I have been assigned to audit third-party dependencies for one of my company's products to make sure we aren't in danger of running afoul of any licenses. This is probably a job for a lawyer, but such is life when you work at a small company.
At my company, we are using CS2J, an open-source project, to translate C# to Java. CS2J is itself MIT-licensed, and we use it in two ways. First, we use it as an internal tool to translate our source code from one language to another. Second, it comes with a support library (a jar file) that the translated files reference. We package this support library with our main distribution.
It turns out that the support library depends on JavaMail, a GPL-licensed product. (There's technically another license option, but it has the same copyleft clause.) I believe at one time it had something other than a GPL license, but that is no longer the case.
We had been planning on to ship the support library (CS2JSupport.jar) and JavaMail (mail.jar) as its dependency. I have a few questions:
- Is CS2J allowed to be licensed under the MIT license in the first place if it's distributed with a GPL dependency?
- If we are shipping mail.jar as a dependency of our dependency, does that mean the copyleft applies to us? Or does it just apply to CS2J?
- We have a close relationship with the CS2J author. If we asked the CS2J author to make available a CS2JSupport.jar that had mail.jar included inside the jar, then is CS2JSupport simply a derivative work of mail.jar? And since the derivative work is covered under the MIT license instead of the GPL license, would that exempt my company from the copyleft even if we wouldn't be exempt in the situation described in #2?