How does an LGPLv3 dependency affect an application when sharing the dependent application with others?

Question

Suppose a developer named Peter has an application named AppMIT licensed MIT that has a dependancy on Tony's library named LibLGPL licensed LGPLv3.

Please help me understand if the cases below are correct.

Case1 - What if Peter does NOT modify Tony's LibLGPL?

a. If Peter does not modify LibLGPL and wants to share his code by open-sourcing his AppMIT then nothing is required of Peter.

b. If Peter does not modify LibLGPL and wants to keep his AppMIT closed source and share within his organisation then nothing is required of Peter.

c. If Peter does not modify LibLGPL and wants to keep his AppMIT closed-source and wants share his application with his Company's clients (outside his company) then he has to allow within his application for his clients to switch Tony's LibLGPL to a different version and also make the source code of LibLGPL available to his clients. This means Peter has to either make his code open-source to only his client so they can change the build file (package.json, maven or some other build file) to switch the LibLGPL dependancy or if Peter does not want to share his source-code then he should allow some other way for his clients to dynamically update the LibLGPL dependancy.

• In the above point 1c if Peter does not allow his clients to switch LibLGPL and does not make the source code of LibLGPL available to his clients then Peter is in violation of LGPLv3.

Case2 - What if Peter modifies Tony's LibLGPL?

a. If Peter modifies LibLGPL and makes his changes public by open-sourcing it as another project under the same LGPLv3 license or any other GPL license then nothing is required of Peter.

b. If Peter modifies LibLGPL and makes his changes public by creating a pull-request to Tony's LibLGPL Git repository then nothing is required of Peter even if the PR does not get approved as the PR (Peter's changes) is still available in history and therefore is open-source.

c. If Peter modifies LibLGPL and does not make his changes public and uses the LibLGPL code only within his organisation then nothing is required of Peter.

d. If Peter modifies LibLGPL and shares his closed-source application outside his Company (clients) making only the changes to the LibLGPL available to his clients then nothing is required from Peter. Open-sourcing his changes to the public is not required here as long as his clients have access to the modified LibLGPL source-code.

• In the above point 4 if Peter does not allow his clients to switch LibLGPL AND does not make the source code of his modified LibLGPL available to his clients then Peter is in violation of LGPLv3.

Answer 1

As I understand it, noting that IANAL/IANYL, and assuming that Peter is an employee of his company rather than a contracted resource:

1a. Mostly correct. You also have certain labelling and license-distribution obligations (see eg LGPLv3 s3); but as regards the provision of actual code, I think you're right.

1b. Correct.

1c. Correct; Peter must either supply AppMIT as a dynamically-linked executable, or if statically-linked to LibLGPL he must also supply the object file form of AppMIT so that it can be relinked in the field with a replacement for LibLGPL (LGPLv3 s4d).

2a. See 1a.

2b. No. You are conveying a modified version of LibLGPL, and so are bound by GPLv3 s6 (and thus also GPLv3 s5). LGPLv3 s2a exempts you from the licensing requirement in GPLv3 s5b, but you are still bound by the source-distribution requirements of GPLv3 s5. Merely pointing to a pull request to someone else's public repository won't meet these, particularly not if Tony takes his repository down; supplying a copy of the full corresponding source of modified LibLGPL to anyone who receives an executable copy of AppMIT will. If you don't know who these people are (for GPLv3 s6d conveyances) then making it available to everyone is your safest bet. It's fine to use a third-party hosting site to do so, but it should be your third-party hosting account, and if the third-party site goes down, you're obligated to bring it up elsewhere.

2c. Correct.

2d. Correct, though note that Peter may not attempt to prevent those clients from exercising their rights under LGPLv3, and re-distributing accordingly.