In association with heise online

The Static Linking Trap

There was one last question The H had for Arno and Widenius, and that was how, given they were using an unmodified LGPL, they were going to be informing users of the C connector about the LGPL's requirements concerning static linking of code. This came about because when the connectors were launched the companies referred to the LGPL as permissive, which the LGPL isn't. As Simon Phipps, current president of the OSI puts it in a recent article, with the LGPL, "while often considered a 'weak copyleft' license, it is actually a strong copyleft license that incorporates a scope restriction setting a boundary on the project to which it applies".

That boundary is where the library's binary code links with the application's binary code; if the user of an application can't replace the LGPL library with their own compilation of the library, then their software freedom is restricted and the GPL's scope expands to the entire application. The freedom to swap the library means a user can fix bugs, audit code or enhance the library themselves. It's the library level version of the software freedom that the GPL offers at the whole application level.

Now, if shared libraries are used for the LGPL code it becomes simple to switch the library out for an alternative. But if the code is statically linked, then it isn't possible to swap the library out. But, clause 6 of the LGPLv2.1 gives static linkers a way out; they need to supply the binary components of the application in such a form that they can be relinked by the user with their version of the LGPL library. When The H asked Widenius and Arno how they planned to ensure developers knew about this, we were first told that people already knew about the requirements, but on going into the detail, were told that they didn't believe these requirements applied or were somehow optional and the responsibility of the library-using developer to ensure they complied. Describing the LGPL as permissive, though, doesn't help the user understand their responsibilities.

Widenius was specific in saying it was their intent that the C connector could be used as a statically linked library easily and the discussion ended with an assurance that they would be looking at adding a statement or exception for static linking to the licence terms, if required. Hopefully, that statement or exception will be structured in such a way that it works with the original LGPL code that the new connector is based on.

As an aside, the H's standing advice for users of LGPL libraries is, for simplicity of compliance with the licence, always employ them as shared libraries and, if making LGPL libraries, make it as easy as possible to use the library in a shared form.

Good intents

Widenius and Arno set out their positions as developers who wanted to ensure that there were good quality, fully featured, well maintained connectors for C and Java developers using MariaDB or MySQL and that they have looked to deliver that good intent with the release of the new connectors. Getting free software licensing right is complex, and being perceived as a good open source citizen is hard, but these are challenges that both want to take on.

Print Version | Permalink:
  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit