My client had me code review an Android app built for them by a third party. As part of my review, I checked the licensing terms of the open source libraries that it used. Most were using Apache 2.0 without a NOTICE file. One was using the GNU Lesser General Public License (LGPL).
My client has commercial reasons to avoid Copyleft-style licenses and so I flagged the library as unusable. The supplier understandably was not thrilled about the rework that implied and asked for an explanation and ideally some way to make it work within the license. Looking into it in more detail, I’m convinced that if you share my client’s concerns, then there is no way to use LGPL licensed code on Android. Here’s why I believe this to be the case.
The GNU LGPL
When I first encountered the LGPL years ago, it was explained to me as “the GPL, without the requirement to publish your source code”. The actual license terms turn out to be a bit more restrictive. The LGPL is an add-on to the full GPL that weakens (only) the restrictions to how you license and distribute your work. These weaker restrictions are in section 4.
Here’s how I read that section:
You may convey a Combined Work under terms of your choice that […] if you also do each of the following: a) [full attribution] b) [include a copy of the license] c) [if you display any copyright notices, you must mention the licensed Library] d) Do one of the following: 0) [provide means for the user to rebuild or re-link your application against a modified version of the Library] 1) [use runtime linking against a copy already present on the system, and allow the user to replace that copy] e) [provide clear instructions how to rebuild or re-link your application in light of the previous point]
The LGPL on Android
An Android app can use two kinds of libraries: Java libraries and native libraries. Both run into the same problem with the LGPL.
The APK file format for Android apps is a single, digitally signed package. It contains native libraries directly, while Java libraries are packaged along with your own bytecode into the dex file. Android has no means of installing shared libraries into the system outside of your APK, ruling out out (d)(1) as an option. That leaves (d)(0). Making the library replaceable is not the issue. It may not be the simplest thing, but I’m sure there is some way to make it work for both kinds of libraries.
That leaves the digital signature, and here’s where it breaks down. Any user who replaces the LGPL licensed library in your app will have to digitally sign their modified APK file. You can’t publish your code signing key, so they have to sign with a different key. This breaks signature compatibility, which breaks updates and custom permissions and makes shared preferences and expansion files inaccessible. It can therefore be argued that such an APK file is not usable in lieu of the original app, thus violating the license.
The GNU Lesser General Public License ensures that a user has freedom to modify a so licensed library used by your application, even if your application is itself closed source. Android’s app packaging and signature requirements are such that I believe it is impossible to comply with the license when using an LGPL licensed library in a closed source Android app.