Licenses are confusing. I'm reading about the AGPL, and it sounds like it's saying you must release your source code to anyone who has access to your binaries if you write code that modifies the software using the AGPL license (this is how MPL works?). Then I'm reading you must make the source of anything you write that depends on unmodified AGPL code available to all users of your code.

Then we have the sketchy iText code. The maven repo says iText v2.1.7 is licensed under MPL 1.1, version 4.2.0 under MPL 2.0 with an added LGPL 3.0, and v4.2.2 they switched to AGPL. Now they say on their website you can use their binary code as is for your own app only if you make your source available to all your users or pay them an annual fee. They claim they had to switch to the license because their original MPL license was illegal, so while technically v2.1.7 is still available claiming MPL license, use it at your own risk.

Now we have jasperreports using LGPL and including iText v2.1.7, and dynamicreports using jasperreports. So if you scroll down the maven repo page for jasperreports it shows iText using AGPL license even though it's on v2.1.7, and if you scroll down the dynamicreports repo page it doesn't show any AGPL. Now, if a company wants to use dynamicreports, do they need to pay for iText licensing?

Do you need to pay to use any version of iText, or disclose your own custom source) if you're using their binaries unmodified, developing an app for a business for a contract exclusive to another business, where the sole users of the app will be members of that business?

On 11/8/2022 9:00 AM, e.d.pro...@gmail.com wrote:
> Licenses are confusing. I'm reading about the AGPL, and it sounds
> like it's saying you must release your source code to anyone who has
> access to your binaries if you write code that modifies the software
> using the AGPL license (this is how MPL works?). Then I'm reading you
> must make the source of anything you write that depends on unmodified
> AGPL code available to all users of your code.
>
> Then we have the sketchy iText code. The maven repo says iText v2.1.7
> is licensed under MPL 1.1, version 4.2.0 under MPL 2.0 with an added
> LGPL 3.0, and v4.2.2 they switched to AGPL. Now they say on their
> website you can use their binary code as is for your own app only if
> you make your source available to all your users or pay them an
> annual fee. They claim they had to switch to the license because
> their original MPL license was illegal, so while technically v2.1.7
> is still available claiming MPL license, use it at your own risk.
>
> Now we have jasperreports using LGPL and including iText v2.1.7, and
> dynamicreports using jasperreports. So if you scroll down the maven
> repo page for jasperreports it shows iText using AGPL license even
> though it's on v2.1.7, and if you scroll down the dynamicreports repo
> page it doesn't show any AGPL. Now, if a company wants to use
> dynamicreports, do they need to pay for iText licensing?
>
> Do you need to pay to use any version of iText, or disclose your own
> custom source) if you're using their binaries unmodified, developing
> an app for a business for a contract exclusive to another business,
> where the sole users of the app will be members of that business?

I am not a lawyer, so take this with a huge disclaimer.

There are 3 fundamental types of open source licenses:
* permissive (Apache, MIT, BSD etc.)
* weak copy left (LGPL, GPL with linking exception, MPL etc.)
* strong copy left (GPL, AGPL)

With permissive licenses you can freely mix the open
source and your proprietary code. There may be a requirement
to mention the open source and its license, but that should
not be a problem.

With weak copy left there is a divide - you have
one bucket of proprietary code and another bucket of
open source code. The open source code and whatever
modifications you make to it must stay under the open
source license.

With strong copy left everything combined incl. your
code comes under the open source license. Combined
means linking or referencing. So you cannot keep your
code proprietary and link with open source under a
strong copy left license.

Within each license there are small variations.

LGPL requires that a problem using a LGPL library is
linked in a way so the library can be updated independently
of the program. Not a problem in Java, but for native code
that means dynamic linking.

GPL only matters if you distribute your code - for internal
use there is no impact.

AGPL matters if you either distribute your code or
expose it to other as a service (SaaS model).

If you use N open source pieces then you obviously need
to comply with each of the N licenses.

Lots of software is under MPL including FireFox,
H2, RabbitMQ and LibreOffice. MPL is perfectly legal.

The problem with MPL 1.x is that it per FSF is
incompatible with GPL - you cannot mix MPL 1.x software
and GPL software due to conflicting license requirements.
That was "fixed" in MPL 2.0, so it can be mixed with GPL.

Arne

> There are 3 fundamental types of open source licenses:
> * permissive (Apache, MIT, BSD etc.)
> * weak copy left (LGPL, GPL with linking exception, MPL etc.)
> * strong copy left (GPL, AGPL)
>
It appears with LGPL you can make a closed source product and the code of your dependency must be available somewhere, no special requirement when you're not modifying their code.
With AGPL it appears if you use their library, you must make all your source available to all users of your app when you're using the dependency unmodified, that the AGPL states this requirement for when you're modifying the third party code apparently includes using it as a dependency as a modification. The only way around this is to write something using the third party code that runs independently of your main app code, where your app is viable without that piece.

In comes iText to confuse it as they change their license from version to version.
So they claim they illegally used the MPL license, so you can use that version of their code at your own risk.
https://kb.itextpdf.com/home/it5kb/faq/can-itext-2-1-7-itextsharp-4-1-6-or-earlier-be-used-commercially#:~:text=LEGAL%20REASONS%3A%20Older%20versions%20of,cases%20as%20of%20version%205.1.
v2.1.7 lists MPL 1.1
v4.2.0 lists LGPL 3.0
v4.2.2 lists AGPL 3.0
So the first question is can you use 2.1.7, or 4.2.0 in a closed source product (app runs over 'web' using private network, all users authenticated and belong to one business entity), and what does that mean legally if you use dynamic reports (https://mvnrepository.com/artifact/net.sourceforge.dynamicreports/dynamicreports-core/6.12.1) which uses jasper reports (https://mvnrepository.com/artifact/net.sf.jasperreports/jasperreports/6.12.2) which uses iText 2.1.7?
Second question can we assume iText is legal under LGPL license, and use up to v4.2.1, including openpdf which is a fork of 4.2.0?

> There are 3 fundamental types of open source licenses:
> * permissive (Apache, MIT, BSD etc.)
> * weak copy left (LGPL, GPL with linking exception, MPL etc.)
> * strong copy left (GPL, AGPL)
>
One other thing I don't understand, if code is licensed to AGPL meaning no one can use it without exposing the source of their product to all users of their product, how can that same code also be sold for use in closed source?

On 11/9/2022 7:53 AM, e.d.pro...@gmail.com wrote:
>> There are 3 fundamental types of open source licenses: * permissive
>> (Apache, MIT, BSD etc.) * weak copy left (LGPL, GPL with linking
>> exception, MPL etc.) * strong copy left (GPL, AGPL)
>>
> One other thing I don't understand, if code is licensed to AGPL
> meaning no one can use it without exposing the source of their
> product to all users of their product, how can that same code also be
> sold for use in closed source?

The copyright owner can license the code to anyone on whatever
terms - and it does not need to be the same license for everybody.

If you write some brilliant software, then you can
sell it to me on commercial terms for 100 dollars
and give it to your neighbor on an open source license.

That open source license gives your neighbor the right
to give his brother a copy under the same license.
But because he does not own copyright, then he
can not pass it on under another license. That
privilege would be yours as copyright owner.

Arne

On 11/9/2022 7:21 AM, e.d.pro...@gmail.com wrote:
>> There are 3 fundamental types of open source licenses: * permissive
>> (Apache, MIT, BSD etc.) * weak copy left (LGPL, GPL with linking
>> exception, MPL etc.) * strong copy left (GPL, AGPL)
>>
> It appears with LGPL you can make a closed source product and the
> code of your dependency must be available somewhere, no special
> requirement when you're not modifying their code.

The LGPL library must be independently upgradeable.

> With AGPL it
> appears if you use their library, you must make all your source
> available to all users of your app when you're using the dependency
> unmodified, that the AGPL states this requirement for when you're
> modifying the third party code apparently includes using it as a
> dependency as a modification. The only way around this is to write
> something using the third party code that runs independently of your
> main app code, where your app is viable without that piece.

You can use the AGPL code with your code for your self or internal
in your organization.

But if you distribute your code or make your code available
as SaaS then the users has the right to not only the original
AGPL code but also to your code under AGPL. And if you do not
comply with that, then you have no right to use the original
AGPL code.

Arne

On Wednesday, November 9, 2022 at 2:34:18 PM UTC-5, Arne Vajhøj wrote:
> If you write some brilliant software, then you can
> sell it to me on commercial terms for 100 dollars
> and give it to your neighbor on an open source license.
>
> That open source license gives your neighbor the right
> to give his brother a copy under the same license.
> But because he does not own copyright, then he
> can not pass it on under another license. That
> privilege would be yours as copyright owner.
>
> Arne
I see, so them publishing their software with a license doesn't mean that software is tied to that license.
I don't know if there is a license for the other options or they just make up their own custom license agreement, it doesn't say what other licensing applies to the paid version.
So if you get itext for free, you use the latest version under the AGPL license. If you pay for it, you get some other custom license that says you can use the code in closed source, and can't share it with anyone else, and have to keep paying annually to renew.

On 11/9/2022 2:42 PM, e.d.pro...@gmail.com wrote:
> On Wednesday, November 9, 2022 at 2:34:18 PM UTC-5, Arne Vajhøj wrote:
>> If you write some brilliant software, then you can
>> sell it to me on commercial terms for 100 dollars
>> and give it to your neighbor on an open source license.
>>
>> That open source license gives your neighbor the right
>> to give his brother a copy under the same license.
>> But because he does not own copyright, then he
>> can not pass it on under another license. That
>> privilege would be yours as copyright owner.

> I see, so them publishing their software with a license doesn't mean that software is tied to that license.

Correct.

The copyright owner can issue whatever license he/she wants.

Some open source projects require contributors to sign over copyright
to the project. That makes it a lot easier to change the open source
license for the project. Instead of having every contributor
to agree on relicensing then the project can do it.

> So if you get itext for free, you use the latest version under the
> AGPL license. If you pay for it, you get some other custom license
> that says you can use the code in closed source, and can't share it
> with anyone else, and have to keep paying annually to renew.
I assume that would be a standard commercial license like the one you
get when you buy MS Office from Microsoft or Oracle DB from Oracle.

Arne

On Wednesday, November 9, 2022 at 2:38:40 PM UTC-5, Arne Vajhøj wrote:
> > It appears with LGPL you can make a closed source product and the
> > code of your dependency must be available somewhere, no special
> > requirement when you're not modifying their code.
> The LGPL library must be independently upgradeable.
Obviously if you add someone else's library as a dependency, it's not upgradeable as your dependency without possibly modifying your code, but you could share just that code as is and they can modify it in the repo you got it from.

> You can use the AGPL code with your code for your self or internal
> in your organization.
>
> But if you distribute your code or make your code available
> as SaaS then the users has the right to not only the original
> AGPL code but also to your code under AGPL. And if you do not
> comply with that, then you have no right to use the original
> AGPL code.
>
> Arne
I take that to mean if you write code for an organization, a web app accessible only to members of that organization, any member of that organization could request your source.
Technically that sounds like any member of that organization could then publish that source with an AGPL license, but that would sound problematic if they all signed NDAs.

On Wednesday, November 9, 2022 at 2:50:15 PM UTC-5, Arne Vajhøj wrote:
> The copyright owner can issue whatever license he/she wants.
>
Now, once they've released that code, that license should have to stick with that version.
That just leaves the other 2 questions.
Is the iText LGPL license valid on v4.2.0 (and thus acceptable on the openpdf project)?
Is the iText MPL license invalid on v2.1.7, and does that invalidate (not legal) every project that depends on it, particularly jasperreports/dynamicreports?

On 11/9/2022 2:51 PM, e.d.pro...@gmail.com wrote:
> On Wednesday, November 9, 2022 at 2:38:40 PM UTC-5, Arne Vajhøj wrote:
>>> It appears with LGPL you can make a closed source product and the
>>> code of your dependency must be available somewhere, no special
>>> requirement when you're not modifying their code.
>> The LGPL library must be independently upgradeable.

> Obviously if you add someone else's library as a dependency, it's not
> upgradeable as your dependency without possibly modifying your code,
> but you could share just that code as is and they can modify it in
> the repo you got it from.
If you have yourapp.jar that depend on somelgpllib.jar, then
the somelgpllib.jar can be updated independently of yourapp.jar.

If somelgpllib has made incompatible changes then it may
no longer work, but that is not your problem. You have
complied with the LGPL requirement - the end user can
upgarde somelgpllib.jar - it is their responsibility to
only upgrade to a version that works.

>> You can use the AGPL code with your code for your self or internal
>> in your organization.
>>
>> But if you distribute your code or make your code available
>> as SaaS then the users has the right to not only the original
>> AGPL code but also to your code under AGPL. And if you do not
>> comply with that, then you have no right to use the original
>> AGPL code.

> I take that to mean if you write code for an organization, a web app
> accessible only to members of that organization, any member of that
> organization could request your source. Technically that sounds like
> any member of that organization could then publish that source with
> an AGPL license, but that would sound problematic if they all signed
> NDAs.
Traditionally an org is considered a single legal entity. The org
use it internally. No problem. All the rules apply when the code
is used by someone outside the org.

Arne

On 11/9/2022 2:55 PM, e.d.pro...@gmail.com wrote:
> On Wednesday, November 9, 2022 at 2:50:15 PM UTC-5, Arne Vajhøj wrote:
>> The copyright owner can issue whatever license he/she wants.
>>
> Now, once they've released that code, that license should have to stick with that version.

Whoever got it under a certain license got it under that license.

> That just leaves the other 2 questions.
> Is the iText LGPL license valid on v4.2.0 (and thus acceptable on the openpdf project)?

OpenPDF is under LGPL itself so I would assume so. Why would it not?

> Is the iText MPL license invalid on v2.1.7, and does that invalidate
> (not legal) every project that depends on it, particularly
> jasperreports/dynamicreports?
Per FSF then MPL 2.0 is compatible with GPL and LGPL while MPL 1.x
is not GPL compatible - they do not mention LGPL but I assume
non-compatible with that as well.

If this is important for you then you should really consult
a lawyer that specializes in open source licenses to
get real legal advice.

Arne