Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id 3296F200D08 for ; Thu, 21 Sep 2017 23:57:41 +0200 (CEST) Received: by cust-asf.ponee.io (Postfix) id 311371609E1; Thu, 21 Sep 2017 21:57:41 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id 500B31609DB for ; Thu, 21 Sep 2017 23:57:40 +0200 (CEST) Received: (qmail 58714 invoked by uid 500); 21 Sep 2017 21:57:39 -0000 Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: Reply-To: legal-discuss@apache.org List-Id: Delivered-To: mailing list legal-discuss@apache.org Received: (qmail 58704 invoked by uid 99); 21 Sep 2017 21:57:39 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd2-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 21 Sep 2017 21:57:39 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd2-us-west.apache.org (ASF Mail Server at spamd2-us-west.apache.org) with ESMTP id 9018D1A0B6A for ; Thu, 21 Sep 2017 21:57:38 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd2-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 2.799 X-Spam-Level: ** X-Spam-Status: No, score=2.799 tagged_above=-999 required=6.31 tests=[HTML_MESSAGE=2, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SORBS_WEB=1.5, SPF_PASS=-0.001] autolearn=disabled Received: from mx1-lw-eu.apache.org ([10.40.0.8]) by localhost (spamd2-us-west.apache.org [10.40.0.9]) (amavisd-new, port 10024) with ESMTP id h_MfgRYTmVG1 for ; Thu, 21 Sep 2017 21:57:35 +0000 (UTC) Received: from smtp475.redcondor.net (smtp475.redcondor.net [208.80.204.75]) by mx1-lw-eu.apache.org (ASF Mail Server at mx1-lw-eu.apache.org) with ESMTPS id CEAF05FE6B for ; Thu, 21 Sep 2017 21:57:34 +0000 (UTC) Received: from mailproxy11.neonova.net ([137.118.22.76]) by smtp475.redcondor.net ({096fa88a-70b2-40e7-9c10-71504124e555}) via TCP (outbound) with ESMTP id 20170921215731355_0475 for ; Thu, 21 Sep 2017 21:57:31 +0000 X-RC-FROM: X-RC-RCPT: Received: from [10.9.100.109] (unknown [208.93.128.118]) (Authenticated sender: ralph.goers@dslextreme.com) by mailproxy11.neonova.net (Postfix) with ESMTPA id 7F528360058 for ; Thu, 21 Sep 2017 17:57:27 -0400 (EDT) From: Ralph Goers Content-Type: multipart/alternative; boundary="Apple-Mail=_856B1995-7F8A-487B-BBE7-46E4ADECBE59" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Subject: Re: Using an LGPL dependency in Apache-licensed software Date: Thu, 21 Sep 2017 14:57:26 -0700 References: <0E794130-18BD-49A7-BF2F-EFA59236E5F7@cornell.edu> To: Legal Discuss In-Reply-To: <0E794130-18BD-49A7-BF2F-EFA59236E5F7@cornell.edu> Message-Id: <448098EE-6B41-40D4-BA39-37B88A1E931E@dslextreme.com> X-Mailer: Apple Mail (2.3273) X-DLP-OUTBOUND: 137.118.22.64/27 X-MAG-OUTBOUND: greymail.redcondor.net@137.118.22.64/27 archived-at: Thu, 21 Sep 2017 21:57:41 -0000 --Apple-Mail=_856B1995-7F8A-487B-BBE7-46E4ADECBE59 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 As I recall the LGPL says that if you modified the source then you must = make your modifications available. However, I could be wrong on that. Ralph > On Sep 21, 2017, at 11:45 AM, Chris Dembia wrote: >=20 > Thank you Stain. This is a point of confusion for me. It is both the = case that the LGPL part's source code is copied into my repository, = *and* that this part is compiled into their own JARs that users should = be able to swap out for their own JARs. In this case, do I avoid the = need to change the license for my own code to LGPL? >=20 > Thank you, > Chris >=20 >> On Sep 21, 2017, at 11:11 AM, Stian Soiland-Reyes > wrote: >>=20 >> Be aware that if you import the LGPL part into your source = repository, that may mean that effectively distribution of any compiled = binaries also needs to be LGPL "upgraded", as it's license requires that = the LGPL part can be user-replaced. (dvd player scenario) >>=20 >> In a traditional desktop/server Java project this is simple to = achieve by having the LGPL part as a separate and clearly named JAR, = referenced from your LICENCE. >>=20 >> If your application is source-only like with Python or JavaScript = there should not be much to worry about, but if you are compiling a = C-program or make other kind of binary bundles you (or your downstream) = need to be more careful.=20 >>=20 >> Using the Apache license for your own contribution is still more = permissive than going full LGPL, as it allows third-parties to remove = the LGPL-component and use (parts of) your code under the Apache = license. Your code can also then be "upgraded" to GPL3 if needed. >>=20 >> On 21 Sep 2017 4:33 pm, "Ralph Goers" > wrote: >> Chris, >>=20 >> Yes, you are free to use the Apache license for your software and = have a dependency that is LGPL licensed. The restrictions about not = using LGPL=E2=80=99d software as a required dependency at the ASF is a = policy decision as it means that anyone using the Apache licensed = software has to comply with the LGPL requirements, which are more = restrictive than the Apache license and user=E2=80=99s might be = surprised or confused by that. >>=20 >> Ralph >>=20 >> > On Sep 21, 2017, at 12:34 AM, Chris Dembia > wrote: >> > >> > Thank you for the helpful licensing Q&As you have made available on = apache.org . There=E2=80=99s a point on which I = could use additional guidance, if anyone on this list would be willing = to help me. >> > >> > I would like to use the Apache 2.0 license for a project of mine = (this project has nothing to do with the Apache Software Foundation = other than my desire to use the Apache 2.0 license). I=E2=80=99ve copied = source code for a dependency into my project (into my git repository), = and this dependency is LGPL-licensed. My question is: am I able to = license my code under the Apache 2.0 license in this scenario? >> > >> > This website (http://www.apache.org/legal/resolved.html#category-x = ) says that an = LGPL-licensed work cannot be included in an Apache 2.0-licensed work. Is = this the case only for projects within the Apache Software Foundation? I = understand that using copyleft components in Apache 2.0-licensed = software somewhat defeats the purpose of using a permissive license for = my project, but I would like to use this LGPL-licensed dependency, and = of the existing permissive licenses, I would like to use the Apache = license. Are the LGPL and Apache licenses incompatible in the direction = where LGPL-licensed work is used within Apache-licensed work? Of course, = I would need to comply with the terms of the LGPL license for the = dependency (by allowing relinking, etc.). >> > >> > Thank you for any help you can provide. >> > Chris >> > = --------------------------------------------------------------------- >> > To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org = >> > For additional commands, e-mail: legal-discuss-help@apache.org = >> > >> > >>=20 >>=20 >>=20 >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org = >> For additional commands, e-mail: legal-discuss-help@apache.org = >>=20 >=20 --Apple-Mail=_856B1995-7F8A-487B-BBE7-46E4ADECBE59 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
As I recall the LGPL says that if you = modified the source then you must make your modifications available. = However, I could be wrong on that.

Ralph

On = Sep 21, 2017, at 11:45 AM, Chris Dembia <cld72@cornell.edu> = wrote:

Thank you = Stain. This is a point of confusion for me. It is both the case that the = LGPL part's source code is copied into my repository, *and* that this = part is compiled into their own JARs that users should be able to swap = out for their own JARs. In this case, do I avoid the need to change the = license for my own code to LGPL?

Thank you,
Chris

On Sep 21, 2017, at 11:11 AM, Stian Soiland-Reyes <stain@apache.org> = wrote:

Be aware that if you import the LGPL part into = your source repository, that may mean that effectively distribution of = any compiled binaries also needs to be LGPL "upgraded", as it's license = requires that the LGPL part can be user-replaced. (dvd player = scenario)

In a traditional desktop/server Java project = this is simple to achieve by having the LGPL part as a separate and = clearly named JAR, referenced from your LICENCE.

If your = application is source-only like with Python or JavaScript there should = not be much to worry about, but if you are compiling a C-program or make = other kind of binary bundles you (or your downstream) need to be more = careful. 

Using the Apache license for your own = contribution is still more permissive than going full LGPL, as it allows = third-parties to remove the LGPL-component and use (parts of) your code = under the Apache license. Your code can also then be "upgraded" to GPL3 = if needed.

On 21 Sep 2017 4:33 pm, "Ralph Goers" <ralph.goers@dslextreme.com> wrote:
Chris,

Yes, you are free to use the Apache license for your software and have a = dependency that is LGPL licensed. The restrictions about not using = LGPL=E2=80=99d software as a required dependency at the ASF is a policy = decision as it means that anyone using the Apache licensed software has = to comply with the LGPL requirements, which are more restrictive than = the Apache license and user=E2=80=99s might be surprised or confused by = that.

Ralph

> On Sep 21, 2017, at 12:34 AM, Chris Dembia <cld72@cornell.edu> = wrote:
>
> Thank you for the helpful licensing Q&As you have made = available on apache.org. There=E2=80=99s a point on = which I could use additional guidance, if anyone on this list would be = willing to help me.
>
> I would like to use the Apache 2.0 license for a project of mine = (this project has nothing to do with the Apache Software Foundation = other than my desire to use the Apache 2.0 license). I=E2=80=99ve copied = source code for a dependency into my project (into my git repository), = and this dependency is LGPL-licensed. My question is: am I able to = license my code under the Apache 2.0 license in this scenario?
>
> This website (http://www.apache.org/legal/resolved.html#category-x) says that an LGPL-licensed work = cannot be included in an Apache 2.0-licensed work. Is this the case only = for projects within the Apache Software Foundation? I understand that = using copyleft components in Apache 2.0-licensed software somewhat = defeats the purpose of using a permissive license for my project, but I = would like to use this LGPL-licensed dependency, and of the existing = permissive licenses, I would like to use the Apache license. Are the = LGPL and Apache licenses incompatible in the direction where = LGPL-licensed work is used within Apache-licensed work? Of course, I = would need to comply with the terms of the LGPL license for the = dependency (by allowing relinking, etc.).
>
> Thank you for any help you can provide.
> Chris
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
> For additional commands, e-mail: legal-discuss-help@apache.org
>
>



---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org



= --Apple-Mail=_856B1995-7F8A-487B-BBE7-46E4ADECBE59--