License Information for CD vendors

Since the Debian system consists of a lot software which is licensed under the GNU General Public License any distributor has to ensure the license is not infringed. If you are distributing Debian or parts of it in compiled (binary) form, please read the explanations and the advice below.

Because copyright law varies around the world, the Debian Project cannot provide legal advice. Contact a local attorney for clarification about your legal obligations when you distribute Debian.

Distributing software which is licensed under the GNU GPL in object code or executable form, either as CD image through the Internet or as pressed or burned CD, requires the distributor (commercial or non-commercial) to inform the person, who receives the binary form, how to obtain the source code of the software. The source code has to be provided to the user for a period of at least three years. Pointing them only to an FTP server from a third party (i.e. the Debian project) is not sufficient!

Quoting and interpreting the GPL:

3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange;

The distributor provides a copy of the complete and corresponding source as well as the binary form. If customers are downloading the binary from some archive on the Internet, then adding the source in the same archive is good enough; the distributor doesn't have to force the user to download it.

b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange;

The distributor has to give the customer a written offer to provide the complete and corresponding source to anyone (not merely ones own customers) at a later date for a period of at least three years. The distributor may charge a regular fee for creating and distributing the source CDs, though. Simply pointing to a third party (e.g. another company that sells source CDs or the Debian archive) is not sufficient. If there's no written offer, the source has to be provided up front.

c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)

If the distributor is a non-commercial organization, and if it has received the binaries with an offer like in paragraph b) above, then the distributor can merely pass on that offer.

Suggested Course of Action

Any entity that distributes binary Debian CDs or CD images (or even binary packages through a different medium, through the Internet, for example) has to provide the complete and corresponding source code to all software packages that are released under the Terms of the GNU GPL.

If no source CDs are provided regularly, one way to fulfill this requirement is to burn a CD containing the corresponding source archives and store it in a shelf. In addition, the distributor is required to add a written offer valid for at least three years to the binary distribution, telling the customer that the complete and corresponding source will be provided on demand.

The easiest way, however, is to distribute both binary and source CDs at the same time and at the same price. Since CDs are quite cheap these days, this will only slightly increase the price.

Additional Explanation

Pointing to a third party FTP server is not sufficient because of two issues:

The customer's claim for the complete and corresponding source is against the distributor, not against any third party, simply because the customer received the binary distribution from the distributor and not from a third party.
When the third party that was pointed to updates or removes a source package on their server or source CDs, the customer is not able to receive the corresponding source package from there anymore.

When a source package (released using the GNU GPL) is distributed or modified and distributed afterwards, one should always place the source code next to it or store it somewhere else at least. If a customer or user is requesting the source code at any later time, it should be possible to provide the corresponding source code.

The Free Software Foundation maintains a list of frequently asked questions and answers (FAQ) that may be able to add further explanations the above: