Show pageBack to top This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. ====== The Ultimate Guide to the GNU Lesser General Public License (LGPL) ====== **LEGAL DISCLAIMER:** This article provides general, informational content for educational purposes only. It is not a substitute for professional legal advice from a qualified attorney. Always consult with a lawyer for guidance on your specific legal situation. ===== What is the GNU Lesser General Public License (LGPL)? A 30-Second Summary ===== Imagine you're building a custom house. You design the layout, pick the colors, and build most of it yourself. This is your proprietary, private creation. However, you decide you don't want to build your own windows from scratch—that's too complicated. Instead, you go to a special "community workshop" that offers fantastic, high-quality windows for anyone to use, for free. This workshop has one big rule: if you take their window design and *improve it* (e.g., make it more energy-efficient), you must share your improvements back with the workshop so everyone can benefit. But, they **do not** demand that you share the blueprints for your entire house. You can install their windows in your private house, sell the house, and keep your floor plans a secret. The **GNU Lesser General Public License (LGPL)** is that special window workshop. It's a type of [[open_source_license]] that allows developers to freely use pre-built software components (the "windows," often called libraries) in their own larger, even commercial and closed-source, applications (the "house"). It's designed to be a compromise, encouraging the use of free software without forcing entire projects to become open source. * **Key Takeaways At-a-Glance:** * **A "Weak Copyleft" License:** The **GNU Lesser General Public License (LGPL)** requires that if you modify the LGPL-licensed component itself, you must share those specific modifications, but it does not require you to share the source code of your own application that simply uses it. * **Enables Commercial Use:** The **GNU Lesser General Public License (LGPL)** is a business-friendly license that explicitly allows developers to include LGPL components within their proprietary, closed-source commercial software. * **Focus on Linking:** Your obligations under the **GNU Lesser General Public License (LGPL)** critically depend on *how* you combine the component with your code, a concept known as [[linking_(computing)]], which is the legal and technical heart of the license. ===== Part 1: The Legal Foundations of the LGPL ===== ==== The Story of the LGPL: A Tale of Two Philosophies ==== The story of the LGPL is a chapter in the larger saga of the free software movement, a story driven by the powerful ideas of programmer and activist Richard Stallman. In the 1980s, Stallman founded the [[free_software_foundation_(fsf)]] and created the [[gnu_project]] with a radical goal: to create a computer operating system that was entirely "free." For Stallman, "free" meant freedom, not price. He wanted users to have the freedom to run, copy, distribute, study, change, and improve the software. To legally protect these freedoms, he authored the [[gnu_general_public_license_(gpl)]]. The GPL is a work of legal genius that uses [[copyright]] law to enforce sharing. It's a "strong [[copyleft]]" license: if you use a GPL component in your program, your entire program must also be licensed under the GPL, forcing you to share your own source code. This was a powerful tool for growing the ecosystem of free software. However, the GPL's strict "all or nothing" approach made some developers hesitate. They wanted to use the FSF's high-quality software libraries (pre-written code that performs common tasks), but they weren't ready or able to make their entire application open source. The FSF recognized a strategic dilemma: if their libraries were too restrictive, developers would simply use proprietary alternatives, defeating the purpose of spreading free software. The solution was a compromise. In 1991, the FSF released the "Library" General Public License, which was renamed the "Lesser" General Public License with version 2.1 in 1999. The LGPL was designed to be a "weaker" form of copyleft, creating the middle ground we saw in our house analogy. It ensured that the library itself and any modifications to it would remain free, but it allowed the library to be a building block for the wider world of software, including proprietary applications. ==== The License on the Books: Key Versions ==== The LGPL is not a statute passed by Congress; it's a legal document—a license agreement—that you accept by using, modifying, or distributing the software. There are two primary versions you will encounter. * **`[[gnu_lesser_general_public_license_v2.1]]` (LGPLv2.1):** Released in 1999, this has been the workhorse for decades. It's known for its focus on the distinction between the "work based on the library" (your application) and a "work that uses the library" (the LGPL component). Its terms are primarily centered on the mechanics of sharing the source code for the library upon distribution. * **`[[gnu_lesser_general_public_license_v3]]` (LGPLv3):** Released in 2007 alongside GPLv3, this version was a major update designed to address new technological and legal challenges. Key changes include: * **Stronger Patent Protection:** It includes an express patent license grant, providing users with protection from patent lawsuits from the code's contributors. * **Tivoization Protection:** It contains provisions to ensure that users can actually run modified versions of the software on their own hardware, combating a practice where hardware makers use free software but lock down the device to prevent modification. * **Greater Compatibility:** It is explicitly compatible with the [[gnu_general_public_license_v3]], making it easier to combine code under the two licenses. ==== A World of Choices: LGPL vs. Other Common Licenses ==== Choosing a software license is a critical business and development decision. The LGPL occupies a unique middle ground between strong copyleft licenses and highly permissive ones. The table below compares the LGPL to its closest relatives. ^ **License Feature** ^ **LGPL (Lesser General Public License)** ^ **GPL (General Public License)** ^ **MIT / Apache 2.0 (Permissive)** ^ | **Use in Proprietary Software?** | **Yes.** This is its primary purpose. You can link to an LGPL library from your closed-source application. | **No.** If you use a GPL component, your entire application must be released under the GPL. | **Yes.** These licenses are designed for maximum flexibility and impose almost no restrictions on use. | | **Must My App's Source Code Be Public?** | **No.** You only need to provide the source code for the LGPL library itself, not your own code that calls it. | **Yes.** The "viral" nature of the GPL requires the entire derivative work's source code to be released. | **No.** You have no obligation to share any of your source code. | | **Must Modifications to the Library Be Public?** | **Yes.** If you change the LGPL library's code, you must release the source code of your modified version under the LGPL. | **Yes.** Same as the LGPL, modifications to the core GPL component must be shared. | **No.** You can modify the code and keep those changes private. | | **Patent Protection** | **Yes.** Version 3 offers strong, explicit protection. Version 2.1 is less explicit. | **Yes.** Version 3 offers strong, explicit protection, similar to LGPLv3. | **Varies.** Apache 2.0 has an explicit patent grant. The MIT license does not. | | **Best For...** | Releasing a software library that you want to be widely adopted by both open-source and commercial developers. | Creating a fully open, community-driven project where you want all contributions to remain free. | Internal tools, corporate projects, or libraries where maximum adoption with minimum friction is the goal. | ===== Part 2: Deconstructing the Core Elements ===== To truly understand the LGPL, you need to dissect its key legal and technical concepts. These are the rules of the road for any developer or business using LGPL-licensed software. ==== The Anatomy of the LGPL: Key Components Explained ==== === Element: The "Lesser" or "Weak" Copyleft === [[Copyleft]] is the legal mechanism that uses [[copyright]] law to ensure software remains free. Instead of the traditional copyright statement "All Rights Reserved," copyleft licenses essentially say "All Rights Reversed." They grant you broad freedoms but attach conditions to ensure those freedoms are passed on to others. The GPL is "strong copyleft" because its conditions extend to the entire combined work. The LGPL is **"weak copyleft"** because its conditions apply only to the LGPL-licensed component itself. It creates a firewall at the boundary of the library. Everything inside the library must remain free; what happens outside (in your application) is up to you. This is the foundational principle that makes the LGPL so useful. === Element: Linking and Derivative Works === This is the most confusing and most important part of the LGPL. Your obligations are triggered when you create a "work based on the Library." The license makes a crucial distinction based on how your code interacts with the library, a process called **linking**. Think of it like a sound system. * **Dynamic Linking:** This is like plugging a separate, high-end amplifier (the LGPL library) into your existing home stereo receiver (your application) with a standard cable. They work together, but they are clearly separate pieces of equipment. You can swap out the amplifier for a different one without changing the receiver. In the software world, this is a common way to use shared libraries (`.dll` on Windows, `.so` on Linux). **The LGPL is generally understood to permit dynamic linking from a proprietary application without requiring you to release your application's source code.** * **Static Linking:** This is like a manufacturer building the amplifier's circuits directly onto the main circuit board of your stereo receiver. They are now a single, inseparable unit. To change the amplifier, you'd have to de-solder components and re-engineer the main board. In software, this bundles the library's code directly into your application's executable file. **Static linking creates a single combined work, which triggers more significant LGPL obligations.** If you statically link, you must provide a way for the end-user to re-link your application with a modified version of the library. This is often done by providing the object files (`.o` files) of your application so a user can perform the final linking step themselves. This can be technically complex and is a major reason why many businesses prefer dynamic linking. === Element: Modification and Distribution === The rules here are straightforward. If you take the source code of an LGPL library and change it—to fix a bug, add a feature, or improve performance—you have created a modified version. * **If you use this modified version only within your company**, you have no obligation to share your changes. * **If you distribute your software containing the modified library to anyone outside your company**, you have triggered the core copyleft provision. You must make the source code of your modified library available to the recipient under the terms of the LGPL. This ensures that your improvements benefit the entire community. === Element: Source Code Availability === A key right granted by the LGPL is the user's right to the library's source code. When you distribute software that includes an LGPL component, you must comply with this. You have a few options: * Bundle the complete source code of the LGPL library with your application. * Provide a clear, written offer, valid for at least three years, to provide the complete source code to anyone who requests it, for a charge no more than the cost of physically performing the distribution. This doesn't mean you must give away your proprietary application's source code. It only ever applies to the LGPL component itself. ==== The Players on the Field: Who's Who in the LGPL Ecosystem ==== * **The Licensor (The Original Author):** The person or organization that created the software library and chose to release it under the LGPL. Their goal is typically to encourage broad adoption while ensuring their core work remains free. * **The Licensee (You, the Developer/Business):** Anyone who uses the LGPL software. You are the "licensee" who agrees to the terms of the license. Your goal is to leverage powerful, free tools to build your own products faster and more effectively. * **The End-User:** The person who ultimately uses your application. The LGPL is designed to protect their freedom to understand, modify, and run the LGPL components within your application. * **The Free Software Foundation (FSF):** The author and steward of the LGPL license text. They do not own the code licensed under the LGPL (the authors do), but they provide guidance and are the philosophical heart of the movement. * **Compliance Organizations (e.g., Software Freedom Conservancy):** These non-profit groups often work on behalf of authors to ensure that companies are complying with the terms of copyleft licenses like the GPL and LGPL, often through education and, if necessary, legal action. ===== Part 3: Your Practical Playbook ===== Using LGPL software can be a massive benefit, but it requires diligence. It's not a "set it and forget it" situation. This step-by-step guide is designed for a small business owner or development team leader. ==== Step-by-Step: How to Comply with the LGPL ==== === Step 1: Identify and Inventory === You can't comply with a license if you don't know you're using it. * **Scan Your Codebase:** Use software composition analysis (SCA) tools to automatically scan your project's dependencies and identify all open-source components and their licenses. * **Create a Bill of Materials (BOM):** Maintain a list of every third-party library you use, its version, and its license. This is crucial for due diligence in a [[merger_and_acquisition]]. * **Identify the Exact LGPL Version:** Is it v2.1 or v3? The obligations can differ slightly, especially regarding patents. === Step 2: Determine Your Method of Integration === This is the critical analysis from Part 2. * **Consult Your Engineers:** Ask them plainly: "Are we linking to this library statically or dynamically?" * **Default to Dynamic Linking:** For most proprietary applications, dynamic linking is the simplest path to compliance. It creates a clear separation between your code and the LGPL library. * **Evaluate Static Linking Carefully:** If you must use static linking, you need a plan to fulfill the re-linking requirement. This means being prepared to provide your application's object files to users upon request. This is a business decision with legal and technical overhead. === Step 3: Fulfill Distribution Obligations === Every time you ship your product (distribute the software), you must follow these steps. * **Include the License Text:** A copy of the LGPL license text must be included with your software. * **Preserve Copyright Notices:** Do not remove any of the original copyright notices from the LGPL source code files. * **Provide a Notice:** Your application should have a notice (e.g., in an "About" box) stating that it uses the LGPL library and that the library and its source code are available under the terms of the LGPL. * **Provide the Library's Source Code:** Fulfill the source code availability requirement through one of the approved methods (bundling it or providing a written offer). === Step 4: Manage Modifications with Extreme Care === * **Isolate Changes:** If you need to modify the LGPL library, do so in a separate, clean repository. Do not mix your proprietary code with the library's code. * **Prepare for Release:** If you distribute a modified version, you are legally obligated to publish the source code of your changes under the LGPL. Plan for this. ==== Essential Paperwork: Key Compliance Artifacts ==== When you distribute software using an LGPL component, you must include a set of documents that fulfill your license obligations. Think of this as your compliance package. * ` * **A Copy of the LGPL License Text:**` You must provide a full, verbatim copy of the license itself (e.g., in a file named `LICENSE` or `COPYING.LESSER`). This informs the user of their rights. * ` * **Clear Copyright and License Notices:**` For each LGPL component you use, you must preserve its original [[copyright]] notices. Often, your application's documentation or "About" screen will list the open-source components used and state that they are licensed under the LGPL. * ` * **The Written Offer for Source Code (if applicable):**` If you choose not to bundle the source code directly, you must include a formal written statement offering to provide it. This document should clearly state how a user can request the source code and explain that there will be no charge other than the cost of shipping or transfer. ===== Part 4: Landmark Cases That Shaped Today's Law ===== While there isn't a famous U.S. Supreme Court case titled "Smith v. LGPL," the legal power of the LGPL rests on foundational court rulings that have affirmed the enforceability of open-source licenses as a whole. These cases established that violating an open-source license isn't just breaking a promise; it's [[copyright_infringement]]. ==== Case Study: Jacobsen v. Katzer (2008) ==== * **The Backstory:** Robert Jacobsen, an amateur software developer, created software to control model trains and released it under an open-source license (the Artistic License). Matthew Katzer's company, KAM Industries, used Jacobsen's code in their commercial product but failed to follow the license's attribution rules. * **The Legal Question:** Are the conditions of an open-source license (like giving credit) legally enforceable copyright conditions, or are they just non-binding contractual promises? If they were merely contractual, the penalty would be monetary damages. If they were copyright conditions, the violation would be copyright infringement, which could be stopped with an [[injunction]]. * **The Court's Holding:** The U.S. Court of Appeals for the Federal Circuit sided with Jacobsen, making a landmark ruling. It held that the terms and conditions of open-source licenses are **enforceable conditions under copyright law**. * **Impact on You Today:** This case is the bedrock of all open-source license enforcement, including the LGPL. It gives the LGPL real teeth. When you fail to provide source code or follow the rules of the LGPL, you are not just in breach of a contract; you are infringing on the author's copyright. This elevates the risk and seriousness of non-compliance significantly. ==== Case Study: Artifex Software Inc. v. Hancom Inc. (2017) ==== * **The Backstory:** Artifex created a popular software called Ghostscript and licensed it under the [[gnu_general_public_license_(gpl)]], the LGPL's stronger sibling. Hancom, a South Korean software company, incorporated Ghostscript into its office suite software and distributed it without providing the corresponding source code as the GPL required. * **The Legal Question:** Could Artifex sue Hancom for both copyright infringement and breach of contract? * **The Court's Holding:** A U.S. District Court in California denied Hancom's motion to dismiss the case. The court affirmed that the GPL functions as a copyright license and a contract, and violating its terms could lead to liability for both. * **Impact on You Today:** This case reinforces the dual nature of open-source licenses. It shows that courts are willing to treat these documents seriously and uphold their clear terms. The logic applied to the GPL in this case applies with equal force to the LGPL, confirming that distributing a combined work without adhering to the license's source code and notice requirements is a legally actionable offense. ===== Part 5: The Future of the LGPL ===== The world of software is constantly changing, and the LGPL faces new challenges and questions as technology evolves. ==== Today's Battlegrounds: Current Controversies and Debates ==== The biggest ongoing debate circles back to the core of the license: linking. While the community has a general understanding of static vs. dynamic linking, new programming languages and development tools sometimes blur the lines. For example, in languages like Go, the concept of linking is different than in C++. This creates ambiguity and requires careful legal and technical analysis. Furthermore, the complexity of modern software, with hundreds of dependencies pulled in automatically by package managers, makes compliance a massive challenge. A single LGPL library deep in your "software supply chain" can trigger obligations that a company may not even be aware of, making robust auditing tools more critical than ever. ==== On the Horizon: How Technology and Society are Changing the Law ==== * **The Cloud and the "SaaS Loophole":** The LGPL, like the GPL, triggers its main obligations upon "distribution." But what if you never distribute the software? When you use a service like Google Docs, the software runs on Google's servers, and you just interact with it through a browser. You never receive a copy. This is known as Software as a Service (SaaS). This model doesn't technically count as distribution, so the copyleft provisions of the LGPL and GPL are not triggered. This "loophole" led the FSF to create the [[gnu_affero_general_public_license_(agpl)]], which closes this gap by requiring source code to be shared even if the software is only used over a network. * **The Rise of Permissive Licenses:** In recent years, many new projects have gravitated towards highly permissive licenses like the [[mit_license]] and [[apache_license_2.0]]. These licenses offer simplicity and place almost no restrictions on users, which can be very attractive for businesses. While the LGPL remains a vital and popular license, particularly for foundational libraries, it faces competition from licenses that offer an even easier path for commercial integration. * **Artificial Intelligence and Machine Learning:** A new frontier of legal questions is emerging. How does the LGPL apply to AI models? If a model is trained using an LGPL library, is the resulting model a "derivative work"? What about the training data? These are complex, unanswered questions that lawyers and technologists will be debating for the next decade. ===== Glossary of Related Terms ===== * ` * [[Apache_License_2.0]]:` A popular permissive open-source license with an express patent grant. * ` * [[Copyleft]]:` A licensing strategy that uses copyright law to ensure that a work and its derivatives remain free. * ` * [[Copyright]]:` A legal right that grants the creator of an original work exclusive rights for its use and distribution. * ` * [[Copyright_Infringement]]:` The use of works protected by copyright law without permission. * ` * [[Derivative_Work]]:` A new work based upon one or more preexisting works. * ` * [[Free_Software_Foundation_(FSF)]]:` The non-profit organization founded by Richard Stallman that promotes free software and publishes the GNU licenses. * ` * [[GNU_General_Public_License_(GPL)]]:` A strong copyleft license that requires entire derivative works to be licensed under the GPL. * ` * [[Linking_(Computing)]]:` The process of connecting software components, either statically (at compile time) or dynamically (at run time). * ` * [[MIT_License]]:` A very short and popular permissive open-source license with minimal restrictions. * ` * [[Open_Source_License]]:` A license that grants rights to use, modify, and distribute software, including its source code. * ` * [[Proprietary_Software]]:` Software that is privately owned and controlled, also known as closed-source software. * ` * [[Source_Code]]:` The human-readable set of instructions written by a programmer that defines how a piece of software works. * ` * [[Static_Linking]]:` A method of linking where library code is copied directly into the application's executable file. * ` * [[Dynamic_Linking]]:` A method of linking where an application references a separate library file that is loaded at run time. ===== See Also ===== * ` * [[gnu_general_public_license_(gpl)]]` * ` * [[gnu_affero_general_public_license_(agpl)]]` * ` * [[mit_license]]` * ` * [[intellectual_property]]` * ` * [[copyright_law]]` * ` * [[software_licensing]]` * ` * [[free_software_foundation_(fsf)]]`