I’m thinking of using a LGPLv3 library in a closed source commercial program running in a closed embedded environment.
According to what I know from LGPLv3 licensing, I can use it as long as the closed source software dynamically links with the LGPLv3 library and leaves the freedom to the user to change or update the LGPLv3 library by changing the library binaries.
Since my software runs in a closed, controlled, validated environment, it would be really odd to respect the part of allowing the user to change the LGPLv3 library.
I could add a functionality to my environment allowing to update the library binaries, but it would be odd to present this functionality to our customers since they would have no interest into changing that library and would see that as a security hole, so they’ll want us to remove it (or restrict the access to no one).
Is adding an update binary functionality the only way to respect LGPLv3 ? If by using it, I require to call my company to give access to it (by a password), Will I still respect the license ?
3
I am, of course, not a lawyer, so this is just my reading of the relevant licenses.
Now, in the LGPL, we’re talking section 4.d.1, “Use a suitable shared library mechanism”, and 4.e, “Provide Installation Information”.
Now, 4.e says you have to provide installation info per section 6 of the GPL v3.
First off, can your device be upgraded? If it can’t, then the ‘Installation instructions’ are moot and you don’t have to do anything – GPL, section 6, third paragraph from the end
“But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).”
Assuming your device is upgradable (and so few devices aren’t anymore) what happens if your device doesn’t fit the definition of a ‘User Product’? And is your device a User Product?
Because if I’m reading section 6 of the GPL v3 correctly, you only have to provide Installation Instructions for consumer goods – stuff sold to consumers, or for use in houses. My reading of this is that industrial stuff (for instance, the medical monitors that my company makes) wouldn’t be covered by the ‘Installation Instructions’ requirement.
If my reading is correct, and if you aren’t making consumer goods, then you’re in the clear. Obviously you’d want to check that with a lawyer, but I suspect you are good without it.
In addition to the excellent answer by Michael Kohne.
If by using it, I require to call my company to give access to it (by a password), Will I still respect the license ?
Yes, because the (L)GPL allows you to give a ” written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model” for obtaining the (L)GPL-covered source code.
You can offer to send them a CD-ROM with the source code and installation instructions, along with the warning that if they do an unofficial update of the software, then the warranty becomes void.
0