5

I've found a flutter plugin on pub.dev that is licensed under MIT, but in its build.gradle for Android building it references another library that seems to be a fork of a GPLv2 library. In turn, I would have thought the plugin would also have to be GPL meaning they incorrectly licensed it.

However, I then noticed the build.gradle uses jitpack in order to download compiled artifacts of the GPL library. In the past I have heard that a program under another license can legally interface with a compiled GPL binary as long as the program itself isn't linked with it (eg: using std pipes) as long as a copy of the GPL license is included and where to find the binary's source.

Is this likely what is happening in this case, or should the plugin be licensed under GPLv2? I've seen a few plugins that seem to do this same thing, are these all violating the GPL or have I got that wrong?

EDIT: Okay so I've been asked to add some more specifics of the actual plugin in question. The plugin I am talking about is flutter_openvpn. It is MIT licensed, but on its Android side uses a fork of ics-openvpn, which is a GPLv2 library for Android. This is the fork I am talking about, and as you can see it too is correctly released under GPLv2.

In the build process, the build.gradle uses jitpack so that the GPL library is compiled into an aar before being used by the plugin:

rootProject.allprojects {
    repositories {
        google()
        jcenter()
        maven { url 'https://jitpack.io' }
    }


}

...

dependencies {
        implementation 'com.github.Topfreelancerdeveloperr:flutter_openvpn_library_updated:3361996fa1'
    }

However, the plugin then creates an instance of the VPN object in this library from its own code and passes some parameters to it. Since its instantiating an object of the library this should come under GPL right? Or does this specific use case allow for the MIT license in the plugin?

As for the iOS side I'm ignoring that for the sake of this question, I'm just interested in whether the Android build process abides by GPL rules or not.

Update: After some thinking I had a theory. Is the MIT license legitimate since the online source code only contains a reference to the repository of the GPL library, but upon use of the plugin when this GPL dependency is downloaded does the whole application become GPL? It seems like that could be what's going on, but if so that can be very misleading for people using plugins like this...

2
  • The answer will depend on the precise details of how the plugin uses the GPL binary, and we can't comment on that without knowing those details. At the very least, please edit a link to the plugin into your question, but better still, add the link and as many details as you can of how this plugin interacts with the GPL binary.
    – MadHatter
    May 25, 2022 at 10:16
  • Okay, I've had a look at the link you provided and updated the question with some more details.
    – Letal1s
    May 25, 2022 at 10:39

1 Answer 1

3

GPL obligations attach when you do one of two things:

  1. Distribute a verbatim copy of something that was licensed to you under the GPL.
  2. Distribute a derivative work of something that was licensed to you under the GPL.

The relevant questions are, therefore:

  1. Do you want to distribute anything at all? For both you and the plugin author, the answer is (presumably) "yes." If you were just making an app for your own private use, then the inquiry would end here.
  2. Will you distribute verbatim copies of anything that is licensed under the GPL, whether in source or in binary form?
  3. Will you distribute anything that could be considered a derivative work of something licensed under the GPL, whether in source or in binary form?

If the answer to (1) is "yes," and the answer to either (2) or (3) is also "yes," then GPL obligations attach, meaning you have to provide source code and license the resulting distribution under the GPL.

In the case of the plugin itself, the answer to (2) is clearly "no," because they are not distributing copies of the GPL'd library. The answer to (3) is, in my opinion, unclear. There are arguments both in favor of and against this position.

But that doesn't matter to you, because you presumably want to distribute a copy of the library bundled together with your application. That means you'll be doing (2), and so the GPL's obligations attach, unless you can claim it as "mere aggregation," which the GPL (version 2) describes as follows:

These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.

Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program.

In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.

The problem is, the boldfaced sentence probably means you can't call it "mere aggregation," because your code and the library form a combined whole (your app).

3
  • Okay, I have one question. I see that the main issue is that the library would be included in an app's compiled form. If the library could be downloaded separately by the end user as an extension where the DEX file can be loaded at runtime, the app alone would not be a distribution of the library. Would that satisfy the requirements for distribution without GPL or is that not a good thing to do?
    – Letal1s
    May 26, 2022 at 9:21
  • 1
    @Letal1s: As I describe, it's controversial and nobody really agrees on the correct answer to that question. If the app is a derivative work of the library, then GPL obligations still attach, but there is disagreement over whether there is a generally "correct" answer to that question.
    – Kevin
    May 26, 2022 at 18:27
  • Fair enough, I see how the issue could be quite complex. Thanks for your help.
    – Letal1s
    May 26, 2022 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.