Copyleft

The starting point was software being sold without its source code. Through the 1980s programs increasingly shipped as executables only, which left the people using them able to see a problem and unable to touch it.

The scene that kept repeating went like this. A lab printer would jam and then sit there with no notification at all. Someone in the same room knew how to fix it, but without the driver source there was nothing to do, and a request to the company that wrote it came back months later or not at all. Buying the program had never included the right to repair it.

So people started publishing source alongside their programs, and a second problem surfaced. Published source could be taken, modified slightly, closed again, and sold. Whoever opened the lock got to watch it be relocked. Conditional publication was the answer to that. Copyright normally exists to stop copying, and copyleft uses that same power to compel publication instead — the direction is inverted, which is exactly what the name is about.

Copyright is the lever. Nobody may copy someone else's code without permission, and a license is the document that grants permission with strings attached. A copyleft license puts "publish the source too" in the strings. Four steps.

1. Published code carries copyleft terms. The GPL family is the best-known example.
2. The code goes into your product. That is the moment you become bound by its terms.
3. You distribute the result. Handing a customer an installer or putting an app up for download both count.
4. Distribution triggers the obligation. You have to provide the source of the result to anyone who asks, under the same copyleft terms.

Strength varies. The strong form reaches the entire program the licensed code is combined into. The weak form only asks you to publish changes to the library or file you took, which leaves your own new code out of scope. That single difference decides whether a given component can go into a product at all, even though both are called copyleft. So the useful habit is reading the actual license name rather than the word open source, which covers both and tells you nothing about which one you are holding.

Companies selling SaaS have one more branch to watch. Step 3 treats distribution as handing over files, so a product that runs on your servers and shows users a screen never triggers the obligation. Licenses were written to close that gap by counting network service as distribution. The AGPL is the notable one, and it catches companies that have never shipped an installer in their lives.

There's usually one occasion for this word at work: someone reads the list of third-party code inside the product and finds a copyleft license on it.

Most of the time nobody chose it. Engineers glance at the license of a library they pick deliberately, but the libraries that library drags in arrive unexamined. A product of any size pulls in hundreds of external components, which is why counting by hand stops working quickly and why teams automate the license compliance pass that builds the list and checks each set of terms. The check runs best as part of the build, because a list assembled once a year describes a product that no longer exists.

Once something turns up, there are three options. Swapping in a different library with the same function is the first and the most common. The second is buying a commercial license from whoever wrote the code — plenty of projects offer the same code under two sets of terms, so paying is a route when publishing isn't acceptable, handled through ordinary contract work. The third is keeping the component separated from your product rather than combined with it, though where combination begins is genuinely contested and not a call to make without legal review.

Finding it late shrinks the options. If it surfaces in a feature you have been selling for a year, ripping it out and rebuilding has to fit into that quarter. Investors and acquirers commonly ask for this list during due diligence, so a team that never maintains one ends up assembling it during the busiest month it has. Enterprise customers ask for it too, often in the final round of contract review, which is a poor time to discover that a component has to come out.

"That library is GPL, so it can't go in the product. I'll look for an alternative."

License terms conflict with how the product is sold, so the technical choice gets reversed.

"If it's only for an internal tool, that's not distribution, so we're fine."

The obligation triggers on distribution, and running something in-house doesn't qualify.

"If it's AGPL, being a SaaS makes us more exposed, not less."

That license counts network service as distribution, so shipping no installer is no protection.

The first time this came up at Pagedeck was during work on document conversion. The library Theo found performed best of anything he tested and carried strong copyleft terms, which meant dropping it in could have put Pagedeck's own server code in scope for publication.

Theo brought Grace three options: an alternative library about 20 percent slower, a commercial license at roughly $14,000 a year, or two weeks of engineering to isolate the component in its own process. Grace took the first one, on the grounds that 20 percent of performance cost less than creating a question legal would have to re-examine every year.

The most common misreading is that copyleft means copyright was given up. The name looks like the opposite of copyright and the code is public, so the conclusion is easy to reach. The reality runs the other way: the mechanism only functions because copyright is intact, since copyright is what lets the author attach conditions at all. Act on the assumption that the rights were waived, ignore the conditions, and what you have is ordinary copyright infringement.

The second is believing that merely using the code forces you to publish yours. Remembering the terms as stricter than they are feels like the safe error. But the trigger is distribution. A component running inside an internal analytics tool, used only by your own staff, creates no publication obligation. Teams that miss this rule out tools they could safely use, and teams that draw distribution too narrowly make the opposite mistake — treating an on-premise install for a customer as something other than distribution.