Licensing question

[greghofer]

Hi, I was wondering what license applies to this json library. I see that the main one is the MIT license but there is also a GPL license in the LICENSES folder which I understand applies to some imported code. Does that mean that the GPL license also applies to the whole json library as well? I need to use this in some proprietary code so can't use code that comes with a GPL license. Thanks.

[nlohmann]

The library is licensed with MIT. The other licenses only apply to test scripts. See https://github.com/nlohmann/json/blob/develop/.reuse/dep5 for more information.

[greghofer]

Ok, perfect. Thanks. It works great.

[cschreib-ibex]

We stumbled upon this today at work, and it took us a bit of time to figure out why the GPL license text was there. It isn't mentioned in the README like the other licenses. In fact, the README doesn't mention that the other licenses only apply to test code. It's probably worth clarifying?

[nlohmann]

As I wrote above: see https://github.com/nlohmann/json/blob/develop/.reuse/dep5

GPL only applies to

Files: tests/thirdparty/imapdl/*
Copyright: 2017 Georg Sauthoff <mail@gms.tf>
License: GPL-3.0-only

These files are not part of the release, so they are not listed in the README.

[cschreib-ibex]

Thank you, I did see your message above. To clarify, my comment should have said that /.reuse/dep5 ( a hidden folder with an obscure name) isn't an easy place to discover this information for a human. In contrast, finding the word "GPL" in a /LICENSES folder was much easier, and immediately scary in a commercial setting.

FYI we encountered this using the conan recipe, which greps all files matching LICENSE* to package as licenses for the library. This is probably unintended (or it preceded #3546 and wasn't updated) and should be fixed over there.

Regardless, I would still suggest clarifying the situation here, for others who may follow the same path we have and end up confused. If the root README.md isn't suitable, a short README.md in the LICENSES folder would do just as well.

[nlohmann]

I understand. This is not my top-prio, so pull requests are more than welcome!

[zuiderkwast]

Hi Niels,

I can see that the GPL'ed script is used for code coverage, for filtering the lcov trace output. It's a fairly small script.

However, legal folks in corporations don't always realize this. To them, the mere presence of a GPL license file and GPL code in a repo raises suspicion that the whole project becomes GPL.

To eliminate the confusion, the best solution for us would be if you can simply remove the GPL script from the repo. Perhaps we can find another tool to filter the lcov output?

[nlohmann]

I have not found another script.

To avoid confusion, I also made sure the project is REUSE compliant (https://api.reuse.software/info/github.com/nlohmann/json) which also generates an SBOM - which should allow to make any FOSS checker happy.

The library is used by a lot of people, so I don't worry about misunderstandings due to a GPL-licensed helper script in the repo.