Tags

, , , , , , , ,

…and particularly the viral nature of GPL (and LGPL).

I spent the whole day looking at and reading (Yes, actually reading!) licenses, articles related to them and analysis about them.

This pursuit started due to something that I had been wondering about: What considerations do commercial software projects need to have in regards to the licenses of the libraries they use?

As in: Does a library’s license affect the license of the software project?

Short Answer: Yes!

But wait! you might say, I’m not modifying the library or doing anything bad with it, I’m just using it, as it was meant to be used!

That is not relevant. What IS relevant is if the library has a viral and/or restrictive license.

According to the GPL FAQ, if the library your software project uses is released with the GPL license, then your software project MUST also be released with the GPL license. In short, the library’s license ‘infects’ your software project.

from: gnu.org/licenses/gpl-faq.html

If a library is released under the GPL (not the LGPL), does that mean that any software which uses it has to be under the GPL or a GPL-compatible license?
Yes, because the software as it is actually run includes the library.

from: freebsd.org/doc/en/articles/bsdl-gpl/article.html

[…]The GPL was designed to be the antithesis of the standard proprietary license. To this end, any modifications that were made to a GPL program were required to be given back to the GPL community (by requiring that the source of the program be available to the user) and any program that used or linked to GPL code was required to be under the GPL. The GPL was intended to keep software from becoming proprietary. As the last paragraph of the GPL states[…]

This same thing may apply with other, less known, viral licenses. (know any? post a reply.)

If the library your software uses is released under a BSD/MIT/Apache license, then there is no such problem.

Here’s a common form of the MIT license from Wikipedia:

Copyright (C) <year> <copyright holders>

Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

That’s it! ~3 paragraphs! Mere mortals (non-lawyers) can read and understand this –well the Apache license is a bit of a read, but the gist of it is similar. If your program uses an MIT licensed library you just have to mention the library’s copyright and license in your program (ie in the help system or he about dialog, as is very common.). Other than that, you can go nuts with it!

Worth noting is that the GPL recommends you use a ~3-paragraph text as a license notice in your distribution, with a link to the full license — and let the users follow the link to get to the huge, 17 paragraph, multiple-page license — that’s a BIG difference there.

More craziness, the LGPL License

If you dynamically link your software with a library released with an LGPL (Lesser GPL) license, then there is no problem, your program can be proprietary and commercial.

If you statically link your software with a library released with an LGPL (Lesser GPL) license, then your software MUST be released with the LGPL license!

That last little caveat causes problems in the embedded devices world, but as an aside I might add that it appears, to me, that it is largely ignored by manufacturers — if it was not then where is the source code for: my router, my e-book reader, my media player, my NAS, my washing machine, my alarm system, my cell phone*? None of them came with source code; and I bet some of them statically link with at least one LGPL licensed library.

Note: The above paragraph has absolutely no research to back it up. Yes I’m pulling it out of thin air. But think about it, do you really think none of your Linux based consumer devices have an LGPL licensed library embedded (and statically linked) in them? really?

Creative Commons (ie. CC BY-NC-SA)

If you happen to come against some library released under a CC BY-NC-SA license, there’s further trouble in that the GPL is incompatible with CC, so if you use a CC licensed library you cannot even release your software project under the GPL.

From the Creative Commons FAQ:

Creative Commons licenses should not be used for software.

One example: CS50’s C library v3.0 is a small assisting library for use as a teaching aid during the course. The entire course is released under CC BY-NC-SA 3.0 The author(s) of the library may have intended to use an open source license for the library, but the whole course’s license was used instead. I believe this means that any code that uses cs50.h/cs50.c must also be under CC BY-NC-SA 3.0. (Note: Even the GPL is incompatible with CC, so you cannot use a CC licensed library in a GPL project).

Perhaps I’m stretching it, but: Shouldn’t the course allow their students to look back at their course notes/materials X years later and do a quick-ish work-related hack for commercial reasons? the NC in CC BY-NC-SA 3.0 may mean no. I’m not sure.

Yes i know, if you really wanted to use an input library, you should look for a ‘proper’ (read: complicated) library…. but hey if it works why not use it?

(I’m currently waiting for an email reply from CS50 folks about that little detail. )

After an email to CS50‘s instructor I got this responce:

Ah, thanks for catching!
http://mirror.cs50.net/library/c/cs50-library-c-3.1/

Note the BSD 3-clause license on the top comments for v3.1 of the CS50 C library.

Conclusion:

Are you writing a library? Do you plan to open source it?
If so, be very careful about the license you choose for it.
Maybe, just maybe, in the future you plan to use your library in a commercial application.
BUT:
If you released your library with a GPL license, you definitely cannot make a commercial application that uses it.
If you released your library under the LGPL you probably can. (the LGPL is also a bit restrictive)
If you released your library under a BSD/MIT/Apache license, you definitely can.

There’s always the completely alternative approach to ‘commercial’, ie. MySQL or WordPress. But that approach — ie. selling support, leasing expert assistance, teaching courses about the software, etc.. — does not always work for all kinds of projects.

Links for your own research:

  1. GPL v2 http://www.gnu.org/licenses/gpl-2.0.html
  2. GPL v3 http://www.gnu.org/licenses/gpl.html
  3. Why you should use a BSD style license for your Open Source Project: freebsd.org/doc/en/articles/bsdl-gpl/article.html
  4. Why the GPL is Incompatible with Commercial Software: encodable.com/tech/blog/2006/02/25/Why_the_GPL_is_Incompatible_with_Commercial_Software
  5. MIT License: wikipedia.org/wiki/MIT_License
  6. BSD License: wikipedia.org/wiki/BSD_license
  7. Apache License: apache.org/licenses/LICENSE-2.0.html
  8. O’Reilly: “Open Sources: Voices from the Open Source Revolution” oreilly.com/catalog/opensources/book/brian.html
  9. O’Reilly: “Understanding Open Source and Free Software Licensing” oreilly.com/openbook/osfreesoft/book/index.html
  10. GPL FAQ: gnu.org/licenses/gpl-faq.html#IfLibraryIsGPL
  11. Why CLISP is under GPL: clisp.cvs.sourceforge.net/viewvc/clisp/clisp/doc/Why-CLISP-is-under-GPL
  12. use of a CC-BY-SA Library in software project: stackoverflow.com/questions/7197381/what-exactly-creative-commons-license-means-for-me
  13. Berne Convention (international agreement about copyright): http://www.wipo.int/treaties/en/ip/berne/trtdocs_wo001.html

(*) Err ok, we do have access to the Andoird sources.