Does interacting with a (L)GPL licensed library through PHP7.4 FFI count as a derived work?

Question

Problem description

I recently wrote a PHP(7.3) wrapper for accessing some git functionality (I use git to create incremental backups).

Another wrapper I wrote is for gpg (to encrypt my backups).

These wrappers use phps shell_exec function and thus are not derived works (as far as I understand) because the gpl programms run through the shell in a different process.

With php 7.4 I would like to get rid of shell_exec and use the foreign function interface (FFI) instead.

Assumptions about the (L)GPL:

• LGPL allows dynamic linking (according to this answer) without having to apply the LGPL license to the dynamically liked code, since php is an interpreted language this should be the case even when using the FFI (based on this answer about static vs dynamic linking).

• The GPL does not differentiate between dynamic and static linking and sees both as derived works if linking in our program to gpl licensed library and thus I would have to publish the code under the same license (only to the person/organisation I distribute the program to).

Assumptions about PHP FFI:

(php7.4 FFI example): The following counts as dynamic linking ?:

<?php
// create FFI object, loading libc and exporting function printf()
$ffi = FFI::cdef(
    "int printf(const char *format, ...);", // this is a regular C declaration
    "libc.so.6");
// call C's printf()
$ffi->printf("Hello %s!\n", "world");
?>

Conclusions:

• PHP 7.4 FFI counts as dynamic linking because the php script does only link to the functions and/or data structures of the library but not contain them.

• So since libgcrypt is licensed under the LGPLv2.1+ I can wrap it with the php FFI because the LGPL allows dynamic linking and and php FFI calls count as dynamic linking.

• In the case of libgit2 I would have to publish my code under the gplv2 (only to the person/organisation I distribute the program to). Except that in this case the authors have given a linking exception. Hence I can keep my php code under my own license but only because the authors gave a linking exception.

Answer 1

Is using PHP FFI similar to dynamic linking?

Yes. Your code sample demonstrates loading a file which contains executable code (libc.so.6) into your own program and calling portions of that code from your program. That is essentially dynamic linking.

However, note that neither the LGPLv2 (libgcrypt's license) nor the GPLv2 + linking exception (libgit's license) technically depend on a specific type of linking from a technical standpoint. The licenses try to use phrases like "combination," "derivative" or "containing portions of the Library," probably to avoid singling out a specific method of linking.

Can I use libgcrypt (LGPL v2 licensed) with PHP using FFI?

If you call functions from an LGPL-licensed library from your own program using the PHP FFI mechanism, then the LGPL v2 seems to be of the opinion that your work then becomes a 'derivative' of the LGPL-licensed library:

... linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.

(LGPL v2 Section 5)

In this case the "executable" is your program (your .php file). Fortunately Section 6 is fairly permissive in how you can distribute it together with the LGPL library:

As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.

(LGPL v2 Section 6)

So basically what that says is that if you use an LGPL library, then the license terms of your own program are basically unaffected. For example, you aren't required to provide source code for your program, but it also says that you aren't allowed to prohibit your customer from modifying or reverse engineering his own copy of your program (proprietary software licenses often have such prohibitions.)

Can I use libgit (GPL v2 licensed + linking exception) with PHP using FFI?

As for the GPL v2 (before we consider the linking exception), that license also considers linking as producing a sort of derivative:

[The GPL v2 Section 2 requirements] apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, ...

(GPL v2 Section 2)

On the one hand, you could read that and "reasonably consider" that your program is separate from the library, but on the other hand, the same paragraph also asserts "when you distribute the same sections as part of a whole ... the distribution of the whole must be on the terms of this License."

This might appear to mean that linking with a GPL library means that you also have to release your program as GPL as well. But the linking exception in this case seems to explicitly give you permission to link to such a library, probably without requiring that you make your own program GPL'ed as well. It says the following:

In addition to the permissions in the GNU General Public License, the authors give you unlimited permission to link the compiled version of this library into combinations with other programs, and to distribute those combinations without any restriction coming from the use of this file.

(GPL v2 + Linking Exception)

So basically what that says is that you can use and distribute your .php file + libgit.so combination "without any restriction." Personally I think the LGPL language of "under terms of your choice" is clearer, but basically the intention seems to be about the same -- you are allowed to use the library + your program combination without it affecting (or precisely 'restricting') your program from a licensing standpoint.