Pysimplegui: [Licensing] Need Licensing Help

[MikeTheWatchGuy]

I'm not new to commercial software licensing having worked for decades with this stuff for multiple products. I've paid per shipment, per user, one time, etc.

What I've not done is develop an open source project, that is LGPL3 based.

I noticed one company has used this software in their product or their product's tools:
https://www.youtube.com/watch?v=49nwV5YNtSc&lc=z23zyxz4wmbldvirl04t1aokg5z15f405j4tre3034m1rk0h00410.1551889239368777

They were nice enough to mention PySimpleGUI!! I have to give them credit for this alone.

I asked them if I could get the source to their program that is using PySimpleGUI. I was sent to their website, but I don't see a way to get this particular code.

The question I have is:
What exactly does this company have to make available openly?

I'm confused on what their obligations are.

[pamoroso]

My guess is the source code should be released. This page explains how to address GPL violations. For further information I suggest contacting the Free Software Foundation.

[MikeTheWatchGuy]

I've read so many different tutorials, wikipedia pages about copyleft, etc, but I'm still left feeling really confused.

For example, I'm helping a company write an internal tool that is being used as a Slack notification tool, among other things. Are they obligated, under the license, to release their code even though it's used only internally?

I really hate to have to pay an attorney for these kinds of questions, but I may ultimately want to do so just to get it all straight so I can speak with some level of authority about my own software.

[spyoungtech]

My understanding is that, under LGPLv3, the source of the software using the library (called the "Application" in license terms) is not covered under the license. Therefore, the source of the internal tool you describe probably would not need to be released. The fact that the tool is used only internally is not really consequential to the license requirements.

However, if the company makes changes to the PySimpleGui library code, those changes are covered by the license and are subject to the requirements and may need to be released, among other requirements.

[MikeTheWatchGuy]

I read somewhere about a "statically linked" versus "dynamically linked" libraries also made a difference.

Does that apply to these Python projects?

Following my inquiries, I just got a message from the company that they've taken out all of the PySimpleGUI code from their software and they have taken down the videos.

I wasn't trying to be mean to them or chase them away. Geez... I was just looking into their use of the code and the licensing requirements

I do think that I need to make a more definitive statement in my readme to address commercial uses and more clearly define what exactly I want them to do in terms of labeling that PySimpleGUI was used in their product.

[spyoungtech]

That is basically the consequence of copyleft licenses. Companies will avoid them like the plague. It's also a very opinionated area of open-source. These are lessons that many projects face, so you're not alone, it's a complex issue.

Depending on license, it can be sometimes be difficult to change later on, so it's important to get it right sooner than later. Type license() into a Python interpreter and you may glean some of the complexity involved.

What is it you want to get out of your license? What reasons made you choose LGPL to begin with?

I do think that I need to make a more definitive statement in my readme to address commercial uses and more clearly define what exactly I want them to do in terms of labeling that PySimpleGUI was used in their product.

That's what the license is for. I'm not an attorney, and this is not legal advice, but I would be careful in trying to summarize the license as I can imagine it may be mistaken for a modification of the license or legal advice.

[eagleEggs]

Wow this was convoluted :P someone correct me if I’m wrong here and maybe it will help with the conversation: I developed a tool for work with PSG. I was obligated to give them my source code under GPLv3 which is what my license is as well as most libraries I used. Neither them nor I have any obligation to give that code out to anyone else. However if we do, the source needs to be given as well. Once that code is given, they can do anything with it, sell it, etc... but they must include the source with it. As far as I understand. I made two branches though, one for the base code which is open source and the other were separate modules that used no libraries which handles sensitive information.

I think your approach would scare most companies. For instance if the code has internal sensitive information. Which is probably why they avoided it completely by trashing it.

[MikeTheWatchGuy]

I do think that I need to make a more definitive statement in my readme to address commercial uses and more clearly define what exactly I want them to do in terms of _labeling that PySimpleGUI was used in their product._

What I meant by this statement was the exact language of the Copyright and attribution statements that I would like to be present in their code. I did not spell out the exact wording of the copyright for example.

I had no intention of modifying the core principals of the LGPL license.

I chose LGPL because I didn't want someone to commercially profit from my Open Source work without "giving back" in some way to the community or in the minimum making it known where the code came from. I didn't want to toss it out there as an MIT license, that's for sure.

I'm not trying to stop all commercial uses or I would have stated so. I started off not wanting any commercial uses at all, but softened up and made it LGPL as a compromise.

[spyoungtech]

That makes sense @eagleEggs -- GPL is what's known as 'strong copyleft' while LGPL is considered 'weak copyleft'. PySimpleGUI is licensed under LGPL. My understanding is that, one distinction with LGPL is that it separates the definition of library code from the program using the library as the covered work, making it less restrictive. There's a lot of nuances, so I'm not sure exactly what all the requirements are under LGPL as it's one of the more complex licenses

Based on what you said Mike, sounds like LGPL or GPL fits the bill, but unfortunately they tend to be less approachable for many companies.

A couple resources that may help you @MikeTheWatchGuy though you may have already come across them.

This SO post has some interesting insights into this particular situation w/Python and 'linked' libraries and another answer with context from FSF is there too.

This video also addresses key points about LGPL licenses.

But there's still a lot of debate on legal nuances that have yet to be tried in courts in the US and worldwide. So, keep that in mind when considering your own understanding or the assessments of others. It's not an easy topic! And companies will tend to err on the side of caution, which is why I, personally, tend to lean towards Apache 2.0 or MIT licensing for commercial/proprietary friendliness.

[MikeTheWatchGuy]

I found this explanation on Quora.

It seems like "dynamic linking" versus "static linking" is of super importance.

That leaves me wondering.... "Is PySimpleGUI statically linked of dynamically linked?"

I don't know exactly how Python would handle something like this. Isn't an import essentially copying the source code into the application space?

Also, if the application was turned into an EXE, a single EXE in particular, then I think that's "static linking".

[spyoungtech]

Per the GNU FAQ

Does the LGPL have different requirements for statically vs dynamically linked modules with a covered work?

(1) If you statically link against an LGPLed library, you must also provide your application in an object (not necessarily source) format, so that a user has the opportunity to modify the library and relink the application.

Even if statically linked, they would only need to provide the application in a format that allows the user to modify/relink the covered library, not necessarily provide source code. If the application was turned into an EXE, it could (technically) still be dynamically linked; just depends. If it was a standalone EXE that did not require the user to have the library on their computer, then it's probably safe to assume it's statically linked, in my view.

Also worthy of note: private (non-distributed) software is not subject to requirements of GPL/LGPL. Both the Free Software Foundation and the Open Source Initiative maintain that it should always be possible to use software privately. As long as it's not distributed, you have no obligation to release either source or binary outside the company.

See also the internal distribution FAQ:

Is making and using multiple copies within one organization or company “distribution”?

No, in that case the organization is just making the copies for itself. As a consequence, a company or other organization can develop a modified version and install that version through its own facilities, without giving the staff permission to release that modified version to outsiders.

However, when the organization transfers copies to other organizations or individuals, that is distribution. In particular, providing copies to contractors for use off-site is distribution.

So, I actually need to to correct my previous statement

The fact that the tool is used only internally is not really consequential to the license requirements.

This is incorrect per the above.

[eagleEggs]

Wow. I don't understand how providing the software to contractors 'off-site' is distribution. They are under the same working umbrella.

I've explicitly stated in the disclaimer for our internal emplyees that distribution is forbidden on the branches that include internal information. However based on this, if they are with a separate contracting company but on the same team, and work remotely - That is distributing it to them? Which would give them rights to distribute again... Confusion.

[spyoungtech]

If you transfer copies of your software to another company or individual (e.g. contracting co or contractor) to use off-site, it's considered distribution, meaning you would need to comply with the terms of the GPL/LGPL licensed work.

In many cases, contractors are considered co-employed with the client and contracting company, which may change things, since they'd technically be an employee of the company.

Which would give them rights to distribute again... Confusion.

I don't think it's totally correct to say it would give contractors rights to distribute it... but rather, the company would be distributing the software and therefore would be obligated to comply with GPL/LGPL license terms.

[BenStigsen]

It would be very helpful if someone could type out a bullet list over what's allowed and not allowed in layman's terms.

[MikeTheWatchGuy]

Go for it @BenTearzz 😃

[BenStigsen]

I don't even understand it myself.

[MikeTheWatchGuy]

Yea, I was just kidding with you.... would be nice to have. I've looked on the net at all the summaries, and they're all very long that I saw.

[BenStigsen]

This might be a good source: https://tldrlegal.com/license/gnu-lesser-general-public-license-v3-(lgpl-3)
Don't know how reliable it is though.

[MikeTheWatchGuy]

I opened up all of their bullet points and ended up with this:

[BenStigsen]

So basically. You're free to create applications and use them commercially, it also doesn't have to be under the LGPL3 license. But if changes are made to the original source / library, then the source / modified library has to be public under the same license.

[giodegas]

How about if I use PySimpleGUIQt? As far as I know, PyQt (GPL version) requires any applications developed with it to be open source GPL as well.
So if we consider PySimpleGUIQt as the application it should comply if LGPL is compatible with GPL, but if we consider the main app distributed as executable it may not comply.
Then being PySimpleGUIQt a wrapper of PyQt, for the final app, holds LGPL coming from PySG or GPL coming from the PyQt ?
So at the end for distributable exes we should have a PySide dependency , which is LGPL, rather that PyQt.

[BenStigsen]

As far as I've understood, you're only restricted to that license if you start distributing your application commercially (in which case you need to make it open-source or pay for a license), or, if any changes were made to the PyQt source it self needs to be open-source.

[giodegas]

Can I make a commercial closed application with PySimpleGUIQt over PySide, not modifing the libraries, without breaking any license?

[MikeTheWatchGuy]

@giodegas Does your company have in-house council?

[IlyaOrson]

In a related note, since PyInstaller is recommended in the docs to bundle a PySimpleGUI application, maybe a link to this guide or something similar in that section of the docs would be good to encourage the compliance with the LGPL license. As far as I understand, although the PyInstaller license allows to build and distribute programs with non GPL licenses, care must be taken to link dynamically dependencies with LGPL licenses.

[IlyaOrson]

I am not an expert in this matter _at all_ but I found this comparison between MPL and LGPL interesting. As far as I understand, it suggests that MPL license for PySimpleGUI would make easier to use the --onefile option in PyInstaller, which is considered static linking of dependencies. This would be helpful for applications that use this library but do not modify it. Just my two cents.

[PySimpleGUI]

Licensing is likely to change soon. Thanks for the info on MPL.