Using Conda's XZ package for proprietary use

Question

I am currently packaging up my python software.

I listed down all the packages that it uses and found out that a package, which is called xz, uses multiple licenses (public domain, LGPLv2.1+, GPLv2+). I wish to avoid using GPLv2+ as it requires disclosure of the entire source code. Is there a way in using the XZ package without the disclosure, or am I missing something?

Methods Tried

I tried uninstalling the package, as it was installed by itself when I was installing other packages. I found out that the package was a prerequisite for many other packages.

(DeloymentEnv_Fresh) C:\Users\PC-2001-044>conda uninstall xz
Collecting package metadata (repodata.json): done
Solving environment: done


## Package Plan ##

  environment location: C:\Users\PC-2001-044\anaconda3\envs\DeloymentEnv_Fresh

  removed specs:
    - xz


The following packages will be downloaded:

    package                    |            build
    ---------------------------|-----------------
    pycparser-2.21             |     pyhd3eb1b0_0          94 KB
    sqlite-3.37.0              |       h2bbff1b_0         785 KB
    ------------------------------------------------------------
                                           Total:         880 KB

The following packages will be REMOVED:

  blosc-1.21.0-h19a0ad4_0
  brotli-1.0.9-ha925a31_2
  bzip2-1.0.8-he774522_0
  charls-2.1.0-h33f27b4_2
  cloudpickle-2.0.0-pyhd3eb1b0_0
  cycler-0.10.0-py36haa95532_0
  cytoolz-0.11.0-py36he774522_0
  dask-core-2021.3.0-pyhd3eb1b0_0
  decorator-5.1.0-pyhd3eb1b0_0
  freetype-2.11.0-ha860e81_0
  giflib-5.2.1-h62dcd97_0
  hdf5-1.8.20-hac2f561_1
  imagecodecs-2020.5.30-py36hb1be65f_2
  imageio-2.9.0-pyhd3eb1b0_0
  jpeg-9d-h2bbff1b_0
  kiwisolver-1.3.1-py36hd77b12b_0
  lcms2-2.12-h83e58a3_0
  libaec-1.0.4-h33f27b4_1
  libopencv-3.4.2-h20b85fd_0
  libpng-1.6.37-h2a8f88b_0
  libtiff-4.2.0-hd0e1b90_0
  libzopfli-1.0.3-ha925a31_0
  lz4-c-1.9.3-h2bbff1b_1
  matplotlib-base-3.3.4-py36h49ac443_0
  networkx-2.5-py_0
  olefile-0.46-py36_0
  opencv-3.4.2-py36h40b0b35_0
  openjpeg-2.4.0-h4fc8c34_0
  pillow-8.3.1-py36h4fa10fc_0
  py-opencv-3.4.2-py36hc319ecb_0
  pyparsing-3.0.4-pyhd3eb1b0_0
  pywavelets-1.1.1-py36he774522_2
  pyyaml-5.4.1-py36h2bbff1b_1
  scikit-image-0.17.2-py36h1e1f486_0
  snappy-1.1.8-h33f27b4_0
  tifffile-2021.3.17-pyhd3eb1b0_1
  tk-8.6.11-h2bbff1b_0
  toolz-0.11.1-pyhd3eb1b0_0
  torchvision-0.11.1-py36_cu102
  tornado-6.1-py36h2bbff1b_0
  xz-5.2.5-h62dcd97_0
  yaml-0.2.5-he774522_0
  zlib-1.2.11-h62dcd97_4
  zstd-1.4.9-h19a0ad4_0

The following packages will be UPDATED:

  pycparser                                       2.20-py_2 --> 2.21-pyhd3eb1b0_0
  sqlite                                  3.36.0-h2bbff1b_0 --> 3.37.0-h2bbff1b_0


Proceed ([y]/n)? n


CondaSystemExit: Exiting.

The question is, if the other packages uses XZ's package, doesn't it mean that they are required to be licensed GPLv2+ as well (which they aren't; they use permissive license such as BSD, apache 2.0, etc.)? I'm I missing a piece of the puzzle here?

Thank you so much in taking your time to answer my question :)

Answer 1

[...] xz, uses multiple licenses (public domain, LGPLv2.1+, GPLv2+). I wish to avoid using GPLv2+ as it requires disclosure of the entire source code. Is there a way in using the XZ package without the disclosure, or am I missing something?

As mentioned in the COPYING file of XZ, different parts of that project are under different licenses. The majority of XZ is in the public domain and only some scripts and command-line tools are under the GPL or LGPL licenses.

If your project just uses the liblzma library, then you are not affected by the (L)GPL license in any way.

If your project uses any of the scripts or command-line tools, then you must make sure that you invoke them as an external program. In such a way you can use GPL-licensed code without having to disclose your own code.

Only if your project makes changes to the GPL-licensed scripts are you required to publish those changes under the GPL license as well.

Answer 2

I found an issue on XZ conda-forge package's repo that corresponds to my question.

The person posted determined that xz package does not include the scripts that are licensed under GPL, so there may exist a discrepancy with XZ conda-forge package licensing. At most, the package is licensed under LGPL.