mattewong

Certain open-source licenses such as LGPL allow the licensed code to be compiled into a library, dynamically linked against a work compiled from closed-source code, and distributed together as a combined work, to allow the recipient to "install and execute a modified version of the Combined Work produced by recombining or relinking the Application with a modified version of the Linked Version" (https://www.gnu.org/licenses/lgpl-3.0.html#section4)

Imagine I have LGPL code "OPEN.C" that is compiled into static and dynamic libs "OPEN.A" and "OPEN.DLL", and I have closed-source code that uses the library, and which is compiled into the following combined bundles:

  - COMBINED_SHARED, which consists of CLOSED_SHARED.EXE and OPEN.DLL. CLOSED_SHARED.EXE dynamically links to OPEN.DLL

  - COMBINED_STATIC, which consists of CLOSED_STATIC.EXE (which was statically linked to OPEN.A at compile time)

In this scenario, it seems undisputed that:

  - COMBINED_SHARED can be run locally, and can also be distributed (with proper notices and adherence to other terms) without running afoul of the license

  - COMBINED_STATIC can be run locally, but cannot be distributed without running afoul of the license

By "run locally", I mean that the work resides on a computer, which could include a server that a user can SSH into to execute the work. In that scenario, there is only ever 1 copy of the work, even if many users are able to use it

But what happens if COMBINED_STATIC is a web assembly target that resides on a web server, and is one of the various resources that are served by that server to users' browsers? Is that a distribution? Has there been any legal precedent for this, or discussion of this in the open-source community, that can provide guidance?

Some points in favor of "yes, it is a distribution":

  - the web assembly ("COMBINED_STATIC.wasm") is copied into the browser of each visiting user, so multiple copies are made

  - COMBINED_STATIC.wasm is executed locally inside the user's browser, and not on the server

Some points in favor of "no, it is not a distribution":

  - a website visitor running server-provided code is more analogous to a user who SSH's into a server to execute code that resides there, than to a user who receives a distribution of code that the user can recombine/relink (if given the necessary resources)

  - the user never has any ability to recombine or relink WASM that the server serves, regardless of whether the library was statically or dynamically linked, so the entire purpose of the license (to allow the recipient to "install and execute a modified version of the Combined Work produced by recombining or relink") is moot and therefore the license could not be intended to apply in this situation