Weak copyleft for libraries. Your own code can stay closed as long as users can swap in their own build of the library. Static linking makes relinking costly.
On this page
What it does
The LGPL is the GPL with one large relaxation: a program may use the library without becoming GPL itself. The price is replaceability. Whoever receives your program has to be able to swap in their own build of the library, and section 6 is where that is written down. Copyleft here means the license requires changes to the library itself to go back out under the same license, while your own separate application code is untouched. You will meet LGPL-2.1 on glibc, GTK and FFmpeg's core, so it usually arrives as a compiled native library rather than as source you edit.
Details
How your product reaches people decides everything here. A hosted service that never hands out a binary carries no source duty, because the LGPL has no network clause. Ship a desktop app, a mobile app, firmware, or an SDK that other developers embed, and two duties wake up. The library's source has to be obtainable, and the recipient has to be able to relink your program against a changed version. Static linking, where the library is compiled into your binary, is what makes that second duty expensive. Lawyers still disagree on whether dynamic linking creates a combined work at all. Take a high-stakes case to counsel.
Pros
- You can link the library from closed code in the way the license describes.
- File-level reciprocity is easier to isolate than GPL-style whole-work copyleft.
Cons
- Vendoring or statically linking can pull more of your tree into the covered set than a dynamic link would.
- The source-offer duty is real the moment you distribute binaries that include modified covered files.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Patent use
These licenses typically include a patent grant covering the licensed files. Read the grant before relying on it in a high-stakes deal.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Open your product
File- or library-scoped copyleft does not, on its face, force you to open your entire application. Reciprocity stays on the covered files.
Obligations
Include copyright
Keep copyright notices on the covered files you distribute.
Include license
Keep the license text with the covered files, and say that those files are under this license.
Disclose source
Source for the library, including your modifications to it, has to be available to people who received a binary.
Keep replaceable
Recipients must be able to swap in their own build of the library. Dynamic linking is the usual path. Static linking means you also hand over a way to relink.
What LGPL-2.1-or-later requires when you ship
When you distribute a binary that includes LGPL-2.1-or-later code, notice still travels with the copy, and the corresponding source has to be available under the same license. Internal use without a copy leaving the company is a different situation. The list below is the shipping work: what a recipient of that binary can demand, and what you record so a buyer can see it.
You are meeting the linking condition when the library loads at run time as a separate file, because the user can then replace that file with their own build.
You are meeting it with static linking only when you also hand over your object files, or another mechanism that lets the user relink the program against a modified library.
You have covered the source duty when every recipient of your binary can get the library's complete source. A URL you publish or a written offer that ships with the download both work.
You are on the right side of section 6 when your own end user terms do not forbid the reverse engineering needed to debug a modified version of the library.
You have handled your own changes when any edit you made to the library itself is published under the LGPL when you distribute it, whether or not you changed its interface.
The duties named in LGPL-2.1-or-later
Notice still travels with the copy. On top of that, LGPL-2.1-or-later names a source duty. These are the conditions in the text. The how-to above is when they become real work.
Include copyright
Keep copyright notices on the covered files you distribute.
Include license
Keep the license text with the covered files, and say that those files are under this license.
Disclose source
Source for the library, including your modifications to it, has to be available to people who received a binary.
Keep replaceable
Recipients must be able to swap in their own build of the library. Dynamic linking is the usual path. Static linking means you also hand over a way to relink.
Things to be aware of
- Teams static-link an LGPL library into a mobile app and ship nothing else. Either switch to a dynamic framework, or publish the object files that let a user relink.
- Teams read weak copyleft as no duties at all. Weak means the duty stops at the library, so find the library's source location before you ship, not after.
- A standard end user agreement bans reverse engineering, which collides with section 6. Carve the LGPL parts out of that wording before legal signs it off.
- Someone patches the library inside a vendored copy and forgets it is a change to LGPL code. Track that copy as a modified component and publish the patch.
What the GNU LGPL v2.1 or later does not do
Search results often flatten GNU LGPL v2.1 or later into a slogan. These are the usual misreads. LGPL-2.1-or-later is a grant with conditions, not a permission to skip the paperwork below.
- LGPL-2.1-or-later does not force you to open your whole application. The reciprocal duty stays on the covered files.
- It is not "permissive with extra paperwork." Change a covered file and ship it, and that file's source has to be available under the same license.
How LGPL-2.1-or-later differs from nearby licenses
These licenses are often confused with LGPL-2.1-or-later, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- LGPL-2.1-or-later
- Weak copyleft for libraries. Your own code can stay closed as long as users can swap in their own build of the library. Static linking makes relinking costly.
- LGPL-2.1-only
- LGPL-2.1-only is library copyleft pinned to version 2.1. Users must be able to replace the library. There is no upgrade to LGPL-3.0.
- LGPL-3.0-or-later
- Weak copyleft written as a delta on GPLv3. Consumer devices also owe installation information for a changed library.
- GPL-2.0-or-later
- GPL-2.0 asks for source when you hand someone a binary. Running it on your own servers triggers nothing. The trigger is shipping a copy, not merely using it.
Common questions about GNU LGPL v2.1 or later
Answers to common questions about what GNU LGPL v2.1 or later requires, when its duties apply, and what evidence belongs with a release.
What is the GNU LGPL v2.1 or later?
The LGPL is the GPL with one large relaxation: a program may use the library without becoming GPL itself. The price is replaceability. Whoever receives your program has to be able to swap in their own build of the library, and section 6 is where that is written down. Copyleft here means the license requires changes to the library itself to go back out under the same license, while your own separate application code is untouched. You will meet LGPL-2.1 on glibc, GTK and FFmpeg's core, so it usually arrives as a compiled native library rather than as source you edit.
What does LGPL-2.1-or-later require when you ship a product?
You are meeting the linking condition when the library loads at run time as a separate file, because the user can then replace that file with their own build. You are meeting it with static linking only when you also hand over your object files, or another mechanism that lets the user relink the program against a modified library. You have covered the source duty when every recipient of your binary can get the library's complete source. A URL you publish or a written offer that ships with the download both work. You are on the right side of section 6 when your own end user terms do not forbid the reverse engineering needed to debug a modified version of the library. You have handled your own changes when any edit you made to the library itself is published under the LGPL when you distribute it, whether or not you changed its interface.
Does hosting a product that uses LGPL-2.1-or-later trigger extra duties?
Hosting alone usually does not trigger the source duty for LGPL-2.1-or-later. Shipping a binary, a container, or an on-prem build does. Notice still travels with any copy you hand over.
Can I keep my application closed if I use LGPL-2.1-or-later?
LGPL-2.1-or-later is library-scoped copyleft. Your application can stay closed if recipients can replace the library with their own build. Static linking makes that expensive. The library itself still ships with corresponding source and notices. Confirm the linking story on the component, then record it.
What is corresponding source for LGPL-2.1-or-later?
Corresponding source is the source a recipient needs to build and run the same binary, including scripts and interface files the license names. Hosting a repository URL can be an offer. The offer has to match what you actually shipped. SourceTrust records that a person on your team confirmed the offer. It does not publish your source and does not host a mirror.
How is LGPL-2.1-or-later different from GNU LGPL v2.1 only?
LGPL-2.1-or-later asks this: Weak copyleft for libraries. Your own code can stay closed as long as users can swap in their own build of the library. Static linking makes relinking costly. GNU LGPL v2.1 only asks this: LGPL-2.1-only is library copyleft pinned to version 2.1. Users must be able to replace the library. There is no upgrade to LGPL-3.0. Open the GNU LGPL v2.1 only page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record LGPL-2.1-or-later for a buyer?
The catalog marks LGPL-2.1 as copyleft, so SourceTrust puts a source offer item on the project checklist when the project ships a Distributed binary or is set to Mixed. An LGPL linking item is added in the Library or SDK, Distributed binary and Mixed contexts. A pure SaaS project sees neither. Neither item is ticked for you: a person on your team confirms each one, and publishing stays blocked until they do. The tick is stored per obligation on the component. Who approved the component, and when, is recorded on the component's approval decision. SourceTrust does not check that you shipped the source or built the relink path.
Where do I record LGPL-2.1-or-later for a buyer?
The catalog marks LGPL-2.1 as copyleft, so SourceTrust puts a source offer item on the project checklist when the project ships a Distributed binary or is set to Mixed. An LGPL linking item is added in the Library or SDK, Distributed binary and Mixed contexts.
A pure SaaS project sees neither. Neither item is ticked for you: a person on your team confirms each one, and publishing stays blocked until they do.
The tick is stored per obligation on the component. Who approved the component, and when, is recorded on the component's approval decision.
SourceTrust does not check that you shipped the source or built the relink path. Read /docs/reviewing-component for the review flow.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.