Termination, Cure, and Enforcement of License Conditions

Enforcement of an open-source license starts from a structural fact rather than from the question of who is annoyed: the license was a permission granted on conditions, and the failure of a condition means the permission did not cover the act. The distributor is then in the position it would have occupied with no license at all, which is the copyright default described in what a license does to a copyright default. Nothing needs to be revoked for that state to exist, and the remedies available are the copyright owner’s remedies rather than a claim about a broken promise.

Both GPL versions state the consequence in the license text, and both then soften it with machinery that turns a violation into a recoverable event rather than a permanent exclusion.

Automatic termination, and why it does not spread

Version 2 provides that a distributor may distribute a work based on the program only under the terms of the license, and that any attempt to copy, modify, sublicense or distribute the program otherwise is void and terminates the rights granted by the license. Version 3 uses the same structure with defined verbs: propagating or modifying a covered work other than as permitted by the license is void and automatically terminates the violator’s rights under it, expressly including the patent licenses granted in the patent section.

The important clause is the one about third parties. Version 2 states that parties who received copies or rights from the violator do not have their licenses terminated so long as they remain in full compliance, and version 3 carries the same principle. Termination is personal to the violator. A distributor that shipped binaries without the corresponding source does not transmit a defect to its customers: the customers hold valid grants from the copyright holders through the license, and the party that lost its rights is the distributor. That design is what lets an end user continue to run a product whose vendor is in breach, and it is why supply-chain enforcement targets the party that performed the distribution rather than the people downstream of it.

The cure windows: sixty days and thirty days

Version 3 replaced the flat statement of version 2 with an explicit reinstatement mechanism, and the numbers in it matter operationally. A violator who ceases all violation gets its license back from a particular copyright holder provisionally, and permanently if that copyright holder does not give notice of the violation within sixty days of the cessation. Where a copyright holder does give notice, and that notice is the first one the violator has received from that holder, the license is reinstated permanently provided the violation is cured within thirty days of receipt.

Two features of that arrangement shape real compliance programmes. The first is that cessation alone restores the license, at least provisionally, so stopping the offending distribution is a remedy the violator can apply unilaterally. The second is that the sixty-day window belongs to the copyright holder: a party that quietly stops shipping without fixing the underlying process can still be terminated if a holder objects within the window. The thirty-day first-notice rule in practice is what a compliance notice is asking for, and it is why notices tend to be written as a description of the missing material and a deadline rather than as an immediate threat.

Version 2 has no equivalent text, so a violation under a version 2 only license does not carry a stated cure window. In practice the same sequence applies because the copyright holder is the one deciding whether to pursue the matter, and the practical remedy is the same: publish the missing source and fix the process.

Condition or covenant, and what courts have done with it

The distinction decides the remedy, and it has been litigated. In Jacobsen v. Katzer the Federal Circuit held that the attribution requirement in the Artistic License was a condition limiting the scope of the license rather than a mere contractual promise, with the consequence that violating it could support a claim for copyright infringement rather than only for breach of contract. The point of the ruling is remedial: an infringement claim reaches injunctions and, for registered works, statutory damages that do not require proving an actual loss, while a contract claim reaches the damages the breach caused.

The characterisation is not settled for every clause in every license, and courts in different jurisdictions approach it from different premises. A system that treats the license as a contract first tends to require a warning notice and an opportunity to cure before suit, which is a procedural difference with the same practical effect as the cure window. What follows for a distributor is that the exposure depends on how a particular clause is classified, and clauses drafted as conditions within the scope of the grant are the ones that reach the stronger remedy.

Patent provisions are the sharpest edge of the same mechanism. The Apache License withdraws its patent grant from anyone who brings patent litigation alleging that the work infringes, and version 3 of the GPL terminates the patent licenses granted by the license when a recipient institutes patent litigation over the work. A company that both consumes a project’s code and sues over it can lose the patent permissions it was relying on while continuing to depend on the code, which is one of the reasons patent counsel is involved in corporate decisions about which licenses a company will accept at all. Those clauses are also the reason certain license pairs cannot be combined, as set out in license compatibility.

Who can enforce, and why the asymmetry is structural

Only a copyright holder, or an exclusive licensee, can bring an infringement claim. A project whose title is scattered across thousands of contributors therefore has thousands of potential plaintiffs and no single one with an interest proportionate to the cost of litigation. This is the argument advanced for copyright assignment and for broad contributor grants: an organisation holding title can act once, on behalf of the whole codebase, which is a material difference in the credibility of any compliance demand, as described in contribution agreements.

The cost asymmetry runs the other way for the violator. A compliance dispute is cheap to start and expensive to litigate, so most matters resolve at the notice stage: the rights holder describes the works whose source is missing, and the distributor publishes the corresponding source for the artifacts it shipped and changes the process that produced them. Nothing about that resolution is a payment. The remedy that both sides want is the material the license was asking for, and it is generated by the distributor’s own build. Some organizations also hold dedicated legal resources for this purpose, which changes who is willing to pursue a claim without a commercial motive.

Correcting the process is the substance of a cure, and it looks exactly like the release process described in compliance for shipped binaries: archive the build inputs for the artifacts that were shipped, publish them, and bind the two together so that the next release does not repeat the omission. A compliance notice answered with a payment and no change to the release process leaves the next release in the same state.

Where the mechanism has no answer

Three cases resist the model. The first is a violation discovered years after the distribution stopped. Cessation has already happened, so the license revives provisionally for version 3 works, but the sixty-day window may be long past and a copyright holder can still terminate, leaving the former violator to negotiate terms for code it is no longer shipping.

The second is the grant that cannot be withdrawn. A recipient who received a copy under the license when the copyright holder was distributing under it holds a valid grant from that time. A later decision by the same holder to distribute on different terms, or to stop distributing altogether, does not reach those recipients, and the copies they hold remain licensed. Enforcement therefore cannot be used to recall a release; it can only constrain what the rights holder or the violator does next, which is the constraint that determines what relicensing can and cannot accomplish.

The third is the unresolved theory of the license itself. If a license is a conditional permission, a breach puts the violator outside it, which is what the termination clauses assume; if a license is an irrevocable contract, a breach produces damages while leaving the permission intact. Both readings have been advanced, the license texts are drafted for the first, and the practical consequence of the uncertainty is that compliance work is worth doing for the reason the license states rather than for a prediction about which theory a court would adopt.