Information Security 22 min read

Analysis of China's First GPL Litigation and Risk Management for Open‑Source Software Use

The Beijing High People’s Court’s landmark 2019 ruling in Digital Heaven v. Yuzu, China’s first GPL‑related lawsuit, rejected Yuzu’s claim that three HBuilder plugins were GPL‑bound derivatives, ordered RMB 710,000 damages, and highlighted both growing judicial recognition of the GPL and the need for companies to isolate, analyze, and manage open‑source components to avoid copyleft liability.

Tencent Cloud Developer
Tencent Cloud Developer
Tencent Cloud Developer
Analysis of China's First GPL Litigation and Risk Management for Open‑Source Software Use

On November 6, 2019, the Beijing High People’s Court issued a final judgment in the copyright infringement case brought by Digital Heaven (Beijing) Network Technology Co., Ltd. against Yuzu (Beijing) Technology Co., Ltd. and Yuzu (Beijing) Mobile Technology Co., Ltd. The court rejected Yuzu’s claim that three plugins of the HBuilder software were derivative works that must be released under the GNU General Public License (GPL) and held that APICloud’s copying and modification of those plugins infringed Digital Heaven’s reproduction, adaptation, and information‑network dissemination rights, ordering Yuzu to cease infringement and pay RMB 710,000 in damages.

This case is the first GPL‑related lawsuit in China and has become a reference for how Chinese courts interpret open‑source licenses.

1. Case facts (first instance)

The plaintiff alleged that Yuzu’s APICloud software copied the source code of three HBuilder plugins (input‑method, real‑device run, and live‑edit plugins). The court confirmed Digital Heaven’s ownership of the software and the plugins, and, based on expert forensic reports, found substantial similarity between the disputed code and the plaintiff’s code.

The court also noted that the three plugins were stored in independent folders that did not contain the GPL text, and that the GPL in other parts of HBuilder did not bind these plugins.

2. Appeal (second instance)

Yuzu appealed, arguing that the entire HBuilder suite should be subject to the GPL and that the three plugins were derivative works. The appellate court rejected the new forensic request, stating that Yuzu had failed to fulfill its evidentiary burden and that the request would delay proceedings.

The court upheld the lower‑court’s finding that the plugins were not GPL‑bound and affirmed the infringement conclusion, adjusting only the number of infringing code lines and the compensation amount.

3. Legal analysis

The judgment demonstrates that Chinese courts are beginning to recognize the legal force of the GPL, but the interpretation of the license’s “viral” (copyleft) effect remains contested. The court accepted the GPL’s applicability to the plugins but did not explore whether the plugins constitute independent programs or derivative works, a key factor for determining GPL coverage.

The GPL v3.0 text quoted in the judgment clarifies that a work is a “derivative” if it is based on the program, and that an “aggregate” of separate works does not impose the GPL on the non‑GPL components.

"The Program" refers to any copyrightable work licensed under this License.
...
You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
...

According to the GPL, the “viral” effect is triggered by distribution (or conveyance). If a company uses GPL software internally or provides it as a SaaS service without distributing the code, the copyleft obligations are not activated. Moreover, the GPL explicitly excludes “aggregates”—separate programs that are merely distributed together—from its scope.

4. Risk‑control recommendations for commercial software companies

• Avoid distributing GPL‑licensed code or its derivatives; use SaaS or internal deployment to sidestep the distribution trigger.

• Keep GPL components isolated from proprietary code by using inter‑process communication (pipes, sockets, command‑line arguments) rather than linking or embedding.

• Be aware that dynamic linking is considered a derivative work by the Free Software Foundation, though the legal consensus is still evolving.

• Conduct thorough technical analysis of communication, dependency, and call relationships between modules to determine whether a component is a derivative work subject to the GPL.

• Maintain proper licensing documentation and include the GPL text with any distributed GPL‑covered binaries to avoid claims of non‑compliance.

In summary, the Digital Heaven v. Yuzu case illustrates both the growing judicial recognition of GPL obligations in China and the complexities surrounding the determination of derivative works. Companies should implement rigorous technical and legal safeguards when incorporating GPL‑licensed software into commercial products.

risk managementopen sourceIntellectual PropertySoftware LicensingChina LawGPL
Tencent Cloud Developer
Written by

Tencent Cloud Developer

Official Tencent Cloud community account that brings together developers, shares practical tech insights, and fosters an influential tech exchange community.

0 followers
Reader feedback

How this landed with the community

login Sign in to like

Rate this article

Was this worth your time?

Sign in to rate
Discussion

0 Comments

Thoughtful readers leave field notes, pushback, and hard-won operational detail here.