giesCANne/THIRD-PARTY.md

Third party code and licenses

SavvyCAN's own source is MIT (see LICENSE). This file inventories the third party code that lives in this repository and the third party libraries SavvyCAN links against, because several of them are under other terms.

Bundled in this repository

Component	Files	Copyright	License	Built on
QCustomPlot 2.1.1	qcustomplot.{h,cpp}	2011-2022 Emanuel Eichhammer	GPL-3.0-or-later	all platforms
candle API	connections/candle_api/	2016 Hubert Denkmair, 2026 Schildkroet	LGPL-3.0-or-later	Windows only
qmqtt	mqtt/	2013 Ery Lee	BSD-3-Clause	all platforms
jsedit	jsedit.{h,cpp}	2010-2011 Ariya Hidayat	BSD-3-Clause	all platforms
SimpleCrypt	simplecrypt.{h,cpp}	2011 Andre Somers	BSD-3-Clause	all platforms

License texts: licenses/GPL-3.0.txt and licenses/LGPL-3.0.txt. Those two plus this file and LICENSE are what gets shipped in the release packages. connections/candle_api/LICENSE is the same LGPL-3.0 text, kept inside the vendored directory so that directory stays self contained. The BSD-3-Clause terms are reproduced in the header comment of each file they cover.

LGPL-3.0 is not a standalone license, it is a set of additional permissions on top of GPL-3.0, which is why both texts are needed even for the candle API alone.

Linked at runtime

• Qt 5 — LGPL-3.0 as distributed by the Qt Company for open source use, which is what the official builds and the CI builds in .github/workflows/build.yml use. Linked dynamically, so LGPL-3.0 section 4d1 applies: the Qt libraries ship as separate replaceable shared libraries (Qt5*.dll, the frameworks inside the .app, or the libraries bundled into the AppImage). Qt sources are available from https://download.qt.io/.

What this means for a distributed binary

QCustomPlot is GPL-3.0-or-later and is compiled into the SavvyCAN executable on every platform. A built and distributed SavvyCAN binary is therefore a combined work that has to be conveyed under GPL-3.0 terms, not under the MIT terms alone.

Nothing here conflicts. MIT and BSD-3-Clause are GPL compatible, and LGPL-3.0 code may be used in a GPL-3.0 work. The practical obligation is that the complete corresponding source has to be available to anyone who receives a binary, which it is, at https://github.com/collin80/SavvyCAN and at the fork this build came from.

Using QCustomPlot under its commercial license instead would remove the GPL-3.0 obligation. That is a decision for the project owner, not something this file assumes.

The candle API specifically

connections/candle_api/ is the only LGPL-3.0 code in this tree, it is only compiled into Windows builds, and it exists to talk to gs_usb class adapters (candleLight, CANable, CANnectivity, cantact) over WinUSB. On Linux and macOS those adapters are handled by the kernel gs_usb driver and appear as SocketCAN, so no part of it is built there.

It is statically linked into SavvyCAN.exe, which puts it under LGPL-3.0 section 4d0 rather than 4d1: the corresponding application code has to be conveyed in a form that lets a recipient relink against a modified candle API. Publishing the complete buildable source of the application satisfies that, and the terms it is published under (MIT for SavvyCAN's own code, GPL-3.0 for the combined work) permit the recombination.

Keep those files separable. Do not copy code out of connections/candle_api/ into the MIT licensed parts of the tree. See connections/candle_api/README.md for provenance and the local changes made to it.