License question about MIT vs. LGPL and usage restrictions.

[jejacks0n]

Trying to get ruby-vips usage approval through legal, and finding it somewhat frustrating in our discussions. I figured I'd ask here, for the potential benefit of the community.

ruby-vips is MIT, and libvips is LGPL.

We don't allow LGPL licenses in our apps, but there's debate on where our usage falls and understandably legal will always err on the side of conservative, so we've thus far been unable to get approval.

The plan is to use ruby-vips within a Rails app, but since ruby-vips is built using resources within libvips, our proposed usage has been rejected because of the question: "is it MIT or LGPL all the way down?"

We think that's somewhat of a strange question though, since Rails ships (and has shipped) with vips as the default, so does that mean the default Rails setup isn't MIT either? I'm hoping to find some resource, documentation, or legal clarification somewhere that I can share with my legal team to dispute their findings, or alternatively, something that helps me feel like they've made the right call in this instance.

Thanks in advance!

[jcupitt]

Hello @jejacks0n,

LGPL allows free commercial use, there shouldn't be any objections, I'd think. Amazon, apple, booking.com, wikipedia, rails, gatsby, tinder, next.js, etc etc it's a huge list all use libvips without issue. The only obligation is that if you modify the libvips sources and then distribute your new libvips binary, you need to contribute your changes to libvips back to the community (I've simplified a little).

GPL is the one that legal usually get wary of since it can potentially require you to open your own code, depending on how you interpret "distribution". Maybe there's some confusion?

Although libvips is LGPL, you can build it against GPL libraries (for example, poppler for PDF handling) so you'd need to be a bit careful there, depending on who made your libvips binary.

The other potential gotcha I can think of comes with formats like HEIC which are patented. Again, you'd need to think about this.

tldr: libvips itself should be fine and is extremely widely used without issue. You should however consider what sub-libraries your specific libvips binary has built into it, with PDF and HEIC support being the big ones to look at.

[jcupitt]

... and Rails and Ruby itself are certainly not MIT all the way down. I doubt if any web development ecosystem is! I suspect your legal department are being overly cautious. If they applied their rule consistently you'd not be able to get any work done.