5

I'm about to release my LGPL 2.1 licensed java/maven project where I have a dependency to a 3rd party jar also licensed under LGPL 2.1. I've also copied and modified some of the 3rd party project into my own project. I have some trouble to understand if I have to handle attribution, and if I do, how do I do it specifically.

Just to be clear. My understanding of what attribution means when it comes to open source projects, is that if you use someones else work (in my case a 3rd party jar), you have to give the developer of that work some acknowledgement in your own project. In the Apache License 2.0 I understand that this is done in NOTICE file where you can state that: "This project uses 3rdParty project. You can find the contributors at http:/3rdpartyproject.com".

Now to my questions.

  1. Do I have a correct understanding of what attribution is? If not, describe why I am wrong.

  2. What part in the LGPL 2.1 license text states the requirement of the attribution?

  3. How do I do the attribution to the 3rd party dependency specifically? If there only are a generic answer, please give an example that is okay, for example, a NOTICE file where a text like this exists "This library uses 3rdPartyProject.."

Improve this question
2
  • When you say, "I've also copied and modified some of the 3rd party project into my own project," do you mean you have taken pieces of LGPL-licensed code and directly incorporated them into your own code? If this is the case, then your entire project may be a derivative of the LGPL work and must be licensed as a whole under the LGPL. If your mean only that you have taken some library files and used them as a library (that is simply located within your distribution) then LGPL obligations remain localized to the library, but you must make it easy for the user to replace the LGPL library files.
    – apsillers ♦
    Commented Mar 19, 2018 at 18:33
  • @apsillers Yes I've copied code from the 3rdparty project under LGPL, and thereby I will license my project as LGPL as well
    – Stefan Vahlgren
    Commented Mar 19, 2018 at 19:50

1 Answer 1

Reset to default
7

1. Do I have a correct understanding of what attribution is? If not, describe why I am wrong.

In the GPL family of licenses (and in many other licenses), attribution comes in the form of a copyright notice. You may also provide attribution in other forms, but this is a courtesy not required by the license.

2. What part in the LGPL 2.1 license text states the requirement of the attribution?

There are two attribution requirements in LGPL 2.1. The first is in section 1, which applies to any distribution of the source code (including modified code and mandatory source distribution alongside machine code):

[you must] conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty

Simple enough: in the source code that you distribute, include correct copyright information and don't remove messages that indicate the licensing status of particular files under the LGPL. (e.g., the headers that start with, "This library is free software; you can redistribute it...") This requirement does not affect non-source binary files you distribute; those will be covered in the next requirement.

The second requirement is in section 6. It applies to the distribution of a larger work that includes a linked LGPL library:

You must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License.

So, you must "give prominent notice" that he library is used by your software, and display copyright notices for the library, if your software displays any copyright notices.

3. How do I do the attribution to the 3rd party dependency specifically?

You may do so in any reasonable way. The FSF (the author of the LGPL) says of this requirement:

Some common and acceptable ways that "prominent notice" is done is by clearly giving a notice in the user manual that accompanies the software, by stating a notice in an "About" box in a GUI program, or by printing a notice on the screen at System startup. In general, much flexibility is available for giving this "prominent notice".

An example for the first part (e.g., that you might include in a manual or About screen) could look like

This program uses the Foobar Library, which is licensed under the GNU Lesser General Public Library, version 2.1.

If you show copyright notices in your program, then you must also include a copyright notice and pointer to the LGPL:

This software uses the Foobar Library.

Copyright 2016 Jane Doe

The Foobar Library is licensed under the GNU Lesser General Public Library, version 2.1. You can find a copy of this license at https://www.gnu.org/licenses/lgpl-2.1.en.html

Improve this answer
3
  • I dont get this: "Simple enough: include correct copyright information and don't remove messages that indicate the licensing status of particular files under the LGPL". What are the messages that I should'nt remove? Is this the copyright notice I copied from the 3rd party project or what is it? Also, the example after: "An example for the first part might look like" Is this what I should use here? The About part was very clearly explained. Thank you
    – Stefan Vahlgren
    Commented Mar 19, 2018 at 18:42
  • @StefanVahlgren To be clear (note: I just edited the answer to be more clear), the requirements in section 1 apply to source code only (which includes source you are required to distribute alongside binary code, but not to the binary code itself). The messages you should not remove are the headers that begin, "This library is free software; you can redistribute it..." and they usually have a copyright notice within them as well. Keep that copyright notice, and optionally add your own if you made copyrightable changes to a file yourself.
    – apsillers ♦
    Commented Mar 19, 2018 at 19:04
  • Okay. And I guess I should leave the original copyright notice in the header as well? So after I aded my own modifications and updated my own copyright notice, the header i the source file should be similar to this: Copyright (C) 2018, by project MyProject Copyright (C) 2010, by project 3rdPartyProject This library is free software; you can redistribute it .... ? And more thing (a bit of topic though). You say "... source you are required to distribute alongside binary code". My project source will be available at github, and binary at sonatype as jar. Is this enough?
    – Stefan Vahlgren
    Commented Mar 19, 2018 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.