4

I have a commercial software project that uses a third party lib (org.quartzscheduler), this has an Apache 2.0 license. I thought I was ok but when I checked the transitive dependencies I found that Quartz uses the c3p0 library which is distributed under the LGPL.

My understanding is that the LGPL is a fairly "weak" copyleft license and so providing I have not amended the library under the license directly I am ok to distribute commercial software that uses the lib without having to provide my source code.

Is my understanding correct? Also to what extent do I need to care about transitive dependencies of the libs I use? How deep do I need to go?

  • I have the same understanding. However I'm not a lawyer so this shall in no way be considered as a legal advice. For commercial project, such serious questions shall really be handled by a legal expert. The impact of a wrong interpretations are simply to high. It makes me think of this guy who was forced by justice to hand over his yacht to an ebay purchaser who offered a couple of dollars and no minimum amount was set for the sale... – Christophe Mar 15 '16 at 22:03
  • 1
    Many Thanks for taking the time to respond. I will of course, get formal advice from legal professionals but I just wanted to put my toe in the water in the first instance. – paulnnosh Mar 16 '16 at 14:53
1

LGPL is "weaker" than the GPL, but not in the way you describe. The difference has nothing to do with whether or not you modified the LGPL'd library.

Here's a very rough high-level description that should help get your intuition on the right track: The GPL requires that if your program uses any GPL'd code, your entire program must be free (as defined by the "four freedoms" the FSF describes here). The LGPL requires that if you use any LGPL'd code, that LGPL'd code must be free even if the rest of your program is not. In particular, that means all users of your program must be able to modify the LGPL'd library within your program however they like, even if they are not able to modify the rest of your program.

If you want the rest of your program to remain closed source, then in practice the simplest way of complying with the LGPL is usually to link your program to the LGPL'd library dynamically rather than statically, since the end user can easily swap one .dll file for another without recompiling or even relinking your code. Another less common option is to provide all of the object files that were statically linked into your program, but not their source code, so the end user can redo the linking if they want to change the LGPL'd library. For more information, I highly recommend browsing the FSF's official FAQ page on GNU licenses.

Regarding transitive dependencies, the short version is that if this worries you, you need a proper lawyer to check this stuff. If one of your dependencies has a GPL dependency you didn't know about, you're still violating the GPL just as much as anyone else is, so this can be a serious problem.

  • I think the main worry is whether or not OP has to provide his own code due to the LGPL library. It is clear that the obligations of the LGPL related to the LGPL library need to be respected (i.e. "do not restrict modification of the portions of the Library contained...", but also copyright notices and so on) – Christophe Mar 15 '16 at 22:17
  • Thanks for the clarity on LGPL v GPL it was something I have been trying to get my head around. Also many thanks for taking the time to respond to my question. – paulnnosh Mar 16 '16 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.