There are some specific usage examples I would like to learn, regarding of using some open source libraries inside a commercial closed source product(binary, executable). Most of the answers online cover only open source products, and license compatibility. Resulted in me opening this question.

1. Openssl / libssl / libcrypto

Is it okay to use these libraries from the system. For example,

#include <openssl/evp.h>
#include <openssl/err.h>
#include <openssl/conf.h>

In this example, libraries themselves are not distributed, but every Unix system has them, and used from the customers computer. I have seen this usage in a MIT licensed library, never mentioning the license of openssl anywhere. Is this normal ?

2. Openssl (static linking)

Sometimes, to get around versioning problems, static linking is applied. In this example, libraries would be distributed with the product.

3. -static-libgcc, -static-libstdc++

I know, GCC compiler, gives the rights of the compilation output to the developer. But if one is trying to avoid runtime library version problems, these libraries can also be included in the binary.

4. Not including the license notices of a included project's own dependencies

Imagine you are using a MIT license open source project, in a binary I described above. You include the project's license notice, but not the other 30 different MIT licensed projects that the first one already includes (therefore depends on). Is it the first project's responsibility to mention them in their website, etc. Or should I dig out every dependency that project include, and mention them myself ?

Would these usages be copyright infringements ? I know these libraries provide some exceptions of non-violating usages. Does these require copyright notices with the exception mentioned? I looked up these exceptions, and they were really confusing for me, couldn't understand if they applied for me.

Note: I apologize for combining many questions into one, but separating them would require explaining the topic over and over again.

  • For your question 3, I think there is an exception mentioned explicitly for the GCC runtime. See gnu.org/licenses/gcc-exception-3.1.html
    – Brandin
    Jan 5 at 6:57
  • I think Question 4 has been asked before. Search for "dependencies" or "transitive dependencies" and you will probably find answers here about this. In general, not following the license terms (e.g. not including a notice) results in copyright infringement, technically. Usually open source folks won't immediately send lawyers after you, though. More likely some people in the community will complain to you and then you can fix the problem. Still, you should do your due diligence as much as you can.
    – Brandin
    Jan 5 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.