GPL Linking: A Technical and Legal Analysis

Short answer: whether GPL linking makes your code subject to copyleft depends on how the two are combined. Static linking usually triggers GPL obligations; dynamic linking, separate processes, and system calls usually do not; plug-ins are the genuine close call. If GPL linking is part of your build, reason about it deliberately before you ship, not after.

I finally found a really useful working paper and law review article written by some European open source attorneys and the Free Software Foundation Europe on linking issues and the GPL license. I thought I would share some of the highlights, as it is really hard to get good practical guidance on open source legal issues.

1. Derivative Work or Compilation (Copyleft Obligations).

• Static linking (GPL’d code combined with your code in one executable at build time).
• Macro and template expansions (embedding GPL’d code into your code).

When the GPL code and your code ship as one tightly bound work, the safe assumption is that your code inherits the copyleft obligation. The Free Software Foundation takes an aggressive view here. Its own GPL FAQ treats most linking as creating a single combined work. You do not have to agree with every position in that FAQ, but it is the view the licensor is most likely to assert, so plan around it. And it is not just theory: in Jacobsen v. Katzer, the Federal Circuit held that open source license terms are enforceable copyright conditions, so a violation can be copyright infringement, not merely a breach of contract.

2. Close Call (aka, It Depends).

• Plug-ins (to extend functionality of other programs). Whether copyleft attaches depends on external factors: dependence or independence of your code, communication protocols and sharing of resources, whether you copied API host code, whether the core functionality is subject to copyright, and the existence of other libraries with the same function.

This is where reasonable lawyers disagree and where a written analysis actually earns its fee. If a plug-in is your distribution model, get the architecture reviewed before you ship, not after a compliance letter shows up.

3. Independent and Separate Program (No Copyleft Obligations).

• Dynamic linking (calling and using a library only at run-time; no GPL code copied, modified, translated, or changed).
• Interprocess communications (remote procedure calls).
• System calls (core operating system resources).
• Interpreted language scripts (not compiled, executed by an interpreter, no third party code incorporated).

The Practical Move for a SaaS or Software Vendor.

Three things keep this from becoming a fire drill. First, know what is in your build. You cannot reason about copyleft on dependencies you don’t know you have. Second, decide the linking architecture deliberately, not by accident in a sprint. Third, write it down. A short, dated analysis of why a given component does or does not trigger copyleft is worth a great deal if a customer’s diligence team or an enforcement group ever asks.

This is an evolving issue and I don’t think the definitive work has been written, but don’t let that stand in your way of learning more about it. And if a GPL or copyleft question is blocking a release, a lawyer who handles open-source licensing can help you sort out the exposure.

A few related reads. For the SaaS-specific copyleft question, AGPL: What Every SaaS Company Should Know covers how Section 13 of the Affero GPL closes the ASP exception. 3 Things You Need in Your Open Source Policy covers written policy, tracking process, and annual review. What Software Companies Need to Know About the Creative Commons License Program covers when (and when not) to use CC. And A Software Lawyer’s Take on the Linux Foundation’s Open Compliance Program covers the tooling and SPDX direction the OSS world is heading.

Frequently Asked Questions.

Does dynamic linking to a GPL library make my code GPL? Usually not, if you link only at run-time and copy, modify, or embed none of the GPL code. But the FSF reads this more broadly than many engineers expect, so document your reasoning.

Is static linking always copyleft? Treat it that way. Static linking binds the GPL code and yours into one work at build time, which is the classic copyleft trigger.

What about plug-ins? That is the real close call. It turns on the interface, the data shared, and how tightly the plug-in depends on the host. Get it reviewed before release.

Disclaimer:

This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after review of all relevant facts and applicable law.