License Incompatibility with GPL 3.0 Dependency (verapdf)

[christianbuerckert]

We’ve identified a potential licensing issue regarding MustangLib’s dependency on verapdf, which is dual-licensed under the GPL 3.0 and MPL 2.0. Currently, MustangLib is licensed under Apache 2.0, but if verapdf were to be available only under GPL 3.0, this would introduce a conflict due to GPL’s strict copyleft requirements.

Problem Summary:

• GPL 3.0’s Requirements: The GPL 3.0 license mandates that any code directly using or linking to GPL 3.0-licensed code must itself be released under GPL 3.0 when distributed.
• Apache 2.0 and GPL 3.0 Incompatibility: Apache 2.0 and GPL 3.0 are not directly compatible, as the Apache license does not meet all the redistribution requirements of GPL 3.0 (e.g., patent rights and terms cannot be combined directly with GPL 3.0 in the same project).
• Effect on MustangLib: If verapdf is only available under GPL 3.0, MustangLib would need to adopt the GPL 3.0 license as well, rather than Apache 2.0, to remain compliant.

Proposed Solution:

1. Confirm verapdf’s License: Ensure verapdf remains dual-licensed under MPL 2.0 and GPL 3.0. Using verapdf under MPL 2.0 allows MustangLib to maintain its Apache 2.0 license without conflicts.
2. Consider Alternative Libraries: If verapdf ever shifts to GPL 3.0 exclusively, consider alternative libraries under compatible licenses to avoid the Apache 2.0/GPL 3.0 conflict.

Request:
Please assess the long-term viability of verapdf within MustangLib, considering any potential future licensing changes. Clear documentation of this dependency’s licensing status would also be helpful for users to ensure continued compliance. Especially writing down the implications for commercial users.

Thank you for your attention to this licensing matter.

[jstaerk]

Hi @christianbuerckert
thanks for pointing that out, I scheduled a meeting with them Monday, 15:00-16:00 CET, do you want to take part?
kind regards
Jochen

[jstaerk]

ok turned out that (incompatibility) was the reason why they co-license under the MPL and Carl said I would not have to do anything, Mustang automatically uses the MPL version :-)