I want the app to be closed source and as hard as reasonably possible to reverse engineer.
The first part of this request is easy to satisfy. The LGPL expressly makes the second part to some degree impossible.
Qt hosts a practical summary of the LGPL's requirements. I won't repeat the entire summary here (definitely read it!), but the first three items are major principles of the LGPL, so I'll offer slightly more explanation:
- Complete corresponding source code of the library used with the application or the device built using LGPL, including all modifications to the library, should be delivered with the application (or alternatively provide a written offer with instructions on how to get the source code). It should be noted that the complete corresponding source code has to be delivered even if the library has not been modified at all.
The LGPL's most significant requirement is that you must offer the complete source code of the library (here, Qt), including any modifications you've made. This is pretty easy to satisfy: offer a download of Qt's LGPL source code from the same place you offer the binary, or include physical media with the source (or written offer) alongside a physical distribution of the binary.
- In case of dynamic linking, it is possible, but not mandatory, to keep application source code proprietary as long as it is “work that uses the library” – typically achieved via dynamic linking of the library. In case of static linking of the library, the application itself may no longer be “work that uses the library” and thus become subject to LGPL. It is recommended to either link dynamically, or provide the application source code to the user under LGPL.
The LGPL obligates you to share only source code for the library itself, while an application that uses the library (i.e. the code you and your contractor are writing now) can remain free of this requirement. However, it is possible that, under copyright law, in at least some jurisdictions, static linking your application code to the library may cause your application code to become part of the same work under copyright law. This would cause source-sharing obligations to apply to your application as well. To avoid this complication, ensure that your application dynamically links to the library instead of statically linking to it.
- The user is allowed to change and re-link the library used in the application or device – including reverse engineering. With LGPLv3 it is explicitly stated that the user also needs to be able to run the re-linked binary, and that sufficient installation information must be provided. In practice, this forbids the creation of closed devices, also known as tivoization.
This refers to the requirement to enable reverse engineering, which may be the a deal-breaker for you. The LGPL requires that users be able (both legally and technically) to replace the LGPL-licensed library with their own modified version. The language for distributing "Combined works" (application plus library) is in section 4 of the LGPLv3:
You may convey a Combined Work under terms of your choice that, taken together, effectively do not restrict modification of the portions of the Library contained in the Combined Work and reverse engineering for debugging such modifications...
[...]
- d) Do one of the following:
- 0) Convey the Minimal Corresponding Source under the terms of this License, and the Corresponding Application Code in a form suitable for, and under terms that permit, the user to recombine or relink the Application with a modified version of the Linked Version to produce a modified Combined Work...
- 1) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (a) uses at run time a copy of the Library already present on the user's computer system, and (b) will operate properly with a modified version of the Library that is interface-compatible with the Linked Version.
In summary:
It must be easy for a user to link a modified version of the library.
It must be legal for the user to reverse engineer your application binary for the purposes of debugging LGPL library modifications. In practice, this likely means you can't legally restrict any reverse engineering, since you can't definitively prove that any act of reverse engineering is not done for the purposes of debugging a library modification.
- Imposing arbitrary technical barriers to reverse engineering your closed-source application code appears to be permissible, as long as you do not intend to punish users who manage to bypass them, and as long as those barriers do not complicate the process of linking a modified library.
- However, note that users may easily insert debugging code in a modified library, which could be substantial help in defeating any anti-circumvention mechanisms you include.
