Copyright license grants of GPLv2 in MIT project

Question

Open source library X has an MIT license. It contains files from another (GPLv2) project, which I will call library Y. Library X states explicitly (in the license notes, a chapter of the readme.md file located in the root) that authors of library Y granted permission to redistribute these files under MIT license.

The files itself have a GPLv2 copyright header, ending with a message stating that permission has been granted to redistribute these files under MIT license.

There is no communication included in library X where this permission grant is explicated. I would expect some email or link to a web document sourced in library Y website or some sort.

Do I need to worry as user of library X that my (proprietary) software license is endangered?

Answer 1

If the author(s) of library Y really did license library Y to the author of library X under permissive MIT X11 terms (and assuming Y doesn't retroactively try to deny that they did so), then you have nothing to worry about: the author of X really does have the rights to share Y under permissive terms with others. The fact that there are GPL headers in the code doesn't diminish the fact that project Y has dual-licensed their code under your option of the GPL or MIT.

The troubling case is if Y's author did not really grant X's author a permissive license to redistribute Y. Without an official statement from Y's author, you are relying on the secondhand report from the X project. It is possible that the author of X did communicate with Y, but misunderstood what Y was saying, or (less likely) that the author of X is telling a baldfaced lie. Since you haven't seen the actual communication, you don't know for sure.

What would happen if X was wrong, and Y denied having made the permissive license grant? Your software would indeed be in hot water, since your software does include Y, and you could only legally use Y on GPL terms. You would have been (unknowingly) committing copyright infringement for unwittingly violating the GPL. It's not likely Y will sue you: that's against the norms of the Software Freedom Coservancy's guide to GPL enforcement, and furthermore since your past infringement would count as "innocent infringement" (in the U.S.), the court could significantly reduce or eliminate the penalty for your past infractions. However, even in the best case, you would either need to (1) immediately stop distribution of your software or (2) come into compliance with the GPL, including releasing your complete source code.

How can you avoid this entire headache? Contact the author of library Y to ask if they will publish a definite statement that their software is dual-licensed under both GPL and permissive MIT, or ask if they will privately make such a statement to you via email. If you can't get in touch with them, you could also go to the author of X with your concerns and see if they will forward any email communication with Y's author that shows clearly that library Y was permissively licensed to them.