Hacker News Reader

Comment by yaeger | Hacker News Reader

I still haven't got a clue what needs to be done if I used a component with, say MIT license which in turn uses a dependency lib that is LGPL licensed.

That components vendor of course then has to make the source of the LGPL dependency available on request. But what about me?

What would I need to do if I wanted to sell a closed source product that uses this MIT licensed component which is of course totally permitted my the MIT license. Would I have to stop using this MIT licensed component unless I also want to provide the source code of a dependency lib that I might not even be aware of?

View on HN

If your distributed object code includes a library that is under the LGPL, then you must also make the source of that LGPL library available on request, and users should be able to change that LGPL library in your project with their modified version of that LGPL library. So, if I remember well, you can either (a) use dynamic linking so that the user can replace your version of the LGPL library with their modified version, or you can (b) provide object code that can be linked with their modified version of the LGPL library.

IANAL, but are at least two cases of "was not aware of": if that MIT licensed package mentioned the LGPL dependency, you could and should have been aware of the dependency, and I think you must mention it in your license, and provide the source on request.

If, on the other hand, the MIT licensed product doesn't mention the dependency, and you cannot be expected to have learnt of it elsewhere, you should be of the hook, both ethically and as far as damage lawsuits go. As soon as that "expected to know of" changes, you must change your license and provide the source on request (or remove the dependency or stop shipping your entire product)

Of course, that is an opinion and just theoretical. In practice, who knows what will happen? That is one reason large companies are/used to be worried about using any source that doesn't ship with extensive disclaimers. Large companies are expected to spend more effort researching these things. That lowers the threshold for "should have known". They generally also have more money. That makes them more open for lawsuits if they are found to walk in a gray area.

Reply on news.ycombinator.com