0

I am working on a project that uses a C++ library licensed under CDDL v1.0. Ideally I would like to publish it commercially as well as keep it closed source (wouldn't mind open sourcing it but then it'd be hard to make any profit)

I know that I can distribute the app commercially, but it is not clear to me if I have to share the source code as well as licence my package with CDDL too.

What are the factors:

  • Does it matter that I modify the library or not? (I plan not to make any changes to the lib)

  • Static/Dynamic linking. does that have any effect? I do prefer to include the library within the final executable.

Yea.. so I guess my question is as follows:

Closed Source + CDDL licensed static lib = OK?

Improve this question

1 Answer 1

Reset to default
4

CDDL is a “weak copyleft” license, roughly similar to the LGPL.

  • you are allowed to combine the CDDL covered software with your software, e.g. by static linking
  • your software will not fall under the CDDL
  • if you modify the CDDL-covered component, your modifications must be CDDL-licensed as well
    • you must also include a notice that identifies you as the contributor for this modification
  • when you distribute CDDL-covered software (whether standalone or linked with a larger software) you have to:
    • make the source code of the CDDL-covered software available
    • include a copy of the license with the source code
    • inform users how to acquire the source code for CDDL-covered components “in a reasonable manner on or through a medium customarily used for software exchange”
  • you are not required to distribute the executable form of the CDDL-covered software under the CDDL license, but may choose a different license, if:
    • you otherwise comply with the CDDL, and
    • the different license does not limits or alters the recipient's rights to the source code, and
    • you make it absolutely clear that the different license is offered by you alone, not by the initial developers or contributors of the CDDL-covered software.

To summarize all of this, having a proprietary software that includes a CDDL-covered library (no matter how it is linked) is perfectly fine. For example, you might take the following steps for compliance:

  • make the library source code available in a public GitHub repository under your control. If it's already available there, consider just forking it.
  • in your proprietary licensing agreement, note that parts of the software may be under open source licenses that provide additional permissions (and where to find more info about these components
  • in the included documentation of your software, include a list of all included open source components with their names, websites, copyright notices, and licenses. For the CDDL-covered components, note that the source code is available at a linked GitHub repository.
Improve this answer
2
  • Alright, so it's less strict compared with LGPL, because if you statically link a LGPL library in your software, then the whole software has to be open source under LGPL as well.
    – Fanckush
    May 4, 2019 at 15:40
  • @Fanckush The LGPL does not require the software to be open sourced, it just requires that the end users have the freedom to modify the LGPL-covered components. That can also be managed by publishing the source under a proprietary license, or by publishing object files for relinking, or by dynamic linking. But yes, the CDDL is a bit more permissive.
    – amon
    May 4, 2019 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.