What is copyleft?
Copyleft is the open-source licensing approach pioneered by Richard Stallman and the Free Software Foundation (FSF) and generalised in the GNU General Public License (GPL), first released in 1989. Copyleft uses copyright law to require that derivative works of copylefted software remain open source under the same licence: a “viral” mechanism that propagates source-code availability across the software supply chain. Copyleft contrasts with permissive licences (MIT, Apache, BSD) which allow proprietary modification and redistribution.
Copyleft licence families
- Strong copyleft (GPL v2, GPL v3, AGPL v3): any work that “links” or modifies GPL code must be licensed under GPL; AGPL extends to network use (SaaS).
- Weak copyleft (LGPL, MPL, EPL): copyleft applies only to direct modifications of the licensed file or library; allows proprietary code to link statically/dynamically.
- Strong network copyleft (AGPL v3): closes the “SaaS loophole” by extending source disclosure to users accessing modified code over a network: significant for hosted services.
Compliance obligations
- Source code availability: distribute source code with binary or provide written offer for 3 years.
- Same-licence redistribution: derivative works must use the same copyleft licence.
- Notice preservation: retain copyright notices and licence text in distributed code.
- Patent grant: GPLv3/AGPLv3 include an express patent licence from each contributor (GPLv3 s.11): contributors cannot assert those patents against users.
- Anti-tivoisation (GPLv3): hardware locks preventing user modification breach licence in consumer products.
Open-source practice in Türkiye
Turkish software companies and the startup ecosystem act as both consumers of and contributors to open source. For Turkish SaaS companies using AGPL code, the service model (SaaS or on-premise) directly affects open-source obligations: in particular, where AGPL-covered code has been modified, users interacting with it over a network are entitled to its source code. KVKK and data localisation requirements add further complexity to SaaS structures that include AGPL code.
Do: maintain open-source bill of materials (OSS BOM) for all dependencies; map licence obligations per software component; engage OSS compliance counsel before incorporating copyleft code into commercial products.
Don’t: assume “open source = free to use however”: copyleft compliance failures expose to litigation (Conservancy v. Vizio, BusyBox cases) and product recall risk.