Why providing source code for unmodified works is important
FSF Licensing and Compliance Manager Donald Robertson poses with a friend at the LibrePlanet 2016 conference.
One common misconception we run into in our compliance work here at the FSF is the idea that if you distribute an unmodified GNU General Public License (GPL)-licensed binary, you don't have to provide the source. All versions of the GPL actually require you to provide source code in some manner whenever you propagate the work. When explaining this requirement, we often get asked "why?" Sure, thirty-five years ago when the FSF was founded, if you didn't provide the source code, then it was unlikely that the user could ever find it. But in 2020, with most free software packages widely available on the Internet, why do users need to get the unmodified source from the distributor? Can't they just get it from upstream?
First, the responsibility shouldn't be placed on the user to track down the source code they need. When developers place their work under the GPL, they do so in order to ensure that all users can enjoy the software in freedom. Finding the proper source code and dependencies isn't always the easiest of tasks, especially for users new to free software. The GPL promises users that they can get the source, but this promise is impaired when they don't know where to find the version of the source code that matches the copy of the package they own. If finding the source is a simple enough task, then surely it isn't too much of an issue for the distributor to find it and provide directly to the user. And making the source easy to find is also important because when it's not, in many compliance cases, the violator will suddenly find that they themselves do not know how to get the source that matches their version.
The responsibility also can't be placed on upstream to provide source code. For projects that self-host, they shouldn't have to offer the bandwidth up to satisfy third party users. This is particularly important when volunteer efforts, with little in terms of resources, are being asked to provide bandwidth for large companies or organizations with more than enough resources to handle their own source obligations. Plus, not everything on the Internet is forever. Projects can choose to remove or stop offering downloads of their source, meaning that users (as well as well as the distributor!) could be left without any access to the source code for the version of the work provided.
Finally, no one else can handle the responsibility of providing accurate installation information. The vast majority of our compliance cases involve devices that run free software. For these devices, users might be able to find the upstream source and build it, but be left with no way to actually install the work on the device it is meant to run upon. Instructions are critical for allowing users to get their own modified code on the device, and in the correct place. Without these critical parts of the complete and corresponding source code, the upstream source is of diminished value to users of these devices.
Taken together, it is clear that providing source code, even when it is unmodified, is just as critical today as it was decades ago before the rise of the Internet. So if you're reading this now and haven't been properly providing source, now is the time to fix that. If you need help or have questions, you can always write to us at email@example.com. We're more than happy to help.
Photo Copyright ©2016 Free Software Foundation, Inc., by Kori Feener. This image is licensed under a Creative Commons Attribution ShareAlike 4.0 International license.