Hi,
during a package review I've stumbled over the following problem:
- a package ships the following in its tarball: a LGPLv2 library a GPLv2+ main application - the main application statically links the library and only the resulting binary is shipped in the final rpm
If I interpret http://fedoraproject.org/wiki/Licensing#GPL_Compatibility_Matrix correctly, the 2nd table should be consulted and so this mix is acceptable and the license mentioned in the spec file should be GPLv2+ (since the resulting binary would have this license).
I'm a little bit unsure about: - Does the fact, that the library is statically linked, affects the compatibility or does the same rules apply as for dynamic linking? - Since the LGPL sources would be in the src.rpm, do we have to mention both licenses in the spec file?
Thank you very much in advance!
Best regards, Christian
On 11/16/2009 06:03 PM, Christian Krause wrote:
I'm a little bit unsure about:
- Does the fact, that the library is statically linked, affects the
compatibility or does the same rules apply as for dynamic linking?
For the purposes of Fedora's licensing, no, it doesn't really make a difference.
- Since the LGPL sources would be in the src.rpm, do we have to mention
both licenses in the spec file?
You can, but you do not need to. We determine License based on the binaries:
https://fedoraproject.org/wiki/Packaging/LicensingGuidelines#License:_field
Since the binary is a combination of the LGPLv2+ static library and the GPLv2+ application code, while technically, the resulting work is LGPLv2+ and GPLv2+, by honoring the terms of the GPLv2+, you are always honoring the terms of LGPLv2+, so it is not necessary to explicitly list it in the License tag.
~spot
On Mon, Nov 16, 2009 at 7:24 PM, Tom "spot" Callaway wrote:
On 11/16/2009 06:03 PM, Christian Krause wrote:
I'm a little bit unsure about:
- Does the fact, that the library is statically linked, affects the
compatibility or does the same rules apply as for dynamic linking?
For the purposes of Fedora's licensing, no, it doesn't really make a difference.
- Since the LGPL sources would be in the src.rpm, do we have to mention
both licenses in the spec file?
You can, but you do not need to. We determine License based on the binaries:
https://fedoraproject.org/wiki/Packaging/LicensingGuidelines#License:_field
Since the binary is a combination of the LGPLv2+ static library and the GPLv2+ application code, while technically, the resulting work is LGPLv2+ and GPLv2+, by honoring the terms of the GPLv2+, you are always honoring the terms of LGPLv2+, so it is not necessary to explicitly list it in the License tag.
Yes but you are missing one thing. The library is LGPLv2. It is not LGPLv2+. Doesn't it make the resultant binary GPLv2, without the + ?
Orcan
On 11/17/2009 12:37 AM, Orcan Ogetbil wrote:
Yes but you are missing one thing. The library is LGPLv2. It is not LGPLv2+. Doesn't it make the resultant binary GPLv2, without the + ?
Well, the text of the LGPL says:
"You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices."
That basically means that LGPLv2* can be converted to GPLv2+.
~spot
"Tom "spot" Callaway" tcallawa@redhat.com wrote:
On 11/17/2009 12:37 AM, Orcan Ogetbil wrote:
Yes but you are missing one thing. The library is LGPLv2. It is not LGPLv2+. Doesn't it make the resultant binary GPLv2, without the + ?
Well, the text of the LGPL says:
"You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices."
Shortening the text does not help to understand the legal problem. The important next sentence is:
---> Once this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy. <---
For this reason, the license change typically is no option for an OS distributor.
Jörg
Orcan Ogetbil oget.fedora@gmail.com wrote:
Yes but you are missing one thing. The library is LGPLv2. It is not LGPLv2+. Doesn't it make the resultant binary GPLv2, without the + ?
There is nothing in the GPL that requires you to put binaries under GPL. In fact, you can't even do this in many cases. You just need to follow the conditions in section 3 for the binary.
If you ever like to convert LGPLv2 code to GPL, you of course cannot convert it to GPLv2+ but only to GPLv2.
Jörg
On Tue, Nov 17, 2009 at 8:29 AM, Joerg Schilling wrote:
Orcan Ogetbil wrote:
Yes but you are missing one thing. The library is LGPLv2. It is not LGPLv2+. Doesn't it make the resultant binary GPLv2, without the + ?
There is nothing in the GPL that requires you to put binaries under GPL. In fact, you can't even do this in many cases. You just need to follow the conditions in section 3 for the binary.
That assumes that the binaries are not considered "derived work", on which there is no general consensus. There are opinions in both ways.
If you ever like to convert LGPLv2 code to GPL, you of course cannot convert it to GPLv2+ but only to GPLv2.
Now this contradicts spot's conclusion. Where is the catch?
Orcan
Orcan Ogetbil oget.fedora@gmail.com wrote:
On Tue, Nov 17, 2009 at 8:29 AM, Joerg Schilling wrote:
Orcan Ogetbil wrote:
Yes but you are missing one thing. The library is LGPLv2. It is not LGPLv2+. Doesn't it make the resultant binary GPLv2, without the + ?
There is nothing in the GPL that requires you to put binaries under GPL. In fact, you can't even do this in many cases. You just need to follow the conditions in section 3 for the binary.
That assumes that the binaries are not considered "derived work", on which there is no general consensus. There are opinions in both ways.
I would be interested in getting information about lawyers who claim that the binary compilation results may be a "derived work" and of course I would like to read their legal reviews on this topic in order to be able to compare claims. I did not yet get in contact with such people....
If you talk to various lawyers from vaious countries, you will see that there seems to be a consensus that in order to create a derived work, you need to add a suffifient amount of own creation which only happens if you modify sources. It is obvious that this does not happen with the automated process of compiling and linking.
While I was trying to sue companies who abuse GPLd software in 2001 (long before Harald Welte did the same), my lawyer explained me that few of the claims of the GPL are enforcable in court and independend lawyers from different countries confirm that this does not only apply in Germany.
The US lawyer who counsels the OpenSource Initiative explains that the combination of a work under GPL and another work that is a library is a "collective work" in contrast to a "derived work". See page 114 ff. in: http://www.rosenlaw.com/Rosen_Ch06.pdf
BTW: I asked Eben Moglen about this in 2001 and in 2008 and he confirmed that the automated process of compiling/linking does not create a "derived work".
If you ever like to convert LGPLv2 code to GPL, you of course cannot convert it to GPLv2+ but only to GPLv2.
Now this contradicts spot's conclusion. Where is the catch?
It is obvious that your original conclusions are correct. Why should an author who forbids to use a later version of the LGPL (the license he originally selected for his work) give permission to use a later version of the alternate license (GPL)?
BTW: I cannot speak for the legal situation in the USA.... But in Germany, the law forbids you to sign a contract that you don't know while you sign. If the last publish date from the Copyright holder was before the final version of the GPLv3 was finished, the phrase "GPLv2 or any later" is void and GPLv2 applies.
Jörg
-
Christian Krause -
Joerg Schilling -
Orcan Ogetbil -
Tom Callaway