interaction your software is. If everything a user does gets transformed into a completely different form by the time it hits the AGPL software then they aren't interacting with it remotely - they are interacting with your software remotely and your software is interacting with the AGPL. Similarly, if you could trivially substitute the AGPL for something equivalent and the end user wouldn't notice, that would also argue they aren't really interacting with the AGPL software specifically. Of course, nothing is really clear until it goes to court, but this my best understanding of current state.
- p_l 6y agoThe postgresql driver might be considered derivative work, and thus required to be AGPL as well, because Postgres does not talk some standard protocol that exists outside of it.
- tremon 6y agoBut one can modify Postgres without changing the wire protocol, so the driver may be the plain, original one without custom modifications. The AGPL doesn't mandate that the protocol must be ratified by some standards body, only that a "Standard Interface [exists] for which an implementation is available to the public in source code form".
- p_l 6y agoThe driver would be derived work of Postgres, thus AGPL, and already problematic in use because of that.