TLDR: the LGPL license explained

[ttoine]

As you know, we utilize the LGPLv3 license to publish the Alfresco Community. In this blog article, I will explain the basics of this license: why Free Software Foundation created it; a bit of its history; how it applies in the real world for developers, integrators, and application builders; and best practices for legal compliance of your projects.

A bit of history and context 

The Free Software Foundation (FSF) published the LGPL in 1991 as version number 2, to go with the GPLv2 license. At the origin it was called Library General Public License. Its purpose was to give more freedom for integration and redistribution than the GPL, particularly with shared libraries used as dependencies of larger applications. This is a compromise between the strong GPL license, and the permissive licenses like the BSD licenses family, but with more "free software spirit". By design, FSF made easy to use with GPL software, but also with many other licenses, including proprietary software. 

However, the FSF discovered later that people understood that they should release full applications in GPL, and libraries in LGPL. So, they modified it in 1999, renaming it Lesser General Public License v2.1. They also published content to explain how to chose the right license: "GPL for a library makes it available only for free programs", while "LGPL permits library in proprietary software". They even recommended Apache 2.0 for "small programs". 

In 2007, FSF published Version 3 of the LGPL in a very different way: it takes advantage of Section 7 of GPLv3 "Additional terms". It means that to understand LGPLv3, one must read first the GPLv3 and then apply the LGPLv3 terms. The general spirit stays the same, giving more freedom for library redistribution, including in proprietary software. 

LGPLv3 in practice 

LGPL licenses allow users to include licensed software into all software projects, and not just in so called "free software" published under the GPL license. And that includes proprietary software.

But, how does it work? And what are some best practices? 

There are two main cases to consider: using the library without modifications, or using a modified library. 

1. Without modification, you can include the library and redistribute it as part of other software. Note that you must make a notice about libraries you used, and where to find their source code. You can do that in the "about" menu of your application or in a readme file if there is no user interface. In many software like Android or Spotify, you will usually find a "third-party software" section in the parameters, with a detailed list of libraries, their license, and links to their sources. 
   
   
2. If you modify the library before integration/compilation, you can also include and redistribute your version in any other software with a notice. However, LGPLv3 states that you can only share modified versions of the libraries with the same license or GPLv3. This means that you must also give access to the sources of your version, and you must make it clear that your version is different.
   
   A good way to do that is to add a short text in the readme and in the file headers, something like: "Please notice that this ‘foo’ program is a modified version of program ‘bar’ version x.x.x", with links and details to the original version. It must be easy for the end users to understand. 
   
   

In theory, LGPLv3 being "additional terms" to the GPLv3, you should include both license texts in your source repository and in the distributed software. In practice, this is quite common to see only the LGPLv3 text file. You can explain it by noting developers updated the LGPL file from an older version, when it was not needed to also add the GPL text. 

Another important thing to know about LGPLv3 is that, being written as a GPLv3 extension, sharing only the source code of your program is not enough: you must also provide all tools, documentation, and other resources needed to build, install and run the software. That includes ways to sign a modified firmware in the case of embedded devices. 

Other licenses and software

If you use and contribute to Alfresco software, you will see that most work is released under LGPLv3, with some repositories under Apache 2.0. However, they run in environment using technologies in many different licenses: operating system, database, container, filesystem, … So, I thought it could be good to give you a quick overview of other licenses you will meet while working with Alfresco solutions. It can be important if you integrate Alfresco into software you distribute to your customers.

The LGPL license is part of so called "weak copyleft license family". Other licenses in this family are Mozilla MPL, Sun Microsystems (now Oracle) CDDL (a derivative of the MPL), and Eclipse Foundation EPL. For something else than program source code, Creative Commons by-sa is also similar. 

If you need more freedom, look permissive licenses like Apache 2.0, BSD, MIT, or CC-by and CC-0.

As a developer, devops, or sysadmin, you will find that a lot of technologies and content you are using everyday are released with those licenses. You can install them and run them together. But, when it comes to redistributing them together, be careful about legal compliance and check with a lawyer.

Please note that for legal compliance, it is considered best practice to list all the libraries you use, with their version and license, and provide links to the original sources. Many tools are available on the market to build such lists, also "called bill of material", or "third party software". 

Resources 

To conclude, I would like to remind you that this article's aim is to introduce LGPLv3 license and share some best practices. However, please keep in mind that this is not a comprehensive document written by your lawyers, or the lawyers of your organization. They are the only authority on legal compliance and licenses about your work on any program, being yours or third party. 

In case you need more details, you will find below a list of interesting resources: 

• GNU General Public License version 3, GNU website 
• GNU Lesser General Public License version 3, GNU website 
• Software Freedom Law Center Guide to GPL Compliance 2nd Edition, Software Freedom Law Center website 
• Copyleft, Wikipedia 
• LGPLv3, tl;drLegal website 
• Open Source Licenses by Category, Open Source Initiative website