LGPL licensing requirement compliance...?

[jeffc-dev]

I have a question regarding Skip's licensing requirements.

As I understand it, Skip is licensed under the LGPL v3. The license has the following stipulation under Section 4 ("Combined Works"):

4. Combined Works.

  You may convey a Combined Work under terms of your choice that,
taken together, effectively do not restrict modification of the
portions of the Library contained in the Combined Work and reverse
engineering for debugging such modifications, if you also do each of
the following:

[...]

   d) Do one of the following:

       0) Convey the Minimal Corresponding Source under the terms of this
       License, and the Corresponding Application Code in a form
       suitable for, and under terms that permit, the user to
       recombine or relink the Application with a modified version of
       the Linked Version to produce a modified Combined Work, in the
       manner specified by section 6 of the GNU GPL for conveying
       Corresponding Source.

       1) Use a suitable shared library mechanism for linking with the
       Library.  A suitable mechanism is one that (a) uses at run time
       a copy of the Library already present on the user's computer
       system, and (b) will operate properly with a modified version
       of the Library that is interface-compatible with the Linked
       Version.

The FAQ for "Can I use Skip in a closed-source commercial app?" on the Skip web site says:

Yes. Skip’s open-source components are released under the LGPL license, which is the same
license used by ubiquitous iOS and Android components like JavaScriptCore and WebKit. LGPL
libraries can be linked to by closed-source apps, but any changes to the LGPL libraries themselves
must be published freely.

Assuming that they've not made any changes to LGPL'd Skip code itself, how are closed-source developers using Skip's LGPL-licensed libraries supposed to comply with the requirements under (d) in the LGPL?

The FSF's FAQ on this says:

(1) If you statically link against an LGPLed library, you must also **provide your application in an object
(not necessarily source) format**, so that a user **has the opportunity to modify the library and relink
the application**.

(2) If you dynamically link against an LGPLed library **already present on the user's computer**, you need
not convey the library's source. On the other hand, if you yourself convey the executable LGPLed library
along with your application, whether linked with statically or dynamically, **you must also convey the library's**
**sources, in one of the ways for which the LGPL provides**.

I'm not sure if Skip is statically or dynamically linked, off-hand, but in either case it is 1) being combined with proprietary/closed code and distributed, and 2) isn't already present on the user's computer.

In either case - static or dynamic linking - it's not clear how to permit a user to "recombine or relink the Application with a modified version of the Linked Version to produce a modified Combined Work." They just have a binary that they install from the App Store or Google Play. There is no functionality for modifying the library or relinking anything.

I'd love to use (and pay for!) Skip - and want to make sure to comply with the expectations of the license - but I do worry about the LGPL being used as the license as it seems like it could open developers up to some degree of legal liability. Some guidance on this would be much appreciated.

Thanks!

[marcprux]

We certainly do expect people to be using Skip's LGPL libraries in closed-source programs. Libraries like WebKit and JavaScript core are LGPL, and they are used ubiquitously throughout both iOS and Android apps, both system-included and user-created (for example, every React Native app ships with a copy of JavaScriptCore on Android, where it is not included by the system).

You are correct that the re-linking requirement could be deemed troublesome, not just because of practical complexities involved (which are different on iOS and Android), but also because there is no way to re-link any app on either platform to a new library version and still retain the original app's code signature, which somewhat defeats the spirit of the clause.

Our general feeling is that if it hasn't been a problem for Apple or Google or any of the thousands of apps that use WebKit and JavaScriptCore, then it shouldn't be a problem for Skip. That being said, one possibility could be to add a linking exception clause to the Skip runtime libraries along the lines of this. Would such an exception to the license allay your concerns?

[jeffc-dev]

I'm not a lawyer, but upon doing a little digging this linking exception seems to be fairly common and would seem to alleviate this concern.

[marcprux]

Thanks for the response. We'll continue to give it some thought. Regardless of the outcome of our deliberations, we want to ensure you that we are committed to having the Skip library ecosystem work well with commercial and closed-source code, so we'll work to come up with some solution that will allay any concerns.

[Touchgram]

I'm honestly puzzled - what are you gaining by using LGPL for your framework libraries as opposed to one of the many OSS licenses which would allow unrestrained reuse?

I'm in serious doubt about using or recommending skip because of the LGPL libraries you force upon users of the tech. I've had clients for whom this would be a deal breaker and will continue to call out the LGPL licensing as a potential issue in any discussions.

As a very experienced cross-platform dev and having worked on multiple code-generators during my career, I'm extremely impressed with what you've accomplished with skip. I like the architecture and will give it a try for one of my personal apps.

[marcprux]

Note that the LGPL license only applies if you are using the Skip open-source or free Indie plan. If you purchase one of our commercial plans, then your use of the various frameworks falls under the Skip license, and the LGPL obligations do not apply.

This is modeled somewhat after the Qt licensing system, which has been successfully used for decades by thousands of applications.

[AndyDentFree]

If you purchase one of our commercial plans, then your use of the various frameworks falls under the Skip license, and the LGPL obligations do not apply.

The FAQ needs updating to point this out. This is the first time I've seen any mention of this.

I only started diving into this issue because I read your docs.

Pricing Misleading bits:

The pricing page has a comparison table but lacks an entry to say the paid versions are free of LGPL licensing.

FAQ Misleading bits:

Which parts of Skip are free and which parts are commercial?

Skip’s ecosystem of libraries, including the core SkipStack modules such as SkipFoundation and SkipLib, are all themselves released under a free and open-source software license, and thus are free for anyone to use, modify, and improve.

and, further down...

The Skip frameworks themselves are licensed under the LGPL, which enables Skip to be used to improve them without needing a license key.

then, which seemed even more definitive that you forced use of an LGPL library:

Can I use Skip in a closed-source commercial app?

Yes. Skip’s open-source components are released under the LGPL license, which is the same license used by ubiquitous iOS and Android components like JavaScriptCore and WebKit. LGPL libraries can be linked to by closed-source apps, but any changes to the LGPL libraries themselves must be published freely.

[AndyDentFree]

(Note that the responses from Touchgram above are also mine, not intending to pretend to be two different parties, was just logged in with a different GitHub account at the time and hadn't noticed until I saw my most recent comment published.)

[marcprux]

Thanks for pointing this out. We will update the FAQ to expand on the topic.

Note, however, that everything we cite there is accurate: you can use LGPL licensed code in your commercial apps. As we've pointed out, the WebKit and JavaSciptCore components included with iOS and linked to by millions of apps are, themselves, licensed under the LGPL. If using LGPL code was problematic, then no one would ship an app that uses an embedded web browser.

[marcprux]

We've added a note about Skip's LGPL linking exception to each of the project READMEs (e.g., SkipUI). This should put to rest any concerns over distribution to the various app stores.

[marcprux]

Quick update to this: we've change the license used by Skip's frameworks from the LGPL to the MPL. You can read the announcement at https://github.com/orgs/skiptools/discussions/647