diff options
| -rw-r--r-- | README.md | 8 | ||||
| -rw-r--r-- | doc/LGPL-and-rust.md | 83 |
2 files changed, 89 insertions, 2 deletions
@@ -255,10 +255,14 @@ This code is licensed under either of at your option. -**However**, some parts are licensed under the GNU Lesser General +**However**, some optional parts are licensed under the GNU Lesser General Public License, version 3.0, as indicated in the `Cargo.toml`. -This applies to `crates/equix` and `crates/hashx`, +This applies to `crates/equix` and `crates/hashx`. +See [`LGPL-and-rust.md`](./doc/LGPL-and-rust.md) +for discussion of issues concerning redistributing binaries +containing these crates. + ## Contribution diff --git a/doc/LGPL-and-rust.md b/doc/LGPL-and-rust.md new file mode 100644 index 000000000..d41942377 --- /dev/null +++ b/doc/LGPL-and-rust.md @@ -0,0 +1,83 @@ +# Arti, Rust, LGPL section 4d compliance, and you + +As of 2024 May, Arti can (but is not required to) link against +certain crates licenced under the +GNU Lesser General Public License version 3.0 ([LGPL]). +These crates are [`hashx`] and [`equix`]. + +This document explains some issues that you should be aware of +if you want to ship binaries that use these crates, +that come about due to the interactions +of the Rust build system with the LGPL. + +If you are just a user of Arti, +and you aren't distributing software, +you don't need to worry about any of this. + +## WARNING! + +We are not lawyers and this is not legal advice. +Although this represents our current understanding +of the compliance issues at stake, +you should not take this document as a substitute +for actually reading and understanding +the relevant licenses and laws. + +This is our attempt to make you aware +of some issues that you may face. +It is not a license, +or an amendment to any license. + +Most of Arti is under licenses other than those discussed here; +this document does not free you of your obligation to follow those licenses. + +## Your more difficult obligations, in summary + +Briefly and approximately: + +If you ship an application that includes an LGPL-licensed library, +you need to give your users the ability to replace that library +with a different or modified version. +This requirement is in section 4.d of the [LGPL]. + +But Rust builds applications and libraries as static binaries, +and does not make it easy to replaces their constituent crates once +they have been built. +So the option of section 4.d.1 of the [LGPL] is not typically available. + +Therefore, +if you are shipping binaries that are based on Arti, +your easiest options are: + +1. Do not include the LGPL-licensed code. +2. Conform with section 4.d.0 of the [LGPL] by giving + your users all the source code necessary to build your + application. + Not just any way of making this code available is okay: + you need to conform with section 6 of the [GPL]. + Free software developers will generally find + section 6.d of the GPL easiest to follow. + +(Note that if you're shipping LGPL-licensed code, +you also have other obligations +with respect to giving notice +and displaying the appropriate copyright statements. +See section 4 of the [LGPL]. +Note also that the LGPL frees you from +some but not all of your obligations under the full [GPL]; +make sure you are aware of the requirements that the [LGPL] +does not relax.) + +## What if I want to ship arti with LGPL code in a closed-source binary? + +With some engineering, +you could probably make it possible to link [`equix`] +into arti as a shared library. + +We have no plans to work on this. + + +[`hashx`]: https://gitlab.torproject.org/tpo/core/arti/-/tree/main/crates/hashx?ref_type=heads +[`equix`]: https://gitlab.torproject.org/tpo/core/arti/-/tree/main/crates/equix?ref_type=heads +[GPL]: https://www.gnu.org/licenses/gpl-3.0.html +[LGPL]: https://www.gnu.org/licenses/lgpl-3.0.en.html |