2

I’m planning to release my code under LGPLv3 license but I can’t find answers to several question.

Let me describe my situation:

  1. I’ve created library and want to use LGPL v3 license for this code;
  2. Library has references to proprietary packages (it has dependencies from packages which were installed to the library): a) EPiServer.CMS.Core package (http://nuget.episerver.com/en/OtherPages/Package/?packageId=EPiServer.CMS.Core&packageVersion=9.0.0). License for this package is https://www.episerver.com/eula/; b) EPiServer.CMS.Core package has dependency from Microsoft.AspNet.Mvc (https://www.nuget.org/packages/Microsoft.AspNet.Mvc/ )
  3. My library can be linked only with EPiServer application (proprietary product) and can’t work as independent application. So every EPiServer application (with my library or without it) owner has to buy license from EPiServer;
  4. My library provides additional functionality to EPiServer application and uses only public available API from proprietary packages;
  5. Every user has possibility to get those proprietary packages from https://www.nuget.org and http://nuget.episerver.com

According to FAQ (https://www.gnu.org/licenses/gpl-faq.en.html#GPLIncompatibleLibs ) I have to include Additional permission section to the license notice.

I’ve created license notice with copyright disclaimer:

Copyright 2017 Pavel Shumihai

This file is part of Epi.Dds.Manager.

Epi.Dds.Manager is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Epi.Dds.Manager is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public License along with Epi.Dds.Manager. If not, see http://www.gnu.org/licenses/.

Additional permission under GNU General Public License version 3 section 7

If you modify this Program, or any covered work, by linking or combining it with EPiServer.CMS.Core 7.5.409 (or a modified version of that library), containing parts covered by the terms of END USER LICENSE AGREEMENT FOR Episerver CMS, COMMERCE, FIND (ON-PREMISES), RELATE AND SUPPLEMENTAL PRODUCTS, the licensors of this Program grant you additional permission to convey the resulting work.

I have several questions according to this text:

  1. I can’t provide source code to EPiServer and MVC libraries. FAQ contains following information: “If not everybody can distribute source for the libraries you intend to link with, you should remove the text in braces; otherwise, just remove the braces themselves.” Does it relate to the next text: “{Corresponding Source for a non-source form of such a combination shall include the source code for the parts of [name of library] used as well as that of the covered work.}”?
  2. Should I insert ‘Lesser’ word before General in the section header: ‘Additional permission under GNU General Public License version 3 section 7’? I’ve found information about similar situation in “The license notices” part of document which you can find by https://www.gnu.org/licenses/gpl-howto.html (quote: When using the Lesser GPL, insert the word “Lesser” before “General” in all three places.)
  3. My library depends from 'EPiServer.CMS.Core' and 'EPiServer.CMS.Core' depends from 'Microsoft.AspNet.Mvc'. Should I include additional permissions only to direct dependency ('EPiServer.CMS.Core' in my case) or for all children dependencies as well ('Microsoft.AspNet.Mvc' in my case)?
  4. Should I do something with situation when I allows to use my library with 'EPiServer.CMS.Core' and that library can be used with different versions of MVC library? (e.g. Developer can use 'Microsoft.AspNet.Mvc 4.0.30506' with MS-EULA License and 'Microsoft.AspNet.Mvc 5.2.3' with MS-.NET-Library-JS License)
  5. Should I include library version to the additional permission? (7.5.409 in my situation)
  6. Does ‘or a modified version of that library’ from license notice allows to link 'EPiServer.CMS.Core' 9.0 version?
  • 1
    This question seems confused. You say you're licensing your library under LGPL, which is explicitly designed to allow the sort of use you're aiming for (I think). But you then quote from the FSF's FAQ on how to amend the GPL (NB: not LGPL) to permit this. Either use LPGL unmodified, or GPL modified, it seems to me: LGPL modified is pointless. – MadHatter Jan 5 '18 at 8:12
  • 1
    @MadHatter LGPL incorporates the terms and conditions of version 3 of the GPL, supplemented by the additional permissions. So I think that additional permissions can be applied to the LGPL as well. I want to make possible for developers link newer versions of EPiServer in the modified work – Pavel Jan 5 '18 at 9:05
  • 2
    Fair point. But it still seems to me that you can do what you want under the existing additional permissions granted by the LGPL itself. It might be prudent to examine the truth of that before getting caught up in the complication of yet-further permissions, lest this turn into an XY problem. – MadHatter Jan 5 '18 at 9:24
  • @MadHatter LGPL allows to use program under this license in the proprietary software. But I have to use proprietary software in my LGPL library and I may have legal issue with this. Topic #GPLIncompatibleLibs suggests to provide additional permissions. It will allow to any developer create modified version of my library with newest version of proprietary software. I need help to write additional permissions – Pavel Jan 5 '18 at 12:09
  • 1
    For the last time, no, because that note only applies to GPL'd code. LGPL'd code does not have that restriction, because the LGPL is a set of exceptions to the GPL designed to permit such linking. I accept that the exceptions are broad enough to allow an LGPL'd library to be linked against any proprietary code, rather than just the code you're interested in. But writing a halfway house set of exceptions that permit only linking to EPI isn't very free, and so is off-topic for this site, as well as being of interest only to you. I don't see a question here and have voted to close it. – MadHatter Jan 11 '18 at 7:58
2

I've discussed this situation with senior analyst from 'Open Source Vulnerability department' and she described that I was looking at it from the wrong side. Library owner/developer shouldn't worry about resolving possible conflicts with licenses which will be selected for products with this library. Developer should just select license which he wants.

Correct flow to resolve and select license:

  • Developer creates library for proprietary soft. Library can use API from linked proprietary libraries (EPiServer and Microsoft in my situation).
  • Code owner select license for his code/library (LGPLv3) and should add notes to the README file that the library uses proprietary products (EPiServer);
  • Proprietary libraries must be dynamically linked (not statically by including code) to LGPLv3 library;
  • Anyone who is developing application by using proprietary technology (EPiServer) can use such library but they must resolve possible conflicts with licenses (e.g. they have to buy license for EPiServer).
  • Application owner have to select appropriate license for the end product which won't violates other licenses (LGPLv3, EPiServer and Microsoft licenses).

It's possible because LGPLv3 was designed specifically for shared components (like libraries) and it can't be used for application (I could be wrong). Also library can't work without application so the application owner have to buy license for the proprietary products

  • 3
    The LGPL can be used for an application (there's no special prohibition against it), but in that case it's not much different from the GPL. The major differences between the LGPL and GPL manifest when the code is used as a library, so if you're not using it as a library, there's no significant difference. – apsillers Jan 11 '18 at 18:40
  • Very true, though the OP's very first point above is that the thing (s)he's created is a library. – MadHatter Jan 13 '18 at 7:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.