Are there legal issues with bundling one's own LGPL-licensed code with proprietary code?

Question

My company's legal team is currently worried about how to move forward with some app releases intended for our enterprise customers.

Here's the gist of it:

• We have many products referred to as "apps", which each contain one or more (usually many) subproject modules (in the form of Java jars).
• Most of these apps are made of free and open source code, with the LGPL license contained at the head of each source code file.
• For our subscription enterprise customers, we offer "private" versions of the apps that contain additional modules whose source code is not made publicly available.
• Our customers want to have access to the source code of our private modules for their own development and troubleshooting (and we want to give it to them).

As mentioned above, each app is just a big collection of .jar files. The current plan is to start bundling the -sources.jar files along with the compiled class jars. Right now, all of our code contains the LGPL license. My solution was to simply change the license in the source code files of our private source to our private enterprise license.

However, our legal team insists that there are issues with bundling jars that contain the LGPL license with jars that contain our enterprise license. Instead, they want to use a script to search/replace the license in all of the jars that go into a private version of an app (including the public modules that are available in the public version of the app) and then repackage the sources.

This might sound confusing, so I'll try to provide a simple example.

Our public app:

foobar.app (simple zip archive containing the following)

• abc.jar
• def.jar
• ghi.jar
• abc-sources.jar
• def-sources.jar
• ghi-sources.jar

Our private app:

foobar-private.app

• abc.jar
• def.jar
• ghi.jar
• xyz.jar (private module)
• abc-sources.jar
• def-sources.jar
• ghi-sources.jar
• xyz-sources.jar

So in the above example, just because of the presence of xyz-sources.jar (which of course contains our enterprise license), legal says we need to replace the LGPL license in abc-sources.jar, def, and ghi when we build foobar-private.app. I'm not a legal expert by any means, but to me this seems ridiculous. All of this code is our own, so we're not infringing on any third party's rights, and I don't think this violates the text or spirit of LGPL. Is there really some reason we can't simply apply whichever license we want on a module-by-module or even file-by-file basis?

Answer 1

According to David Turner of the Free Software Foundation (link), a LGPL-ed library in the form of a JAR file can be redistributed with non-LGPL software without impacting the other software's licensing terms. If your legal team has reservations about this, contacting the LGPL's authors via l[email protected] may be the quickest way to assuage their fears.

A potential option that sidesteps the issue entirely is to tweak the way that your program is distributed. I've seen projects that offer the same sort of public and private versions that you describe, but they distribute them slightly differently. The private version is distributed as an add-on to the public version. That is, it's distributed completely separately. The user would download and install the public version, then download and install a separate module to upgrade it to the "private" version. The proprietary code is distributed by itself, so the license of the LGPL-ed "public" code doesn't impact it at all.

Answer 2

If it's your code, and nobody else holds a GPL-related copyright, you can do what you please with it. The LGPL, along with all other Gnu licenses, is about what you can do with the code you are only allowed to use from the license. Any headaches your distribution causes because of LGPL considerations are the recipient's, not yours.

See the GPL FAQ (the indicated question and the following one), which says pretty much what I said.