My company's legal team is currently worried about how to move forward with some app releases intended for our enterprise customers.
Here's the gist of it:
- We have many products referred to as "apps", which each contain one or more (usually many) subproject modules (in the form of Java jars).
- Most of these apps are made of free and open source code, with the LGPL license contained at the head of each source code file.
- For our subscription enterprise customers, we offer "private" versions of the apps that contain additional modules whose source code is not made publicly available.
- Our customers want to have access to the source code of our private modules for their own development and troubleshooting (and we want to give it to them).
As mentioned above, each app is just a big collection of .jar files. The current plan is to start bundling the -sources.jar files along with the compiled class jars. Right now, all of our code contains the LGPL license. My solution was to simply change the license in the source code files of our private source to our private enterprise license.
However, our legal team insists that there are issues with bundling jars that contain the LGPL license with jars that contain our enterprise license. Instead, they want to use a script to search/replace the license in all of the jars that go into a private version of an app (including the public modules that are available in the public version of the app) and then repackage the sources.
This might sound confusing, so I'll try to provide a simple example.
Our public app:
foobar.app (simple zip archive containing the following)
Our private app:
So in the above example, just because of the presence of
xyz-sources.jar (which of course contains our enterprise license), legal says we need to replace the LGPL license in
ghi when we build
foobar-private.app. I'm not a legal expert by any means, but to me this seems ridiculous. All of this code is our own, so we're not infringing on any third party's rights, and I don't think this violates the text or spirit of LGPL. Is there really some reason we can't simply apply whichever license we want on a module-by-module or even file-by-file basis?