search

tananaev / passport-reader

e-Passport NFC Reader Android app
329 stars 128 forks source link

Possible GPL violation #8

Closed SonOfBowser closed 6 years ago

SonOfBowser commented 6 years ago

License of this library is listed as Apache 2.0 but it's using components from JMRTD and SCUBA licensed as LGPL. Under the terms of LGPL, this library is considered a combined work and so must be licensed under a GPL compatible license. https://www.gnu.org/licenses/lgpl-3.0.en.html

Just a warning for anyone looking to integrate this.

tananaev commented 6 years ago

You are mistaken. Passport reader is not a library, it's an application that uses LGPL library. That does not violate LGPL 3 license.

SonOfBowser commented 6 years ago

I suggest you read the license again. It's pretty clear on what constitutes a Combined Work ("a work produced by combining or linking an Application with the Library"), as well as how to make a combined work compatible with the license terms. You might be able to get away with just saying it contains GPL code and linking to the original license.

tananaev commented 6 years ago

I agree that we might need to indicate somewhere that LGPL library is used, but Apache license is compatible with GPL 3. Your original comment seems to imply that it's not compatible, which is incorrect.

SonOfBowser commented 6 years ago

They are incompatible in a strict sense, but that doesn't matter as long as its not a derivative work (ignore my original comments, misread the license). What needs to be made clearer is that people using or modifying this code also need to be compliant with the terms of LGPL license. This may be a major problem for non open-source code.

tananaev commented 6 years ago

I have added a list of dependencies with corresponding licenses. Thanks for pointing this out.

tananaev commented 6 years ago

Interesting commit hash code ;)