What is the scope and trigger of the the copyleft provision of the Common Public Attribution License v1.0 (CPAL)?

Question

I wrote a C++ program that uses an unmodified as-is 3rd-party library that's licensed under the Common Public Attribution License v1.0 (CPAL). I want to distribute my program along with the 3rd-party library without open-sourcing the rest of my program (the larger work). In order to achieve this, it seems sufficient that I:

• provide the name and logo of the 3rd-party library in a splash-screen on startup of my C++ program (§14, §Exhibit B)
• provide a copy of the CPAL license in addition to the source of the 3rd-party library to the user (§15, §3.1, §3.2)

However, I've encountered some contradictory information.

Google prohibits internal use of CPAL-licensed software because it is "AGPL-like in crucial ways" (AGPL-licensed software is also prohibited). No clarification is given, however Google seems to imply, like another company states, that the CPAL, like the AGPL, has a "strong copyleft" provision, which would force larger works that use CPAL code to be open-sourced and use the triggering license for the rest of the larger work. This contradicts another source which describes the CPAL as "weak copyleft", like the Mozilla Public License (MPL) that it's based on (MPL code is accepted by Google), which would require open-sourcing only the CPAL library and any modifications to it (the covered work), and not requiring open-sourcing the larger work that said library is used in.

So, what is the scope and trigger of the CPAL's copyleft? Are my bullet-points sufficient for complying with the license?

Answer 1

So, what is the scope and trigger of the CPAL's copyleft?

The CPAL is what I would call file-based copyleft: Once code is licensed under CPAL, it needs to stay under that license and modifications to the same file must also be licensed under CPAL.

Are my bullet-points sufficient for complying with the license?

Yes.

The problem that Google likely has with the license are in the Additional Terms, because those also have requirements around network use that become problematic for companies like Google, like having to show the attribution on every session a user opens with Google.