Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 9 years ago.
Improve this question
I don't know much about the LGPL/GPL when it comes to distributing programs (without a Qt license); If I made a program, could I statically link the libraries to the exe so I have a single file to distribute when:
The program does not cost anything, it's just being distributed (closed source or open source)?
When you have to pay for the program can you still statically link?
Actually, the LGPL allows static linking as long as you meet a few very specific requirements. For example, if all distribution is done from your website where you have StaticProgram.exe, you're okay as long as users could also download StaticProgram.obj and LGPL-library-source.tar.gz. You could also distribute StaticProgram.exe with a written offer to provide the other files.
Specifically, static linking creates a single executable that is a derivative of the LGPL code, so you must comply with section 6 of the LGPL:
6) As an exception to the Sections above, you may also combine or link a
"work that uses the Library" with the
Library to produce a work containing
portions of the Library, and
distribute that work under terms of
your choice, provided that the terms
permit modification of the work for
the customer's own use and reverse
engineering for debugging such
modifications.
You must give prominent notice with
each copy of the work that the Library
is used in it and that the Library and
its use are covered by this License.
You must supply a copy of this
License. If the work during execution
displays copyright notices, you must
include the copyright notice for the
Library among them, as well as a
reference directing the user to the
copy of this License. Also, you must
do one of these things:
a) Accompany the work with the complete corresponding
machine-readable source code for the
Library including whatever changes
were used in the work (which must be
distributed under Sections 1 and 2
above); and, if the work is an
executable linked with the Library,
with the complete machine-readable
"work that uses the Library", as
object code and/or source code, so
that the user can modify the Library
and then relink to produce a modified
executable containing the modified
Library. (It is understood that the
user who changes the contents of
definitions files in the Library will
not necessarily be able to recompile
the application to use the modified
definitions.)
b) Use a suitable shared library mechanism for linking with the
Library. A suitable mechanism is one
that (1) uses at run time a copy of
the library already present on the
user's computer system, rather than
copying library functions into the
executable, and (2) will operate
properly with a modified version of
the library, if the user installs one,
as long as the modified version is
interface-compatible with the version
that the work was made with.
c) Accompany the work with a written offer, valid for at least
three years, to give the same user the
materials specified in Subsection 6a,
above, for a charge no more than the
cost of performing this distribution.
d) If distribution of the work is made by offering access to copy
from a designated place, offer
equivalent access to copy the above
specified materials from the same
place.
e) Verify that the user has already received a copy of these
materials or that you have already
sent this user a copy.
For an executable, the required form
of the "work that uses the Library"
must include any data and utility
programs needed for reproducing the
executable from it. However, as a
special exception, the materials to be
distributed need not include anything
that is normally distributed (in
either source or binary form) with the
major components (compiler, kernel,
and so on) of the operating system on
which the executable runs, unless that
component itself accompanies the
executable.
It may happen that this requirement
contradicts the license restrictions
of other proprietary libraries that do
not normally accompany the operating
system. Such a contradiction means you
cannot use both them and the Library
together in an executable that you
distribute.
No, if your program is closed source and you want to link against the LGPL version of Qt you must use dynamic linking. If you want to statically link then you must buy a license for Qt.
To use LGPL code in your closed source project, the user has to be able to replace the lgpl portion of the code. The easiest and by far the most common way to do this is to put all the LGPL code in a dll and then the user can replace the dll if they choose.
You are also allowed to use whatever technical means your language allows to accomplish the same goal. You can distribute object files and then the user can relink as other commenter pointed out, but I have never seen this done in practice.
It does not matter whether or not your product is free or pay. You can sell GPL/LGPL products.
Related
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about programming within the scope defined in the help center.
Closed 4 years ago.
Improve this question
By including a library file in the program, such as LiquidCrystal.h while programming Arduino, there are certain functions that were declared in the library. So while uploading the program to the micro-controller, does the header file also get uploaded?
No. The source code is compiled, each separate compilation unit is linked to each other and to the libraries to generate a machine-code binary, which is what is loaded to the processor.
Compiled languages, such as C and C++ are not executed directly like interpreted languages. Instead the compiler generates target-native machine code, which the processor can run directly.
Whilst the compiler deals with individual source files (to generate object code, these may include references to code in other modules and libraries - these references are resolved by the linker, which replaces the symbolic links with direct memory addresses. The resulting binary is what is executed.
Header files are just source code generally containing declarations of function signatures for code contained in other modules or libraries. These allow the compiler to "know" what these interfaces "look like" without having needing to know the implementation details (which the linker resolves).
More complete description available here (for example)
All this happens, even in the Arduino environment - in that case a lot of the detail is hidden from you, which is what makes Arduino a simple environment for beginners, but ultimately far less flexible - you relinquish some control and visibility in exchange for not being scared off embedded development as "just too hard". All the steps however are visible in the build output log text if you care to look.
Specific build process details for Arduino are described here.
Preword:
I have come across this issue in a made-up scenario. Imagine company X wishes to work with potentially sensitive data of their customers. How would they prove they only do what they claim to do?
Example: Company X wishes to match users with similar habits, without tampering with the data any further.
My partial solution:
Company X would release the source code of their application, which would confirm that the company only matches the data (and does not search for patterns, create personalised ads, etc.).
The remaining problem:
How does Company X prove that the released source code matches the code they are running? My requirements are that nobody should trust any instance, neither Company X nor any third-party. Simply hiring a third-party to "certify" Company X' practices is not a proof, simply another claim.
Side Note: Does it make a significant difference if the application does not need to be compiled before usage (e.g. PHP)?
Are there any solutions to this? Any "provable" method to ensure a certain source code is being run?
The only way to ensure the binary matches the source is to compile it yourself or at least compare it to a binary you compiled yourself under the exact same circumstances.
But then again you have to do the same to every piece of software involved (the compiler could change the code, libraries could do something bad etc.).
Even if the software is not compiled the interpreter would have to be validated in this way because it interprets and runs the source (i.e. can modify it in any way it wants)
For your scenario the data could also be used and processed outside the specific software so their whole system would have to be audited and build in this way and then locked down. Choose your level of paranoia.
So the answer is not realistically without trusting someone. That's the idea behind signed packages in several Linux systems (including android) were some party like the developer or a repository maintainer signs the binary to verify it's what he compiled (and matches the published source).
Also in the previous step with verifying the source: it's pretty easy to show that a program has a certain functionality but (most often) impossible to show that it doesn't have it.
So basically choose your own level of paranoia but if they are really after you, you are screwed.
Great now I'll go find some tin foil...
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about programming within the scope defined in the help center.
Closed 7 years ago.
Improve this question
I'm developing an application with the Qt open source edition. As I don't want to deliver the Microsoft Visual Visual C(++) redistributables, I'd like to use a static-linked version of Qt.
The Qt licensing information says that I "should" develop with a commercial Qt license if I want to use static linking in my application, although when I use the configure -static command for building a static Qt library the command prompt asks me if I use the commercial or open source version of Qt.
So it is possible to build Qt with the open source version? Do I need the commercial edition to use static linking? I won't sell the application.
EDIT April 2016
Actually, I have recently been reading in depth about LGPL, and asking some experts on the subject. Turns out that the inability to use static linking for Qt in closed source applications is more of a cultivated legend and has nothing to do with reality.
What LGPL requires is the possibility for the end user to relink the application against a different version of the library. Using dynamic linking is one way to achieve that, but you can just as easily provide your object files, this way you don't have to open your source and the LGPL requirement is still satisfied.
On the Qt website there are 2 legal FAQs and in neither of them is it directly stated that you can't do it. Just as it is not stated that you can. However, there are at least several instances of implying a vague legal threat in case that you do. I think there is a good explanation for all of those - they can't say that you can't do it without publishing a practical lie which may as well have negative legal repercussions for them, and they are willing to discourage doing that rather than encourage it, as it has the potential to force more people into purchasing a commercial license.
So in short, yes you can, and you most definitely should as lately Qt has become a living deployment hell, plus as of Qt 5.7 in a static build, QML files are tucked neatly in the executable rather than being out on the file system, for anyone to tamper with. Just make sure that:
your Qt build only contains modules, licensed under LGPL, and nothing GPL
the about section of your app mentions that it is using Qt and contains a link to where you can download the application's object files
include all the respective license files with your application
Lastly, your application actually has to be "relinkable", that is, it must be able to work with a compatible library version that provides the necessary functionality. Which means that if you have made modifications to Qt before building it, you must provide those in the form of source code as well, but only the modifications to Qt, not your application's source code.
Update:
Here is an excerpt directly from the GNU FAQ:
For the purpose of complying with the LGPL (any extant version: v2,
v2.1 or v3):
(1) If you statically link against an LGPL'd library, you must also provide your application in an object (not necessarily source)
format, so that a user has the opportunity to modify the library and
relink the application.
That states it pretty clear.
The old, original answer:
It is possible to build Qt statically as long as your application is open-source and you provide the source. If you want to keep your source closed, you either need an expensive commercial license, or you need to use dynamic linking.
BTW using a static build of Qt is pretty nice, for Qt5 I get about 7-8 MB executable with no external dependencies, which is much better than the 20+ MB of additional dll's you have to ship with a dynamically linked app.
For more information, you can take a look at this video: Making the correct license choice when developing with Qt
All in all, can it be done? 100% yes. Should it be done? It depends, for personal/testing/learning purposes it is 100% OK, however if you plan to distribute production grade software, be that commercially or not, open source or not, you'd better first consult with a lawyer. The whole subject is unnecessarily complicated, subject to interpretation, so that the consultation with a lawyer becomes more expensive than a pricey commercial license.
The answer is Yes, if you are willing to open source your application.
According to the Qt-Project's own interpretation of the licenses they use, if you dynamically link to the Qt libraries your application can be either closed source or open. If you statically link, however, your application is subject to the terms of the LGPL.
The exact language the Qt Project uses is this:
In case of dynamic linking, it is possible, but not mandatory, to keep
application source code proprietary as long as it is “work that uses
the library” - typically achieved via dynamic linking of the library.
In case of static linking of the library, the application itself may
no longer be “work that uses the library” and thus become subject to
LGPL. It is recommended to either link dynamically, or provide the
application source code to the user under LGPL.
(http://qt-project.org/legal.html)
The suggestion in some of the other answers that the situation is "not at all clear" is simply untrue - The Qt Project has tried to be abundantly clear about in what circumstances usage of the LGPL license is permissible, and static linking is one of those as long as the app is also LGPL.
Since the original question specifies non-commercial (not necessarily open source), the asker will need to decide whether they can allow distribution under the LGPL (or GPL by extension, as the above page also says "LGPL can be converted to GNU General Public License").
We've developed a commercial Qt application with Qt under LGPL. We link dynamically. We also made a few changes to a couple of files in Qt to better suit our needs. I realize that according to LGPL, I must make those changes publicly available.
My question is how is that done?
Do I set a webpage on my domain with the modified source codes available for download?
Do I distribute the modified source code in a folder on the client target machine after installation?
Another
way?
You simply have to make them available on request.
It can be a file on your web server, it could just be emailing them to anyone that asks, you can even supply them on floppy disk and make a charge for it.
Ideally you would also contribute the changes back to Qt if it's a bug fix or feature that could be useful to other people, then it may be incorporated in future editions and youcould then just use the standard build.
ps. The letter of the GPL says that you have to provide everything that is needed to create your modified build - so the full Qt sources and the build files. However for a large complex project like Qt, if you have only modified a couple of files it would be useful to offer a download of just these (or even a diff against the specific Qt version)
According to the licence you need to provide your changes back to the community, not just to your customer.
The easiest way is forking the main Qt repository on http://qt.gitorious.org/qt and commit your changes there.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about programming within the scope defined in the help center.
Closed 7 years ago.
Improve this question
Should a web application have a notices/about page that details the components/libraries that we are using and there relevant licences?
Some Licences such as LGPL (Used by SevenZipSharp) have a combined works clause:
lgpl V3
Combined Works. You may convey a Combined Work under terms of your choice that, taken together, effectively do not restrict modification
of the portions of the Library contained in the Combined Work and
reverse engineering for debugging such modifications, if you also do
each of the following:
a) Give prominent notice with each copy of the Combined Work that the
Library is used in it and that the Library and its use are covered by
this License. b) Accompany the Combined Work with a copy of the GNU
GPL and this license document. c) For a Combined Work that displays
copyright notices during execution, include the copyright notice for
the Library among these notices, as well as a reference directing the
user to the copies of the GNU GPL and this license document. d) Do one
of the following: 0) Convey the Minimal Corresponding Source under the
terms of this License, and the Corresponding Application Code in a
form suitable for, and under terms that permit, the user to recombine
or relink the Application with a modified version of the Linked
Version to produce a modified Combined Work, in the manner specified
by section 6 of the GNU GPL for conveying Corresponding Source. 1) Use
a suitable shared library mechanism for linking with the Library. A
suitable mechanism is one that (a) uses at run time a copy of the
Library already present on the user's computer system, and (b) will
operate properly with a modified version of the Library that is
interface-compatible with the Linked Version. e) Provide Installation
Information, but only if you would otherwise be required to provide
such information under section 6 of the GNU GPL, and only to the
extent that such information is necessary to install and execute a
modified version of the Combined Work produced by recombining or
relinking the Application with a modified version of the Linked
Version. (If you use option 4d0, the Installation Information must
accompany the Minimal Corresponding Source and Corresponding
Application Code. If you use option 4d1, you must provide the
Installation Information in the manner specified by section 6 of the
GNU GPL for conveying Corresponding Source.)
lgpl V2.1
You must give prominent notice with each copy of the work that the
Library is used in it and that the Library and its use are covered by
this License. You must supply a copy of this License. If the work
during execution displays copyright notices, you must include the
copyright notice for the Library among them, as well as a reference
directing the user to the copy of this License. Also, you must do one
of these things:
a) Accompany the work with the complete corresponding machine-readable
source code for the Library including whatever changes were used in
the work (which must be distributed under Sections 1 and 2 above);
and, if the work is an executable linked with the Library, with the
complete machine-readable "work that uses the Library", as object code
and/or source code, so that the user can modify the Library and then
relink to produce a modified executable containing the modified
Library. (It is understood that the user who changes the contents of
definitions files in the Library will not necessarily be able to
recompile the application to use the modified definitions.) b) Use a
suitable shared library mechanism for linking with the Library. A
suitable mechanism is one that (1) uses at run time a copy of the
library already present on the user's computer system, rather than
copying library functions into the executable, and (2) will operate
properly with a modified version of the library, if the user installs
one, as long as the modified version is interface-compatible with the
version that the work was made with. c) Accompany the work with a
written offer, valid for at least three years, to give the same user
the materials specified in Subsection 6a, above, for a charge no more
than the cost of performing this distribution. d) If distribution of
the work is made by offering access to copy from a designated place,
offer equivalent access to copy the above specified materials from the
same place. e) Verify that the user has already received a copy of
these materials or that you have already sent this user a copy.
A number of other licences have similar clauses about displaying a notice in your application or combined works.
Does this mean that web applications need an about page detailing components used? I cant find any examples of websites doing this, although lots of sites will often be using OpenSource Libraries?
I guess the get out clause that websites/applications currently use is who would know if an OpenSource component was being used in a combined work/web application on the server side but that isn't an excuse especially if the web app was ever audited.
Just because other does it wrong, doesn't give you the right to do it wrong.
If the license for a library says that your application should include a page with the appropriate credits, then that is what you should do.
Edit:
(This is my interpretation of the license agreement, I may be wrong).
I believe there's a (quite big) difference between a library and a web application. The license agreement posted above seems to be for other libraries, not for end-user webapplications. I believe that if you make your own library, from the SevenZipSharp library, the quote from the license agreement above applies - and forces you to distribute your library under LGPL as well. But if you use the SevenZipSharp library in an application that's meant for the user and not for developers, the above quote from the license does not apply.
Sorry for reopening this rather old question, but apparently there was no accepted conclusion. As a disclaimer, IANAL, so everything that follows is a layman's interpretation of how this licenses might be applied to this topic. I'm really looking for clarifications, confirmations or for someone proving me wrong!
My current interpretation is that a running Web Application does not "distribute" itself to every surfer, it merely generates output which is then rendered in the surfer's browser.
So the Web Application would be required to contain copyright / licensing notices in its own documentation / installation instructions / administrators/operators manual - which is targeted at the Web Application's users, which in fact is the one who installs, configures and operates it.
The licenses usually do not cover OUTPUT generated by an application, which is what the surfers visiting the web pages generated by the application consume. Thus, no copyright notice has to be included in the generated output, ie. the web pages.
In interactive Web Applications, the line between "the application" and "generated output" is not that clear and sharp, however, and might not even exist any more if parts of the application code are contained in the shipped web pages (as Javascript applications). So I'm not sure if my interpretation will hold or if it even is valid at all.