13

I've built an R package that uses a mix of libraries licensed under GPL-2 and GPL-3. From what I've read, because of this dependency, my package will also have to be GPL.

See here: https://www.gnu.org/licenses/gpl-faq.en.html#IfLibraryIsGPL

If a library is released under the GPL (not the LGPL), does that mean that any software which uses it has to be under the GPL or a GPL-compatible license? Yes, because the software as it is actually run includes the library.

Confusingly, one can find R packages under MIT, even though they depend on a package under GPL. For example, memoise is MIT even though it depends on digest (which is GPL-2).

See https://cran.r-project.org/web/packages/memoise/index.html

Am I right about my having to use GPL and does it matter if I choose GPL2/3?

Mureinik
  • 5,112
  • 3
  • 31
  • 42
Levi Thatcher
  • 131
  • 1
  • 5
  • Similar: https://wordpress.org/news/2009/07/themes-are-gpl-too/ –  Sep 01 '16 at 17:49
  • 1
    "Confusingly, one can find R packages under MIT, even though they depend on a package under GPL." -- That sounds to me like improper licensing. It's not legally well-defined what constitutes a derivative work in the context of an interpreted scripting language, but generally it's accepted that this would count. It's likely the authors of these packages either never looked at the licenses of their dependencies or don't understand them. – Xiong Chiamiov Sep 01 '16 at 21:36
  • @XiongChiamiov I could not agree more with your comment, but this is rather common and quasi-pervasive for CRAN packages – Philippe Ombredanne Sep 01 '16 at 23:39
  • Thanks, guys! I'm still confused though, as @hadley says that this scenario doesn't require GPL because my package and the ones I call don't link: https://twitter.com/levithatcher/status/771716687712231424 Thoughts? – Levi Thatcher Sep 02 '16 at 19:19

2 Answers2

6

While a package running on top R could use any license, when using GPL-licensed R libraries that my code depends on I would consider that the GPL would apply also to my code, regardless how removed that dependency might be.

The R community has the tendency (which is IMHO a tad unfortunate) to release libraries using the GPL when the LGPL or a GPL with a linking exception could have been more suitable for a library-style usage. You can also check this question and answer (of mine) on dependencies.

About choosing GPL 2 or 3: it depends on the license of these dependent libraries: if one is GPL 2-only, it technically would not be compatible (per the FSF) with the GPL 3. Is this devilishly weird or not?

Philippe Ombredanne
  • 14,441
  • 2
  • 32
  • 87
  • The URL of the linked Q&A is incorrect (it links here). – jbaums Sep 30 '19 at 04:12
  • 1
    @jbaums Thank you and good catch: I fixed this: this is at https://opensource.stackexchange.com/questions/4287/what-are-software-dependencies-and-what-are-the-implications-of-floss-dependenc – Philippe Ombredanne Oct 01 '19 at 08:37
3

You are technically allowed to distribute your own package under any license because you are distributing your code only. However, it would not be fair to the users of your package who might not realize that they have to abide to the terms of the GPL license as well.

These users include yourself as soon as you start producing a full program using your library. The program as a whole needs to be under GPL 2.0 or 3.0. And as Philippe notes, these two versions are mutually incompatible so you cannot distribute a program that would depend on libraries under both licenses. To solve this hurdle, the best way is probably to write to the authors of the "GPL 2.0 only" packages and ask them to license their libraries under "GPL 2.0 or later" instead.

Zimm i48
  • 5,587
  • 17
  • 40