Episode Details

A pending Orange County Superior Court trial in Software Freedom Conservancy v. Vizio could let any consumer sue a manufacturer to enforce General Public License source code obligations in 2026. The Conservancy bought a single Vizio SmartCast television, asked for the Linux source code the license already required Vizio to hand over, and is now five years into proving that the buyer of a device, and not a copyright holder alone, may compel that disclosure in court. A December 2025 ruling already found Vizio owes a contractual duty to produce the code. Whether an ordinary purchaser can be the one who sues for it is the question a jury will decide

.

I have spent thirty years drafting the representations that ask a founder to promise no General Public License code sits inside a proprietary product, and until recently the question behind that promise was narrow: could the Free Software Foundation or a copyright holder sue if the promise turned out to be false. SFC v. Vizio asks a different question, and if the Conservancy wins, the population of people who can enforce that promise against a company expands from a handful of foundations to every customer who ever bought the product.

why a copyleft license turns a code audit into a deal term

The mechanism behind that exposure is not new. Jacobsen v. Katzer, 535 F.3d 1373 (Fed. Cir. 2008), settled fifteen years ago that a broken open source license condition supports a copyright infringement claim, with an injunction and statutory damages, rather than a breach of contract claim capped at the buyer’s actual loss. The General Public License conditions the right to distribute a modified or combined work on handing over the complete corresponding source. The Affero variant goes further and reaches software a company never distributes at all, triggered the moment a user reaches it over a network, which is precisely the deployment model most software companies now use.

Version 3 of the license already anticipated the moment a company gets acquired. Section 10 carries the license through a merger, an acquisition, or an asset sale, and hands the buyer whatever rights the seller had, along with a right to the source the seller already possessed. What the license does not hand the buyer is knowledge of which components in the target’s codebase carry that obligation in the first place. That knowledge is the entire purpose of an intellectual property audit conducted before signing rather than after.

what a scanner actually finds and what it misses

A composition scanner such as FOSSA, Black Duck, Mend, or the open source ScanCode Toolkit reads a codebase, matches every component against a license database, and flags anything that conflicts with a policy counsel set in advance. That step is necessary and it is not sufficient. Industry audit data covering deals closed between November 2024 and October 2025 found open source components in ninety eight percent of codebases and a license conflict serious enough to flag in ninety four percent of transactions, with sixty nine percent of deals carrying at least one component whose license was custom written or simply missing from the package metadata a scanner reads. A missing tag does not mean a missing license. It means a lawyer has to open the file.

The same data set found unpatched vulnerabilities in ninety seven percent of transactions, a mean of seven hundred eighty six per deal, and a component more than four years out of date in ninety two percent of codebases. None of that describes a badly run engineering team. It describes what a modern codebase looks like once you actually count what is inside it, which is why an audit built for institutional due diligence has to start from the assumption that contamination exists rather than treat a clean disclosure schedule as the default finding.

what companies selling into the eu now owe under the cyber resilience act

The regulatory floor unde