Sign up ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

I wrote a system in Java that I want to release under the terms of GPL v2 or later. I've used Apache Maven to deal with all the dependencies of the system, so I don't have the source code of any of the libraries used. I've already checked, all the libraries were released under GPL-compatible licenses (Apache v2, 3-clause BSD, MIT, LGPL v2 and v2.1).

Can I distribute my work under GPLv2 or later and provide the libraries on the same package as separate works, without having to apply GPL on them (as stated by GPLv2 sec 2), even if they are necessary to compile and run the system? If so, I know I am bound only by the original licenses of each one, and than I know what to do.

share|improve this question
Just to be sure everyone will understand the answers, I originally have made 3 questions, and than resumed into one. The questions were 1) Can I release a package with only the binaries of code I wrote, not including the libraries, and distribute only the source code I wrote? 2) Can I release a package with all the binaries, including the libraries, and distribute only the source code I wrote? 3) Can I release a package with all the binaries, including the libraries, and distribute only the source code I wrote plus the source code of the libraries licensed under the LGPL license? – Luciano Silveira Nov 1 '13 at 16:36

4 Answers 4

up vote 5 down vote accepted

For the most part, the GPL v2 and LPGL v2 and v2.1 require that, if you distribute GPL'ed or LGPL'ed code, you also make the source code available yourself. With a few exceptions, pointing to an upstream repository is not sufficient. See section 3 of the GPL v2 and section 6 of the LGPL v2.1. (Version 3 of the GPL and LGPL ease this restriction and permit pointing people to third-party servers; see section 6 of the GPL v3.)

So #1 and #3 are okay; #2, not so much.

Update: A few additional notes:

  • In practice, if you simply point people to third-party servers, most people won't care. Complaints have occurred, though; several years ago, the FSF contacted several Linux distros for not making source available. Slashdot and covered this.
  • If the libraries are distributed under "LGPL v2 / v2.1 or later," then I believe that distributing library binaries but not the source would be okay, as long as you point people to the source, since LGPL v3 allows that.
  • In my own experience, I've found it simplest to just make the source for everything available, rather than trying to track the details of when I do and don't have to distribute things.

In response to your edit: Sections 5 and 6 of the LGPL specifically cover creating "a work that uses the Library." Based on my understanding, it's fine to distribute your work as GPLv2 or later without applying the GPL to the libraries. (Your source code itself is not a derivative of the libraries, so the LGPL doesn't directly apply to your source code, and section 6 allows the resulting binary to use LGPL'ed libraries as long as the license terms are compatible.)

Standard disclaimers apply, I am not a lawyer, etc.

share|improve this answer

In general, if your application depends on those libraries to work, you must license the entire application as GPL. Since the libraries are already distributed under GPL, the source code for those libraries should already be publicly available, so in theory you shouldn't need to redistribute the source code for those libraries yourself. The GPL concerns itself mostly with making your code public (including any modifications you made to the libraries), not code that is already public anyway.

There are a few caveats, however; the most important one is that the version of the library that your application works with might not be the same one that is in general distribution, either because you modified it, or it has been modified by the original developers since you incorporated it in your application. Consequently, it is more convenient for developers to have the entire body of actual code that is in use available in the project that you distribute, rather than going to several disparate places in an attempt to re-create the entire project, which might not even compile now.

share|improve this answer
This is actually quite uncommon. Most GPL'ed systems do not distribute the source code of the (L)GPL'ed libraries they use, regardless of whether they distribute the binaries. – Ross Patterson Oct 31 '13 at 21:23
[shrug] Perhaps it's just a convenience issue, then. I've tried a couple of times to collect together the source code for a build, and unless the application owner provides a complete source repository (which sometimes they do), it's generally a pain in the ass. – Robert Harvey Oct 31 '13 at 21:38
None of the libraries are already distributed under GPL, but some are under LGPL, so I can use other license for my project if I want to. And even if my entire system depends on some library, in principle I'm not enforced to distribute the library as we can conclude with this faq entry from . The question is more about what are my obligations if I release my system under GPL v2 or later, and what happens if I release the libraries that wasn't under GPL. – Luciano Silveira Oct 31 '13 at 21:46
Both dependency-versions and convenience are not issues here. He uses Maven to handle the dependencies, and MavenCentral holds past versions of the libraries stored in it. As for convenience - Maven handles it as well, and allows developers to fetch all the dependencies - with correct versions! - with a single command. – Idan Arye Nov 1 '13 at 3:00

Standard disclaimer: P.SE isn't the most appropriate place to ask for legal/license advice

1) Yes; 2) Yes; 3) Yes

You are not required to distribute any library code as long as you make it very clearly which libraries and versions you are using AND you did not make any modifications AND (as Ross pointed out) you provide explicit information on where to get the source for those libraries. If anyone wishes to see the source code for those libraries, they can always go to their respective websites and download them from there. What I didn't know and just learned from others on this page (+1 to those answers) is that you are also responsible for making sure that source code accessible based on the information you provide. And if third-party library website goes down, then it becomes YOUR RESPONSIBILITY to find another source or host the source yourself.

However, if you had to modify even a single line of code in a library (under both GPL and LGPL) you must distribute the library code that you modified. The motivation here is that if you are benefiting from using third-party code, the community should in return benefit if you find and fix bugs in that third-party code.

Under GPL you are required to make your own source code available, which looks like you are planning to do already, so you are good there. You do not have to package your source with the binaries, but your binaries distribution should reference a location from where your source code could be downloaded.

share|improve this answer
+1 But strictly speaking, "they can always go to their respective websites and download them from there" is wrong - you have to tell them where to go (ref. GPLv2 sec. 3c). – Ross Patterson Oct 31 '13 at 21:31

While I agree with the other two answers, keep in mind, that you are still in fact on the hook for providing sources to all the dependencies you use.

If you say "grab libBlah2.0" from, and the sources are easy to grab from there, no one is going to give you a hard time. But if shuts down and doesn't host the sources anymore, you are then still responsible for stepping up and making the sources available. Not stepping up in that circumstance is a violation of the terms of the GPL.

Edit: Additionally, not bothering to distribute binaries of the libraries does not get you off the hook. Your project is a derivative work of those libraries, and so you are responsible for providing source to the libraries whether you distribute them as binaries or not, because the GPL/copyright demands so.

share|improve this answer
Version 2 of the GPL and LGPL technically don't permit telling people to grab source from third-party servers. – Josh Kelley Oct 31 '13 at 21:08
@JoshKelley: Where does it say that in the license? – Robert Harvey Oct 31 '13 at 21:12
@RobertHarvey - Looks like I wasn't entirely correct; sorry. GPL (but not the LGPL) permits noncommercial distribution to refer to an upstream source. In general, though, section 3 of GPL v2 and section 6 of LPGL v2.1 require you to "accompany with source," "accompany with a written offer" for the source, or "offer access to copy the source from the same place" (emphasis added). This came up several years ago; some smaller Linux distro variants weren't in compliance because they just pointed to their upstream distros' servers. – Josh Kelley Oct 31 '13 at 21:22
@JoshKelley Nope. GPLv2 section 3c says "You may copy and distribute the Program ... in object code or executable form ... provided that you also do one of the following: ... Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)". The OP is using unmodified libraries, so they're covered. – Ross Patterson Oct 31 '13 at 21:29
GPLv2 sec. 3c just requires you to pass along the same offer you received. If that offer is invalid, that's immaterial. – Ross Patterson Oct 31 '13 at 21:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.