7 ms·

What's the rational for not allowing LGPL code on the unity store? It makes no sense for the ban imho (tho i m not very familiar with unity store's model so i m

by chii 3y ago

What's the rational for not allowing LGPL code on the unity store? It makes no sense for the ban imho (tho i m not very familiar with unity store's model so i might just be missing something).

paulmd 3y ago
intredasting, they rather explicitly appear to be tilting against viral licensing: > 5.10.4 Provider represents and warrants that its Assets shall not contain (a) any software licensed under the GNU General Public License or GNU Library or Lesser General Public License, or any other license with terms that include a requirement to extend such license to any modification or combined work and provide for the distribution of the combined or modified product’s source code upon demand so that Customer content becomes subject to the terms of such license; or (b) any software that is a modification or derivative of any software licensed under the GNU General Public License or Library or Lesser Public License, or any other license with terms similar thereto so that Customer content become subject to the terms of such license. LGPL doesn't impose combined redistribution requirements, does it? They're just tilting against that whole ecosystem specially. And if you apply the same standard as LGPL, MIT/BSD are basically the same right? Probably CDDL falls in too? that's absolutely a crazy thing but it's pretty straightforward in the licensing agreement. No, no, they got it all wrong: "not, invented here!"
- adrian_b 3y ago
  LGPL is a regular license, it is not a viral license. GPL is a viral license. The GNU glibc uses LGPL and almost any program run on a Linux system uses glibc, regardless in what programming language it has been written, at least for the system calls. If LGPL had been a viral license too, all programs would have been affected.
  - ghusbands 3y ago
    Doesn't the LGPL give users the right to replace the LGPL part with a modified library of their choice? It seems doubtful that users can modify downloaded Unity apps at their leisure, so that would mean that LGPL cannot be supported on Unity, wouldn't it? Though then it would seem that LGPL libraries on almost any app store are being used against their license terms, so I must be wrong.
    - adrian_b 3y ago
      The obvious way to comply with LGPL is to link dynamically the LGPL libraries, even if everything else is linked statically. I am pretty sure that the Unity executables link dynamically glibc anyway. The alternative is to do the static linking in 2 steps. First link everything else into a big ELF object file, then do the final linking of the LGPL libraries. For compliance with the LGPL, it is enough to provide access to the big binary object file, so that a user may relink the possibly modified LGPL libraries, if desired. A dynamically-linked executable and an object file that needs a final static linking step with additional libraries have almost identical content and they provide equivalent information.
      - pzo 3y ago
        Sometimes even dynamic linking might be not enough - on iOS you can build dynamic frameworks that are dynamically linked but they are signed with developer provisioning key when distributed via App Store. AFAIK there is not other way for end user to swap such dynamic framework/library unless developer will provide source code or object files or compiled code (e.g. in other dynamic framework that links dynamically to such LGPL code). Not sure about jailbroken iPhones. Also for more complicated iOS projects (that require iOS capabilities e.g. in-app-purchase, push notifications, app pay, icloud etc.) end user would need to have a paid apple developer account to create and sign build.
    - swiftcoder 3y ago
      > Though then it would seem that LGPL libraries on almost any app store are being used against their license terms, so I must be wrong. You are not wrong. LGPL does require that you provide users the ability to link against a modified version of the LGPL library. It is a requirement that has been rather honoured in the breach in this age of appstores
      - palata 3y ago
        > LGPL does require that you provide users the ability to link against a modified version of the LGPL library. That's correct for LGPLv3, but I believe LGPLv2 is more nuanced. With LGPLv2, I don't think it requires that you provide the ability. It has to be possible if you get access to the executable (which may require that you jailbreak your device, for instance). For instance, it is my opinion (not legal advice) that it is fine to use an LGPLv2 Java library in a proprietary Android app, because you can technically go replace the class files corresponding to the LGPLv2 library in your apk. It's not easy to do (unlike swapping a dynamic library), but it is possible.
  - paulmd 3y ago
    This isn't a linguistic disagreement, LGPL and similar licenses are literally forbidden by the direct plain text of the agreement. > (b) any software that is a modification or derivative of any software licensed under the GNU General Public License or Library or Lesser Public License, or any other license with terms similar thereto so that Customer content become subject to the terms of such license.
    - adrian_b 3y ago
      The complaint was not that it is not true that they have not complied with the agreement, but that this rule is only selectively enforced and that nobody truly complies with it. Moreover, the rule has no rational reason, because unlike with GPL, compliance with LGPL is very easy to achieve, even for proprietary programs.
      - rerdavies 3y ago
        The rule is completely rational. It is impossible to use LGPL-licensed components on the Android app store or Apple app store without becoming infected with the full GPL. (As extensively discussed throughout this thread).
        cozzyd 3y ago
        Sounds like Apple and Google should fix their broken app stores then.
        rerdavies 3y ago
        The LGPL breaks because the app stores require signed executables, and signed static libraries, which is a Very Good Thing. Sounds like people should use MIT licenses (or similar non-viral licenses) instead of LGPL licenses.
  - deleted 3y ago
    [deleted]
  - lmm 3y ago
    > LGPL is a regular license, it is not a viral license. > GPL is a viral license. The LGPL's level of "virality" is small, but nonzero - it imposes requirements on a larger program of which you use LGPL code as a part. Those requirements are much smaller than the requirements imposed by GPL code in the same circumstances, but they are real, and much more substantial than e.g. including a copyright notice. > The GNU glibc uses LGPL and almost any program run on a Linux system uses glibc, regardless in what programming language it has been written, at least for the system calls. glibc has an explicit linking exception for programs using its public interface.
  - davexunit 3y ago
    Calling a license "viral" is a gross pejorative intended to discourage copyleft.
    - paulmd 3y ago
      okay
- MaxBarraclough 3y ago
  At the risk of seeming pedantic, the proper term is copyleft, not viral licensing. If memory serves, viral licensing has its origins in Microsoft fear-mongering (predating the modern positive use of viral, as in go viral). > LGPL doesn't impose combined redistribution requirements, does it? It does, in that if you modify the source-code of an LGPL-licensed library and distribute the binary, you are required to also distribute the source (i.e. the source of your modified version). Your modified source must also use the LGPL licence. If you distribute an unmodified binary for an LGPL-licensed library, you must also provide access to the unmodified source. (This isn't to say you need to bundle it into the same archive file.) It differs from the vanilla GPL in that an LGPL-licensed library permits you to dynamically link to it from application code that doesn't need to use any particular licence. (This is at least the gist of the matter as it applies to application code. This isn't legal advice, I'm not a lawyer, etc.) See the final point on this page from the FSF (authors of the GPL and LGPL) - https://www.fsf.org/bulletin/2014/fall/common-gpl-misconceptions https://www.fsf.org/bulletin/2014/fall/common-gpl-misconcept...
  - rerdavies 3y ago
    At the risk of seeming pedantic, who are you to decide whether viral licensing or copyleft is the proper term?
    - MaxBarraclough 3y ago
      It's not just my preference, anyone familiar with this area of copyright law recognises copyleft as its standard name. Viral licensing is, as I said, a snarky pejorative. [0][1] It's also less precise. Proprietary licenses can be 'viral' too. DRM libraries, for instance, may require that application source code not be made publicly available. > At the risk of seeming pedantic Parroting others in this way comes across as juvenile and antagonistic. [0] https://en.wikipedia.org/wiki/Copyleft#Viral_licensing https://en.wikipedia.org/wiki/Copyleft#Viral_licensing [1] https://en.wikipedia.org/wiki/Viral_license https://en.wikipedia.org/wiki/Viral_license
      - paulmd 3y ago
charcircuit 3y ago
The rational is that you should be able to just install any asset from the store in your game and be good to go. With an LGPL asset now you have to let customers be able to edit that addon and rebuild your game with it which would be a pain, and most developers do not want to give out the unity project files. Having a simple licensing story for assets on the store lets users have trust in whatever they see they can use in their game worry free. Edit: Removed bit about LGPL applying to the original code because of static linkage because it was incorrect and distracting from my point
- deleted 3y ago
  [deleted]
- adrian_b 3y ago
  What you say is not correct. Only linking with a GPL library makes GPL applicable to the whole program. This is the difference between LGPL and GPL. LGPL is a normal license that applies only to the library. Since glibc uses LGPL, if your theory had been true than almost all programs run on a Linux system, regardless of their origin, would have been covered by LGPL.
  - charcircuit 3y ago
    The LGPL code gets statically linked with the rest of your code which means that you have to provide the project files in order to be able to change the LGPL code.
    - adrian_b 3y ago
      No, you do not have to provide any project files, even when everything is linked statically. Static linking can be split into two linking steps, first everything except the LGPL libraries can be linked into a big ELF object file, which no longer contains any information about the internal structure and the internal symbols, exactly like an executable file. The only difference between such an object file and an executable is that it contains unresolved external references, like a dynamically-linked executable. Then in the second and final linking step, the big binary object file is linked with the LGPL libraries. For compliance with LGPL it is enough to offer access to the big binary object file for the users who would want to replace the LGPL libraries.
larschdk 3y ago
My guess; Unity doesn't want LGPL code in component they re-distribute, because the responsibility to comply with the license requirements falls on them, since they are the ones redistributing. It's not that they can't, but they wont take that responsibility, which is understandable. They would basically need to audit every component to ensure that the end user can build and replace LGPL parts with their own.
- toyg 3y ago
  Not really. They could just distribute things anyway, and simply invoke the license-termination clauses as soon as any infringement is detected by claimants - similarly to how (I expect) they would treat claims of copyright infringements on game assets. They are just being obtuse - which looks fishy when coupled with VLC's claims that they wouldn't allow them back in even if all LGPL code was removed. They probably don't want competition for some component.
- captainmuon 3y ago
  I'd say it is even debatable whether Unity is really re-distributing in the sense of the LGPL or merely hosting. Redistribution is something between licensor and licensee, your web hoster or your telecom is not involved. But I guess that's another thing they don't want to test in court and it's easier to say they don't want it.
  - larschdk 3y ago
    The LGPL license doesn't work that way. The rights that it establishes follows every time you transfer the work between legal entities. If I transfer the work to you, I need to extend the rights granted in the license to you. I can't expect others to do it for me.
- maratc 3y ago
  I think your guess is correct. GPL/LGPL is a contract that puts certain obligations on all parties; just by being a redistributor, Unity now becomes a party to a contract they never signed or even intended to sign. It's easier for them to refuse to be a party to that contract by not allowing any software under that license on their property to begin with.
agsnu 3y ago
My guess is that they want packages on the Unity store to be usable on all platforms they support. For example, if you build an app for iOS or visionOS, you have to distribute it via Apple’s stores, and there are technical barriers (code signing, DRM) that get in the way of an end user being able to exercise their right to replace LGPL components with modified versions. I mention this example because there was a big tie up for Unity and visionOS announced with the Apple Vision Pro last summer, but presumably the same applies to Unity games on consoles etc as well. I can see why from Unity’s perspective it is cleaner to just forbid LGPL entirely, that way it is harder for their customers to mistakenly violate licenses.
- palata 3y ago
  > there are technical barriers (code signing, DRM) that get in the way of an end user being able to exercise their right to replace LGPL components with modified versions I wonder if that is an issue for LGPLv2. Pretty sure that for LGPLv3, the distributor would have to give instructions explaining how to do it (which they could not do), but LGPLv2 does not require that, right? As in, wouldn't code signing and DRM count as some kind of tivoization?
mihaaly 3y ago
Would it worth a try reporting other LGPL violations to Unity - as drawing attention to violations of their own 5.10.4 of Provider agreement - in a documented manner? Just to see how they proceed.

by chii 3y ago

What's the rational for not allowing LGPL code on the unity store? It makes no sense for the ban imho (tho i m not very familiar with unity store's model so i might just be missing something).

paulmd 3y ago

intredasting, they rather explicitly appear to be tilting against viral licensing: > 5.10.4 Provider represents and warrants that its Assets shall not contain (a) any software licensed under the GNU General Public License or GNU Library or Lesser General Public License, or any other license with terms that include a requirement to extend such license to any modification or combined work and provide for the distribution of the combined or modified product’s source code upon demand so that Customer content becomes subject to the terms of such license; or (b) any software that is a modification or derivative of any software licensed under the GNU General Public License or Library or Lesser Public License, or any other license with terms similar thereto so that Customer content become subject to the terms of such license. LGPL doesn't impose combined redistribution requirements, does it? They're just tilting against that whole ecosystem specially. And if you apply the same standard as LGPL, MIT/BSD are basically the same right? Probably CDDL falls in too? that's absolutely a crazy thing but it's pretty straightforward in the licensing agreement. No, no, they got it all wrong: "not, invented here!"

adrian_b 3y ago
LGPL is a regular license, it is not a viral license. GPL is a viral license. The GNU glibc uses LGPL and almost any program run on a Linux system uses glibc, regardless in what programming language it has been written, at least for the system calls. If LGPL had been a viral license too, all programs would have been affected.
- ghusbands 3y ago
  Doesn't the LGPL give users the right to replace the LGPL part with a modified library of their choice? It seems doubtful that users can modify downloaded Unity apps at their leisure, so that would mean that LGPL cannot be supported on Unity, wouldn't it? Though then it would seem that LGPL libraries on almost any app store are being used against their license terms, so I must be wrong.
  - adrian_b 3y ago
    The obvious way to comply with LGPL is to link dynamically the LGPL libraries, even if everything else is linked statically. I am pretty sure that the Unity executables link dynamically glibc anyway. The alternative is to do the static linking in 2 steps. First link everything else into a big ELF object file, then do the final linking of the LGPL libraries. For compliance with the LGPL, it is enough to provide access to the big binary object file, so that a user may relink the possibly modified LGPL libraries, if desired. A dynamically-linked executable and an object file that needs a final static linking step with additional libraries have almost identical content and they provide equivalent information.
    - pzo 3y ago
      Sometimes even dynamic linking might be not enough - on iOS you can build dynamic frameworks that are dynamically linked but they are signed with developer provisioning key when distributed via App Store. AFAIK there is not other way for end user to swap such dynamic framework/library unless developer will provide source code or object files or compiled code (e.g. in other dynamic framework that links dynamically to such LGPL code). Not sure about jailbroken iPhones. Also for more complicated iOS projects (that require iOS capabilities e.g. in-app-purchase, push notifications, app pay, icloud etc.) end user would need to have a paid apple developer account to create and sign build.
  - swiftcoder 3y ago
    > Though then it would seem that LGPL libraries on almost any app store are being used against their license terms, so I must be wrong. You are not wrong. LGPL does require that you provide users the ability to link against a modified version of the LGPL library. It is a requirement that has been rather honoured in the breach in this age of appstores
    - palata 3y ago
      > LGPL does require that you provide users the ability to link against a modified version of the LGPL library. That's correct for LGPLv3, but I believe LGPLv2 is more nuanced. With LGPLv2, I don't think it requires that you provide the ability. It has to be possible if you get access to the executable (which may require that you jailbreak your device, for instance). For instance, it is my opinion (not legal advice) that it is fine to use an LGPLv2 Java library in a proprietary Android app, because you can technically go replace the class files corresponding to the LGPLv2 library in your apk. It's not easy to do (unlike swapping a dynamic library), but it is possible.
- paulmd 3y ago
  This isn't a linguistic disagreement, LGPL and similar licenses are literally forbidden by the direct plain text of the agreement. > (b) any software that is a modification or derivative of any software licensed under the GNU General Public License or Library or Lesser Public License, or any other license with terms similar thereto so that Customer content become subject to the terms of such license.
  - adrian_b 3y ago
    The complaint was not that it is not true that they have not complied with the agreement, but that this rule is only selectively enforced and that nobody truly complies with it. Moreover, the rule has no rational reason, because unlike with GPL, compliance with LGPL is very easy to achieve, even for proprietary programs.
    - rerdavies 3y ago
      The rule is completely rational. It is impossible to use LGPL-licensed components on the Android app store or Apple app store without becoming infected with the full GPL. (As extensively discussed throughout this thread).
      - cozzyd 3y ago
        Sounds like Apple and Google should fix their broken app stores then.
        rerdavies 3y ago
        The LGPL breaks because the app stores require signed executables, and signed static libraries, which is a Very Good Thing. Sounds like people should use MIT licenses (or similar non-viral licenses) instead of LGPL licenses.
- deleted 3y ago
  [deleted]
- lmm 3y ago
  > LGPL is a regular license, it is not a viral license. > GPL is a viral license. The LGPL's level of "virality" is small, but nonzero - it imposes requirements on a larger program of which you use LGPL code as a part. Those requirements are much smaller than the requirements imposed by GPL code in the same circumstances, but they are real, and much more substantial than e.g. including a copyright notice. > The GNU glibc uses LGPL and almost any program run on a Linux system uses glibc, regardless in what programming language it has been written, at least for the system calls. glibc has an explicit linking exception for programs using its public interface.
- davexunit 3y ago
  Calling a license "viral" is a gross pejorative intended to discourage copyleft.
  - paulmd 3y ago
    okay
MaxBarraclough 3y ago
At the risk of seeming pedantic, the proper term is copyleft, not viral licensing. If memory serves, viral licensing has its origins in Microsoft fear-mongering (predating the modern positive use of viral, as in go viral). > LGPL doesn't impose combined redistribution requirements, does it? It does, in that if you modify the source-code of an LGPL-licensed library and distribute the binary, you are required to also distribute the source (i.e. the source of your modified version). Your modified source must also use the LGPL licence. If you distribute an unmodified binary for an LGPL-licensed library, you must also provide access to the unmodified source. (This isn't to say you need to bundle it into the same archive file.) It differs from the vanilla GPL in that an LGPL-licensed library permits you to dynamically link to it from application code that doesn't need to use any particular licence. (This is at least the gist of the matter as it applies to application code. This isn't legal advice, I'm not a lawyer, etc.) See the final point on this page from the FSF (authors of the GPL and LGPL) - https://www.fsf.org/bulletin/2014/fall/common-gpl-misconceptions https://www.fsf.org/bulletin/2014/fall/common-gpl-misconcept...
- rerdavies 3y ago
  At the risk of seeming pedantic, who are you to decide whether viral licensing or copyleft is the proper term?
  - MaxBarraclough 3y ago
    It's not just my preference, anyone familiar with this area of copyright law recognises copyleft as its standard name. Viral licensing is, as I said, a snarky pejorative. [0][1] It's also less precise. Proprietary licenses can be 'viral' too. DRM libraries, for instance, may require that application source code not be made publicly available. > At the risk of seeming pedantic Parroting others in this way comes across as juvenile and antagonistic. [0] https://en.wikipedia.org/wiki/Copyleft#Viral_licensing https://en.wikipedia.org/wiki/Copyleft#Viral_licensing [1] https://en.wikipedia.org/wiki/Viral_license https://en.wikipedia.org/wiki/Viral_license
    - paulmd 3y ago

charcircuit 3y ago

The rational is that you should be able to just install any asset from the store in your game and be good to go. With an LGPL asset now you have to let customers be able to edit that addon and rebuild your game with it which would be a pain, and most developers do not want to give out the unity project files. Having a simple licensing story for assets on the store lets users have trust in whatever they see they can use in their game worry free. Edit: Removed bit about LGPL applying to the original code because of static linkage because it was incorrect and distracting from my point

deleted 3y ago
[deleted]
adrian_b 3y ago
What you say is not correct. Only linking with a GPL library makes GPL applicable to the whole program. This is the difference between LGPL and GPL. LGPL is a normal license that applies only to the library. Since glibc uses LGPL, if your theory had been true than almost all programs run on a Linux system, regardless of their origin, would have been covered by LGPL.
- charcircuit 3y ago
  The LGPL code gets statically linked with the rest of your code which means that you have to provide the project files in order to be able to change the LGPL code.
  - adrian_b 3y ago
    No, you do not have to provide any project files, even when everything is linked statically. Static linking can be split into two linking steps, first everything except the LGPL libraries can be linked into a big ELF object file, which no longer contains any information about the internal structure and the internal symbols, exactly like an executable file. The only difference between such an object file and an executable is that it contains unresolved external references, like a dynamically-linked executable. Then in the second and final linking step, the big binary object file is linked with the LGPL libraries. For compliance with LGPL it is enough to offer access to the big binary object file for the users who would want to replace the LGPL libraries.

larschdk 3y ago

My guess; Unity doesn't want LGPL code in component they re-distribute, because the responsibility to comply with the license requirements falls on them, since they are the ones redistributing. It's not that they can't, but they wont take that responsibility, which is understandable. They would basically need to audit every component to ensure that the end user can build and replace LGPL parts with their own.

toyg 3y ago
Not really. They could just distribute things anyway, and simply invoke the license-termination clauses as soon as any infringement is detected by claimants - similarly to how (I expect) they would treat claims of copyright infringements on game assets. They are just being obtuse - which looks fishy when coupled with VLC's claims that they wouldn't allow them back in even if all LGPL code was removed. They probably don't want competition for some component.
captainmuon 3y ago
I'd say it is even debatable whether Unity is really re-distributing in the sense of the LGPL or merely hosting. Redistribution is something between licensor and licensee, your web hoster or your telecom is not involved. But I guess that's another thing they don't want to test in court and it's easier to say they don't want it.
- larschdk 3y ago
  The LGPL license doesn't work that way. The rights that it establishes follows every time you transfer the work between legal entities. If I transfer the work to you, I need to extend the rights granted in the license to you. I can't expect others to do it for me.
maratc 3y ago
I think your guess is correct. GPL/LGPL is a contract that puts certain obligations on all parties; just by being a redistributor, Unity now becomes a party to a contract they never signed or even intended to sign. It's easier for them to refuse to be a party to that contract by not allowing any software under that license on their property to begin with.

agsnu 3y ago

My guess is that they want packages on the Unity store to be usable on all platforms they support. For example, if you build an app for iOS or visionOS, you have to distribute it via Apple’s stores, and there are technical barriers (code signing, DRM) that get in the way of an end user being able to exercise their right to replace LGPL components with modified versions. I mention this example because there was a big tie up for Unity and visionOS announced with the Apple Vision Pro last summer, but presumably the same applies to Unity games on consoles etc as well. I can see why from Unity’s perspective it is cleaner to just forbid LGPL entirely, that way it is harder for their customers to mistakenly violate licenses.

palata 3y ago
> there are technical barriers (code signing, DRM) that get in the way of an end user being able to exercise their right to replace LGPL components with modified versions I wonder if that is an issue for LGPLv2. Pretty sure that for LGPLv3, the distributor would have to give instructions explaining how to do it (which they could not do), but LGPLv2 does not require that, right? As in, wouldn't code signing and DRM count as some kind of tivoization?

mihaaly 3y ago

Would it worth a try reporting other LGPL violations to Unity - as drawing attention to violations of their own 5.10.4 of Provider agreement - in a documented manner? Just to see how they proceed.