GPL license Pillow/XZ/FreeType

[CSchulzeTLK]

It seems that pillow wheel on pypi.org lists xz/freetype and therefore GPL as third party license in the pypi wheel at least since b8fc734. xz had been added to the winbuild/build_prepare.py.

Judging from the wheel license file alone, I have to assume, that latest versions of pillow are GPL...

I know that the GPL remark in xz refers to "different files in this package", but there is no statement if they were used or not. And I'm not sure if that is relevant.

XZ Utils Licensing
==================

    Different licenses apply to different files in this package. Here
    is a rough summary of which licenses apply to which parts of this
    package (but check the individual files to be sure!):

      - liblzma is in the public domain.

      - xz, xzdec, and lzmadec command line tools are in the public
        domain unless GNU getopt_long had to be compiled and linked
        in from the lib directory. The getopt_long code is under
        GNU LGPLv2.1+.

      - The scripts to grep, diff, and view compressed files have been
        adapted from gzip. These scripts and their documentation are
        under GNU GPLv2+.

      - All the documentation in the doc directory and most of the
        XZ Utils specific documentation files in other directories
        are in the public domain.

        Note: The JavaScript files (under the MIT license) have
        been removed from the Doxygen-generated HTML version of the
        liblzma API documentation. Doxygen itself is under the GNU GPL
        but the remaining files generated by Doxygen are not affected
        by the licenses used in Doxygen because Doxygen licensing has
        the following exception:

            "Documents produced by doxygen are derivative works
            derived from the input used in their production;
            they are not affected by this license."

      - Translated messages are in the public domain.

      - The build system contains public domain files, and files that
        are under GNU GPLv2+ or GNU GPLv3+. None of these files end up
        in the binaries being built.

      - Test files and test code in the tests directory, and debugging
        utilities in the debug directory are in the public domain.

      - The extra directory may contain public domain files, and files
        that are under various free software licenses.

    You can do whatever you want with the files that have been put into
    the public domain. If you find public domain legally problematic,
    take the previous sentence as a license grant. If you still find
    the lack of copyright legally problematic, you have too many
    lawyers.

    As usual, this software is provided "as is", without any warranty.

    If you copy significant amounts of public domain code from XZ Utils
    into your project, acknowledging this somewhere in your software is
    polite (especially if it is proprietary, non-free software), but
    naturally it is not legally required. Here is an example of a good
    notice to put into "about box" or into documentation:

        This software includes code from XZ Utils <https://tukaani.org/xz/>.

    The following license texts are included in the following files:
      - COPYING.LGPLv2.1: GNU Lesser General Public License version 2.1
      - COPYING.GPLv2: GNU General Public License version 2
      - COPYING.GPLv3: GNU General Public License version 3

The license text used for freetype is not as mentioned here using the custom license text, but rather refers to the "wrapper" suggesting you have to choose between GPL and BSD. The content of the two license files FTL.txt and GPL.txt has been placed below the freetype license. It is not obvious to a reader if the GPL license applies to pillow, or that those two files have been placed after the "wrapper" license text,

===== freetype-2.13.0 ===== 
 
FREETYPE LICENSES
-----------------

The FreeType  2 font  engine is  copyrighted work  and cannot  be used
legally without  a software  license.  In order  to make  this project
usable to  a vast majority of  developers, we distribute it  under two
mutually exclusive open-source licenses.

This means that *you* must choose  *one* of the two licenses described
below, then obey all its terms and conditions when using FreeType 2 in
any of your projects or products.

  - The FreeType License,  found in the file  `docs/FTL.TXT`, which is
    similar to the  original BSD license *with*  an advertising clause
    that forces  you to explicitly  cite the FreeType project  in your
    product's  documentation.  All  details are  in the  license file.
    This license is suited to products which don't use the GNU General
    Public License.

    Note that  this license  is compatible to  the GNU  General Public
    License version 3, but not version 2.

  - The   GNU   General   Public   License   version   2,   found   in
    `docs/GPLv2.TXT`  (any  later  version  can  be  used  also),  for
    programs  which  already  use  the  GPL.  Note  that  the  FTL  is
    incompatible with GPLv2 due to its advertisement clause.

[nulano]

Liblzma is an optional sub-dependency of LibTiff, no other parts of XZ are used.

As stated in the note, FreeType is generally available under the FreeType license, but because that is incompatible with GPLv2, it is dual-licensed under that, so that you can use it in GPLv2 projects also.

FreeType has been included in Pillow wheels for a long time now, nothing has changed with that. Liblzma was omitted for Windows in a few recent releases, but it has also been included in wheels for a long time.

Note also the following from https://pillow.readthedocs.io/en/stable/installation.html#external-libraries:

Pillow wheels since version 8.2.0 include a modified version of libraqm that loads libfribidi at runtime if it is installed. On Windows this requires compiling FriBiDi and installing fribidi.dll into a directory listed in the Dynamic-link library search order (Microsoft Learn) (fribidi-0.dll or libfribidi-0.dll are also detected). See Build Options to see how to build this version.

Pillow wheels can load LGPL-licensed FriBiDi at runtime, but this does not make Pillow wheels fall under LGPL due to the linking exception in LGPL.

[CSchulzeTLK]

Thank you for your valuable feedback.

Is there a part in the documentation, license text or anything else which I can reference, to clarify that only liblzma is used?
I couldn't find anything helpfull in http://www.libtiff.org/ or https://pillow.readthedocs.io/en/stable/. I just found the macro activating the LZMA support in the build script.

[nulano]

On Windows, only the liblzma target is built:

Pillow/winbuild/build_prepare.py

Lines 154 to 166 in 4f7070e

	"xz": {
	"url": SF_PROJECTS + "/lzmautils/files/xz-5.4.2.tar.gz/download",
	"filename": "xz-5.4.2.tar.gz",
	"dir": "xz-5.4.2",
	"license": "COPYING",
	"build": [
	*cmds_cmake("liblzma", "-DBUILD_SHARED_LIBS:BOOL=OFF"),
	cmd_mkdir(r"{inc_dir}\lzma"),
	cmd_copy(r"src\liblzma\api\lzma\*.h", r"{inc_dir}\lzma"),
	],
	"headers": [r"src\liblzma\api\lzma.h"],
	"libs": [r"liblzma.lib"],
	},

Either way, as noted in the XZ readme you quoted above, liblzma is the only library part of xz, everything else are scripts and binary tools, nothing that could end up being included in another library.

[CSchulzeTLK]

Thank you for your support.

[buildqa]

It's not clear to me if the above applies w.r.t how Anaconda miniconda installs Pillow for Linux and MacOS. The Pillow LICENSE.txt file installed by miniconda includes the freetype 2 notice (with choice of license). However, the libzlma notice portion states: (1) xz, xzdec, and lzmadec command line tools are in the public domain unless GNU getopt_long had to be compiled and linked in from the lib directory. The getopt_long code is under GNU LGPLv2.1+; (2) The build system contains public domain files, and files that are under GNU GPLv2+ or GNU GPLv3+. None of these files end up in the binaries being built.

Wondering if there is a way to verify for (1) that getopt_long has not been built info the 10.0.0 version of Pillow installed by miniconda. I assume that (2) is not an issue that would GPL encumber distributing a miniconda image with Pillow installed.

[radarhere]

You can see a list of the wheels that Pillow distributes at https://pypi.org/project/Pillow/#files. In my limited understanding, I don't think that conda pulls from there, but instead uses wheels created by https://github.com/conda-forge/pillow-feedstock. So you may wish to go there to ask after their build process.