No, you can't take open-source code back

A popular note on the Linux Kernel Mailing List claims that a program's author can block people from using his code at his discretion. Wrong.
Written by Steven Vaughan-Nichols, Senior Contributing Editor

Some people are still unclear about what it means or what happens once they've published their program under an open-source license. In the most recent example, mikeeusa, the author of an obscure game called GPC-Slots 2, claimed he was rescinding the program's GPLv2 license from some people and "from anyone who adds a 'Code of Conduct' anywhere near my code (to 'fight sexism'.)."

While this specific case doesn't really matter -- the text-based casino game hasn't been updated in over a decade and appears to have no players -- the issue of whether one can block users from using code once it's been placed under the GPLv2 bothered enough people that it's been one of the hottest stories on the Linux Kernel Mailing List (LKML) for over a week.

This issue of whether you can pull code from an open-source program under the GPLv2 keeps coming up. In the last go-around, some people argued they could take their code out of Linux. Richard M. Stallman, author of the GPLv2 -- the open-source license that governs Linux -- but no fan of Linux, replied: "The developers of Linux, or any free program, can remove any and all code, at any time, without giving a reason. However, this doesn't force others to delete that code from their own versions of the program." 

In short, once you've opened up your code, you can't close Pandora's copyright box. But Stallman is not a lawyer. I asked several open-source savvy attorneys what they made of this latest argument. This is what they told me.

The Software Freedom Conservancy executive directory Karen M. Sandler said the Conservancy recently clarified this very issue. The relevant section of the Copyleft and the GNU General Public License: A Comprehensive Tutorial and Guide states: "The GPLv2 have several provisions that, when taken together, can be construed as an irrevocable license from each contributor."

Here's their logic:

The GPLv2 says "by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it" (GPLv2§5, emphasis added). A contributor by definition is modifying the code and therefore has agreed to all the terms in the GPLv2, which includes the web of mechanisms in the GPLv2 that ensure the code can be used by all.

More specifically, the downstream license grant says "the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions." (GPLv2§6). So in this step, the contributor has granted a license to the downstream, on the condition that the downstream complies with the license terms.

That license granted to downstream is irrevocable, again provided that the downstream user complies with the license terms: "[P]arties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance" (GPLv2§4).

Thus, anyone downstream of the contributor (which is anyone using the contributor's code), has an irrevocable license from the contributor. A contributor may claim to revoke their grant, and subsequently sue for copyright infringement, but a court would likely find the revocation was ineffective and the downstream user had a valid license defense to a claim of infringement.
Nevertheless, for purposes of argument, we will assume that for some reason the GPLv2 is not enforceable against the contributor, or that the irrevocable license can be revoked. In that case, the application of promissory estoppel will likely mean that the contributor still cannot enforce their copyright against downstream users.

The estoppel defense, in its simplest form, is that once code has been released under an open-source license, the community can reasonably assume that the developer can't take back the right to use his or her's code.

Of course, this is only an argument at all under the GPLv2. 

As Heather Meeker, a partner specializing in intellectual property law at the law firm O'Melveny pointed out in an e-mail interview,  "GPL3 specifically says, 'All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met.'  Arguments that the license is "bare" or revocable actually contradict its terms. And in fact, most GPL code is available under GPL3, if the licensee chooses that version. Only a few projects are GPL2 only."

Must read

The issue behind the legal issue isn't that code can be removed from a given open-source license. That one, despite what some people with a poor grasp of copyright law may argue, is settled. No, the real issue is trolls arguing that codes of conduct are wrong and that they can be combated by using the threat of removing code as a magic bullet to stop them.

Codes of conducts are here to stay. 

Open-source is maturing and transforming from being a wild west forum -- where anyone can say anything in a workplace with increasingly large and diverse workforce, which demands respect for all its participants. There will continue to be spats between those who oppose and support codes of conducts in technology circles, but threatening to pull code from a project over them isn't a valid threat.

The top open-source rookies, projects in 2018

Related Stories:

Editorial standards