Hacker News Reader

Hacker News

Comment by eurasiantiger | Hacker News Reader

Parent Full thread

eurasiantiger

Why is bundling a (L)GPL .dll considered a violation?

View on HN

Because you have to make the source code available to people who receive your distribution of the library.

So? Maybe malwarebytes are doing that?

Are they? I got the sense that this is the issue.

I'll have to brush up on this, GPL that's not seen by people say it does something in messaging or part of DNS or something, it would still have to be public? Use case is part of some web-app that isn't installed.

If its running on your server, then you aren't distributing it. There are licenses like AGPL that do try to limit that usage but GPL does not. Now if it is a web app that has client code that gets executed in the browser, that is distributed to the end user and GPL would apply, so you would need to include license notifications for that within your app or as part of the source code distributed. In that case you are already distributing source but you may need to make an unobfuscated source available if your distribution is minified/uglified.

YANAL ha, but I was curious even if we did have to disclose the specific GPL piece of software, do we only have to release that part? Not the entire app.

> web app that has client code that gets executed in the browser,

That's the technicality stuff, the client triggers an event, that then uses this GPL piece of code that is on the server. I went through our stuff (mostly NPM) and they all are either Apache/MIT but there was one piece like ahh... Anyway not making money yet but will bring this up for review with legal.

Thanks

Did you ask?

You shouldn’t have to ask. The GPL requires that the distributor either sends the source code alongside the binaries, or that the distributor sends along an explicit written offer to send the source code. If you, as a recipient of binaries, did not get such an offer, and no source code was sent along the binaries either, the GPL was violated. There is no recovery from this, even if the distributor sends the source code on request.

Can you point to where in the GPL it says that it must be explicitly offered? I don't remember ever reading anything that gave me that impression, or anyone even informally mentioning that was the case.

I ask because I'd be in violation. I've attached the GPL to a bunch of dinky little projects I haven't bother hosting a public repository for because I don't think anyone else in the 'verse really cares. In most cases I know I'm the only user, but there are a few that some other people have at least downloaded (probably bots or mistakes, but downloaded nonetheless).

Section 6 pretty much lets you choose between:

- Bundling the source with the program (a)

- Letting people download the source from the same place as they can download the program (d)

- A written offer to hand over the source on request (b, c, e)

https://www.gnu.org/licenses/gpl-3.0.en.html

You’re not in violation. If people download the binaries, and you offer the source code at the same download site, and they choose not to download the source code, that’s on them; you are off the hook.

I also did not mention (because it was not relevant to the parties being discussed) one other option: If you received the binaries from someone else, with a written offer for source code, and you are distributing the binaries non-commercially, you can simply forward a copy of the written offer of source code you received.

The section of the GPL 2 you want is section 3, and in GPL 3 it’s section 6.

This is covered in section 6 of the GPL(v3). See the text here: https://www.gnu.org/licenses/gpl-3.0.en.html

Note that there are some changes here compared to v2 of the GPL.

IANAL but my understanding/interpretation (simplified) is you have to either:

6a) Ship the binaries in a physical product with a copy of the source code accompanying

6b) Ship the binaries in a physical product along with an offer to provide the source code on request

6c) "occasionally and noncommercially" ship the binaries (not necessarily in a physical product) along with an offer to provide the source code on request

6d) Make the binaries available from somewhere (e.g. a website) which also offers the source code (e.g. GitHub would count)

6e) Ship the binaries via a P2P mechanism if you include a link to where you host the source code

Again, IANAL but if you hosted a GPLv3 binary somewhere without source code, it would technically be a violation of the GPL.

However, since you are the copyright holder in this case, you can ship it however you want - it would just prevent anyone else from then distributing it under the GPL since they wouldn't be able to comply with section 6, since they don't have the source code.

But this is not about distributing GPL code in a custom binary. Rather, a GPL binary library was linked against by a custom binary, and that GPL binary was distributed alongside the ”custom” binary. Do those license terms apply here?

Yes, linking to a GPL library means you need to follow the terms of the GPL.

Pardon the confusion, this was about LGPL, not GPL—and the former does allow linking.

There are terms you need to follow when you link to LGPL libraries, as well. You need to provide your compiled program in an object format such that users can link it against their own versions of the LGPL library you originally linked it against. The LGPLv3 also adds some anti-Tivoization clauses, too, that make those rights explicit.

If my dubious understanding of the GPL is correct, you can link to an LGPL DLL without assuming the LGPL. Distributing that DLL modified/unmodified would require also distributing the corresponding modified/unmodified source code. I don't think that in this case we have a violation (for the LGPL code) since it's unlikely that they modified the source code for the named libraries (and would provide links to the unmodified source code after application of legal pressure). I also would assume that the copyright notices required to be displayed are all listed somewhere buried in the about dialog of the running software.

[append]

> wintun.dll, from the Wintun project, without mentioning it, thus violating its license.

Also, after reading the license, I don't see this particular clause at all.

From what I remember someone should basically be free to modify the DLL distributed under the LGPL license, so they need to be able to access the corresponding source-code and whatever logic is necessary to link a new DLL to the application (if required).

According to clause 4, you either provide enough source to compile and load a modified lib, or you use a dynamically linked lib. If you go the dynamic linking route no source distribution is required. I guess they figure the end user can get source from the library project themselves.

> If you go the dynamic linking route no source distribution is required.

For your code. The LGPL code still requires source distribution. (Plus, the BSD clause requires attribution.)

Certainly the authors of said LGPL code are distributing that source. Would it make sense to distribute the source of every .dll included in a project?

… Yes. That's your obligation under the LGPL. Pretty much your only obligation, actually – other than including the “this is this, by these people, licensed this way” boilerplate text.

Alternatively you could include the offer to distribute

Only with (L)GPLv2, I believe.

They have to provide the source code for those DLLs, which they aren't doing.

Actually I wanted to know, which clause says that. Is it Section 4d0?

No they don't, if I am correct all they need to do is allow you to swap out the dll for your own and put a license.txt or what not with the license. As long as the DLL is setup as a shared library (which it is) it is fine.

The source code is necessary to create "your own".

Not always, but, practically.

Reply on news.ycombinator.com