2

Suppose a developer named Peter has an application named AppMIT licensed MIT that has a dependancy on Tony's library named LibLGPL licensed LGPLv3.

Please help me understand if the cases below are correct.

Case1 - What if Peter does NOT modify Tony's LibLGPL?

a. If Peter does not modify LibLGPL and wants to share his code by open-sourcing his AppMIT then nothing is required of Peter.

b. If Peter does not modify LibLGPL and wants to keep his AppMIT closed source and share within his organisation then nothing is required of Peter.

c. If Peter does not modify LibLGPL and wants to keep his AppMIT closed-source and wants share his application with his Company's clients (outside his company) then he has to allow within his application for his clients to switch Tony's LibLGPL to a different version and also make the source code of LibLGPL available to his clients. This means Peter has to either make his code open-source to only his client so they can change the build file (package.json, maven or some other build file) to switch the LibLGPL dependancy or if Peter does not want to share his source-code then he should allow some other way for his clients to dynamically update the LibLGPL dependancy.

  • In the above point 1c if Peter does not allow his clients to switch LibLGPL and does not make the source code of LibLGPL available to his clients then Peter is in violation of LGPLv3.

Case2 - What if Peter modifies Tony's LibLGPL?

a. If Peter modifies LibLGPL and makes his changes public by open-sourcing it as another project under the same LGPLv3 license or any other GPL license then nothing is required of Peter.

b. If Peter modifies LibLGPL and makes his changes public by creating a pull-request to Tony's LibLGPL Git repository then nothing is required of Peter even if the PR does not get approved as the PR (Peter's changes) is still available in history and therefore is open-source.

c. If Peter modifies LibLGPL and does not make his changes public and uses the LibLGPL code only within his organisation then nothing is required of Peter.

d. If Peter modifies LibLGPL and shares his closed-source application outside his Company (clients) making only the changes to the LibLGPL available to his clients then nothing is required from Peter. Open-sourcing his changes to the public is not required here as long as his clients have access to the modified LibLGPL source-code.

  • In the above point 4 if Peter does not allow his clients to switch LibLGPL AND does not make the source code of his modified LibLGPL available to his clients then Peter is in violation of LGPLv3.
  • Are the putative apps independent, communicating via some kind of interprocess communication rather than being linked together? If the former, one could make the case that they are separate apps and treat each licence independently although I don’t think this suggestion has been tested in court. – James McLeod Dec 18 '19 at 2:26
  • They are linked together as a jar or javascript npm dependency. No interprocess communication. The LGPL app is just a library. – captain Dec 18 '19 at 4:11
  • I've updated the question to state the AppLGPL is a library. Thank you for the link but it doesn't mention about how to deal with the LGPL library if it was modified. – captain Dec 18 '19 at 4:34
  • 1
    In point 4 of case 2 I think what you are saying is more or less correct but this wording is a little confusing: "open-sourcing his changes to the public is not required." Since AppLGPL is covered by the LGPL, then yes you do need to open source any changes you make there. But you have no obligation to distribute them, say, on a web site, where everyone can download them. However they are still open source; someone (i.e. one of your clients) could easily put them on a web site if they wanted according to the license, and you cannot forbid that with your own license. – Brandin Dec 18 '19 at 11:57
2

As I understand it, noting that IANAL/IANYL, and assuming that Peter is an employee of his company rather than a contracted resource:

1a. Mostly correct. You also have certain labelling and license-distribution obligations (see eg LGPLv3 s3); but as regards the provision of actual code, I think you're right.

1b. Correct.

1c. Correct; Peter must either supply AppMIT as a dynamically-linked executable, or if statically-linked to LibLGPL he must also supply the object file form of AppMIT so that it can be relinked in the field with a replacement for LibLGPL (LGPLv3 s4d).

2a. See 1a.

2b. No. You are conveying a modified version of LibLGPL, and so are bound by GPLv3 s6 (and thus also GPLv3 s5). LGPLv3 s2a exempts you from the licensing requirement in GPLv3 s5b, but you are still bound by the source-distribution requirements of GPLv3 s5. Merely pointing to a pull request to someone else's public repository won't meet these, particularly not if Tony takes his repository down; supplying a copy of the full corresponding source of modified LibLGPL to anyone who receives an executable copy of AppMIT will. If you don't know who these people are (for GPLv3 s6d conveyances) then making it available to everyone is your safest bet. It's fine to use a third-party hosting site to do so, but it should be your third-party hosting account, and if the third-party site goes down, you're obligated to bring it up elsewhere.

2c. Correct.

2d. Correct, though note that Peter may not attempt to prevent those clients from exercising their rights under LGPLv3, and re-distributing accordingly.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.