2
  1. If a company released source code for software and released a corresponding binary release that uses different code, are they obligated to give acknowledgement that they used different source code?
  2. What if the company secretly included unwanted (like trackers, malware, cryptocurrency miners, etc.)? Will anyone ever be able to discover that? and what should happen to the company?

I hope I get an answer which can be understood anyone who develops or uses open source software without having to study law.

Improve this question
15
  • 1
    I could imagine some situations in which this might constitute fraud, false advertising, or some other sort of prohibited deceptive business practice, but I suppose that it isn't specifically forbidden per se, and that many examples of this wouldn't create civil or criminal liability. Can you make the question more specific? Does the source code imply that the binaries do something that they don't do, or vice versa?
    – phoog
    Commented Jul 22, 2022 at 7:52
  • @phoog, there's no certain software that I'm talking about, but is it possible for anyone to determine if a company uses different code for their binary release? and is it legal or depends on the difference?
    – AZeed
    Commented Jul 22, 2022 at 7:59
  • 1
    "is it possible for anyone to determine if a company uses different code for their binary release?": One way to check whether the source code corresponds to the binary release is to compile the source code and compare the behavior of the resulting binary with the behavior of the binary release. This won't expose all differences in the source code, of course, and it doesn't eliminate the possibility of differences introduced by using a different compiler.
    – phoog
    Commented Jul 22, 2022 at 8:04
  • 1
    Even source code can be dangerous, see How to prove that given binary files are compiled from provided source code? on Software Engineering StackExchange.
    – mouviciel
    Commented Jul 22, 2022 at 8:26
  • 1
    @AZeed I think you misunderstood the linked-to question on SE StackExchange. Source code itself is not dangerous, but in practice, people don't take the time to thoroughly review the publicly available source code, to see if there are hidden backdoors or semi-obvious bugs which could be used in the same way as a backdoor. However, without the source code, such a review process would be all but impossible. So it's not really dangerous, per se, but just because you have it doesn't mean you are automatically safe.
    – Brandin
    Commented Jul 29, 2022 at 8:05

1 Answer 1

Reset to default
3

If it is open source code, then usually the requirement is that you produce the source code for the software that you release. Exactly for the software that you release. For example if you took open source software X, and added feature Y, and distributed the combined software outside your company, anyone can request the source code for X including Y. Handing them the source code for X only wouldn't meet the open source requirements.

Now all this is not illegal, but it means the copyright holder of X could sue you for copyright infringement. They will do that if they have enough reasons to do so. So let's say you are continuously developing your software and occasional hand out your compiled software. Say you built versions 100, 101, 102, 103, 104 of the software, you gave versions 100 and 103 to customers, and anyone asking for the source code is given the source code for the latest, slightly improved version 104.

The copyright holder of X might sue you but: 1. They wouldn't know you are doing this. 2. A judge might side with you and decide that newer, improved source code is good enough (I don't know this, but it seems not unreasonable). 3. The copyright holder might decide that they don't want to sue you for this because you are close enough to meeting the requirements.

Improve this answer
7
  • 2
    You might want to clarify that this is only true for licenses like the GPL and only if the software contains third party code.
    – eesiraed
    Commented Jul 22, 2022 at 21:53
  • who exactly is “third party”? First party = original copyright holder, 2nd party = me, third party = whoever asks me for the source code.
    – gnasher729
    Commented Jul 24, 2022 at 14:50
  • 2
    What I meant is that if someone is publishing GPL software that they own, they can legally release source code that don't correspond to the binaries since they're not bound by their own license. The question is asking whether it's legal to publish source code that doesn't correspond to binaries in general and doesn't appear to be limited to cases where the person distributing the code is not the copyright holder.
    – eesiraed
    Commented Jul 24, 2022 at 18:15
  • 1
    The answer does specify that you're releasing open source software X from another copyright-holder/licensee with modifications you made. If the license requires you to release the code with the full source, then it's self-evidently a breach of the license to not do that; although the extent of legal liability is in practice uncertain (if it was an innocent mistake, changes were minimal, or caused no harm, would you have to pay damages?).
    – Stuart F
    Commented Jul 25, 2022 at 10:40
  • desired, If X creates some open source software, and Y adds to it, then it has copyright and is licensed by two parties. X is NOT allowed to release the version with Y added without the source code.
    – gnasher729
    Commented Jul 25, 2022 at 10:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .