Important: Use of GLIBC in node-webkit and licensing

[Patrick Klug]

Just a quick note. We are currently going through the formal complaint process with the Free Software Foundation because a user has reported our non-compliance with the L-GPL. It turns out that node-webkit dynamically links to the gnu c library glibc, and this requires that a license of the L-GPL should be included with any distribution of an app on Linux and that end-users need to be made aware of that.

More info on this is available here:

http://www.greenheartgames.com/2013/09/07/to-our-linux-players-game-dev-tycoon-for-linux-and-glibc/

This is just a friendly warning that if you deploy your app using node-webkit on Linux then you might also be in non-compliance with the L-GPL.

Hope this can save someone trouble.

Patrick

[LZAntal]

Hi,

Could you give me/us some more background. Did you have anywhere in your credits that you are using glibc[LGPL] and a contact email? If so that suffice the fulfillment since the user can simply request access to it. It's been awhile I released a commercial software on linux but thats how we used to do it and never had issues.

Thanks

Laszlo

http://twitter.com/LZAntal

--
You received this message because you are subscribed to the Google Groups "node-webkit" group.
To unsubscribe from this group and stop receiving emails from it, send an email to node-webkit...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

[Patrick Klug]

We didn't list this anywhere as we didn't know that node-webkit uses glibc and needs to include such a license.

Now that I look at this closer it seems that a bunch of licenses are missing from the node-webkit release.

Licenses for glibc on Linux and all of the .dll files on Windows also need a license (icudt, libEGl, libGLESv2, ffmpegsumo).

If you do distribute your app using node-webkit you will need to include these licenses.

[Chris Turnbull]

Hi Patrick, thanks for the heads up!

A quick question if you don't mind - is including the license and a link to the code (e.g. https://www.gnu.org/software/libc/) enough to satisfy the LGPL?

I hope so, as it would be a bit of a pain to have to distribute the full source-code of node-webkit and glibc with each release.

[Patrick Klug]

You don't have to distribute the source code just include a copy of the license and say that the software uses it.

We ended up doing a license directory with a readme that is similar in content to the third party components listed on this page:

http://www.greenheartgames.com/credits/game-dev-tycoon/

Patrick

[bav...@gmail.com]

That would make >99.9% of linux software illegal.

Dynamically linking against glibc does not fall under the terms of the license, thus you do not need to act.

For example, lets take it from the manual: http://www.gnu.org/software/libc/manual/html_mono/libc.html

"Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted ..."

Statically linking, however, will mean copying and distributing. Otherwise you are just using the software and you will not need a license, neither you need a license when using the output of the software for any purpose.

[Patrick Klug]

Well, the Free Software Foundation seems to disagree. This is what they told us:

"The problem is that a work that dynamically links with GLIBC is

considered a work that 'uses the library'. The executable of such a

work, when distributed, needs to include a copy of the license, as well

as a notice that the work is used. Failing to do so is a violation of

the license."

Patrick

--

[Roger]

Patrick Klug <patric...@gmail.com> writes:

> Just a quick note. We are currently going through the formal complaint
> process with the Free Software Foundation because a user has reported our
> non-compliance with the L-GPL. It turns out that node-webkit dynamically
> links to the gnu c library glibc, and this requires that a license of the
> L-GPL should be included with any distribution of an app on Linux and that
> end-users need to be made aware of that.

Hi Patrick,

There should be a little misunderstanding here. I double checked with our
internal trusted licensing expert, regarding dynamic linking to glibc:

"If your program uses the standard GCC runtime libraries and you are not
distributing those libraries with your program, you do not need to
include a copy of the LGPL license with your program. Users should have
received a copy of the LGPL with the Linux distribution which included
those libraries."

So it shouldn't be on glibc and we're not distributing GCC runtime
libraries. It should be some other LGPL components included in the
binary.

Now there is a list of licenses of open source components in the
node-webkit binary, basically it's the same as Chromium's plus Node.js:

https://github.com/rogerwang/node-webkit/wiki/How-to-package-and-distribute-your-apps

We'll start including the notices when we release 0.7.3.

--
Roger

[Patrick Klug]

I have contacted the FSF again to clarify the situation. We were just following their advice on the matter and we made very clear from the beginning that we only dynamically link to glibc.

Will keep you updated and thanks for checking this from your side too.

Patrick

[Patrick Klug]

I got another update from the FSF and I think they wouldn't mind quoting some of it here:

==

The GCC Runtime Library exception
<http://www.gnu.org/licenses/gcc-exception-3.1-faq.html> applies to
works under the GPL that are a part of GCC, such as libgcc and
libstdc++. Use of those libraries would fall under the terms of the GPL,
except that the exception works to remove particular works from the
scope of the license.

And, accordingly, your use of works covered by the GCC Runtime Library
Exception was never an issue.

However, GLIBC is not a GCC runtime library. GLIBC is licensed
under the LGPL, not under the terms of the GPL with Runtime Library
Exception.

You'll note that GLIBC does not contain a copy of the Runtime Library
Exception.
Also note that GLIBC is omitted from the list of libraries covered in
the GCC Runtime Library Exception FAQ ("The GCC Runtime Library Exception
covers any file that has a notice in its license headers stating that the
exception applies. This includes libgcc, libstdc++, libfortran, libgomp,
libdecnumber, libgcov, and other libraries distributed with GCC.")

[...]

The act of running the dynamically linked program is not covered by the
license, but the act of distributing a work that "uses the library" (as
defined in section 5), is covered. Section 6(b) lays out what is
necessary when dynamically linking[...]

==

They also graciously offered that you can follow up with questions directly via lice...@fsf.org

Roger, I suggest your team should do that to come into compliance.

Hope this helps.

Patrick

[bav...@gmail.com]

How about, you link against a different libc.so shared library (like musl) and on the end-users machine the linking resolves to glibc?

This case is a total mess!

I believe I will stop Linux development altogether and stick with commercial platforms. Maybe BSD, some time in the future, will bring a free(!!) development platform.

[Trevor Linton]

Pretty simple fix is to open Chrome and go to chrome://credits, copy out (or save) the html out and include it in your application as CREDITS.html, make sure to add node-webkit to it though :)

chrome://credits/

[Yongkang You]

Not all Chrome used libs are used by node-webkit, since nw is just based on the Content layer. BTW, I also didn't catch glibc in chrome://credits/ on Linux. So I really doubt the request from FSF.

--
You received this message because you are subscribed to the Google Groups "node-webkit" group.
To unsubscribe from this group and stop receiving emails from it, send an email to node-webkit...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
Yongkang You