Redistribution of Graph32.OCX in a VB6 application

Hi Gatlin Le,

Thank you for an awesome answer, it has been very useful.

This is the section of the EULA that I have available (I have boldened the section of 4.1.2 that calls out Graph32.ocx and DbGrid.ocx):

4. DISTRIBUTION REQUIREMENTS; LICENSE RESTRICTIONS. 4.1 General. The SOFTWARE PRODUCT may contain up to three categories of redistributable code, any redistribution of which by you requires compliance with the following terms. 4.1.1. Redistributable Code-Standard. If you are authorized and choose to redistribute Sample Code, Redistributable Code, Limited Use Redistributable Code, Sample Applications, and/or SQL Run-Time Files (collectively, the "Redistributables") as described in Section 3, you agree to: (a) distribute the Redistributables in object code only in conjunction with and as a part of a software application product developed by you using the product accompanying this EULA that adds significant and primary functionality to the SOFTWARE PRODUCT ("Licensed Product"); (b) not use Microsoft's name, logo, or trademarks to market the Licensed Product; (c) include a valid copyright notice on the Licensed Product; (d) indemnify, hold harmless, and defend Microsoft from and against any claims or lawsuits, including attorney's fees, that arise or result from the use or distribution of the Licensed Product; (e) include "Copyright <year> Microsoft Systems Journal" in all Microsoft Systems Journal (MSJ) code used within your program(s); (f) otherwise comply with the terms of this EULA; and (g) agree that Microsoft reserves all rights not expressly granted. You also agree not to permit further distribution of the Redistributables by your end users except: (1) you may permit further redistribution of the Redistributables by your distributors to your end-user customers if your distributors only distribute the Redistributables in conjunction with, and as part of, the Licensed Product and you and your distributors comply with all other terms of this EULA; and (2) in the manner described in Section 4.1.2. 4.1.2 Redistributable Code-Extended Use. Visual Basic, Visual C++, Visual J++, and Visual Studio. If this EULA accompanies any of the Microsoft products listed in the heading of this subsection, you may permit your end users to reproduce and distribute the object code form of certain portions of the SOFTWARE PRODUCT (as listed in REDIST.TXT as "Extended Use Redistributable Code") only in conjunction with and part of a Licensed Product and/or Web page that adds significant and primary functionality to the Extended Use Redistributable Code. (NOTE: The foregoing license grant does not apply to files designated as Dbgrid.ocx and Graph32.ocx). You are authorized to exercise the foregoing rights provided that: (a) you comply with Section 4.1.1, and (b) your end user agrees to: (i) distribute the Extended Use Redistributable Code in object code only in conjunction with and as a part of a software application product developed by them that adds significant and primary functionality to the Extended Use Redistributable Code; (ii) not use Microsoft's name, logo, or trademarks to market the End-User Application; (iii) include a valid copyright notice on the End-User Application; (iv) indemnify, hold harmless, and defend Microsoft from and against any claims or lawsuits, including attorney's fees, that arise or result from the use or distribution of the End-User Application; and (v) not permit further distribution of the Extended Use Redistributable Code by the user of the End-User Application. 4.1.3 Redistributable Code-Limited Use. If you are authorized and choose to redistribute Limited Use Redistributable Code, in addition to the terms of Section 4.1.1, you must also comply with the following (as applicable to the corresponding portions of the SOFTWARE PRODUCT identified in REDIST.TXT as Limited Use Redistributable Code). 4.1.3.1 "Jet" Files. If you redistribute the "Jet Files" (as identified in the SOFTWARE PRODUCT ) you agree to comply with the following additional requirements: (a) your Licensed Product shall not substantially duplicate the capabilities of Microsoft Access or, in the reasonable opinion of Microsoft, compete with same; and (b) unless your Licensed Product requires your customers to license Microsoft Access in order to operate, you shall not reproduce or use any of the Jet Files for commercial distribution in conjunction with a general purpose word processing, spreadsheet or database management software product, or an integrated work or product suite whose components include a general purpose word processing, spreadsheet, or database management software product except for the exclusive use of importing data to the various formats supported by Microsoft Access. Note: A product that includes limited word processing, spreadsheet or database components along with other components which provide significant and primary value, such as an accounting product with limited spreadsheet capability, is not considered to be a "general purpose" product. 4.1.3.2 Microsoft Data Access Components. If you redistribute the Microsoft Data Access Component file identified as MDAC_TYP.EXE, you also agree to redistribute such file in object code only in conjunction with and as a part of a Licensed Product developed by you with a Microsoft development tool product that adds significant and primary functionality to MDAC_TYP.EXE.

The Redist.txt file lists Graph32.ocx and GSWDLL32.dll under the REDISTRIBUTABLE CODE - Extended Use: section, thus we have settled on the grounds that both of these files are redistributable under the standard terms.

The problem I now have is that GSW32.exe is not listed under the redist.txt and is a required support file for Graph32.ocx to work on Windows 10 and later. Regarding the SBOM, if I was using SPDX you would be quite right and I would simply apply NOASSERTION to the component but unfortunately I need to CycloneDX

Hi @Duncan Howe ,

I still cannot confirm redistribution permission for GSW32.exe from the Microsoft documents I found. CycloneDX does let you record the file without asserting a license while that question remains open.

Your excerpt confirms that the Graph32.ocx exclusion is within section 4.1.2's additional end-user redistribution grant. That clarification does not resolve the missing GSW32.exe entry. Being required by Graph32.ocx, or listed in VB6DEP.INI, shows a technical dependency but does not by itself confirm permission to redistribute it.

The next place to check is the license/readme supplied with the package your exact GSW32.exe version came from. If that does not provide an applicable grant, give your licensing reviewer the file's version and source, together with the EULA and REDIST.TXT, so they can seek written clarification from the relevant licensor.

My earlier licenseConcluded: NOASSERTION example was specific to SPDX. For CycloneDX 1.6/1.7 JSON, licenses is optional. You can omit it for this unresolved component and explain the pending review in custom properties, without using NOASSERTION as a license name or ID. This follows the optional license and custom property fields in the CycloneDX schema.

For example, place this entry inside your BOM's components array, replacing acme with your organisation's own namespace:

{
  "type": "file",
  "bom-ref": "gsw32-exe",
  "name": "GSW32.exe",
  "properties": [
    {
      "name": "acme:license-review:status",
      "value": "pending"
    },
    {
      "name": "acme:license-review:note",
      "value": "GSW32.exe is absent from the reviewed REDIST.TXT; redistribution permission has not been confirmed."
    }
  ]
}

These properties are custom metadata, not standard license fields. Avoid internal: here because the CycloneDX property taxonomy reserves it for internal use and advises against including it in BOMs shared with third parties.

Add the actual version and hash, ensure the bom-ref is unique, and link Graph32.ocx to this entry through your BOM's dependencies. Keep the license information already verified for the other components.

I validated a minimal BOM containing this entry against the CycloneDX 1.6 and 1.7 JSON schemas. Your SBOM recipient may require more than the schema does, so check whether their policy accepts unresolved licenses. This records uncertainty, not permission to distribute.

Completing the MSChart replacement you mentioned could remove both GSW32.exe and GSWDLL32.dll from future releases, provided no remaining component needs them and the installer no longer includes them.

Note: the linked CycloneDX website and taxonomy repository are non-Microsoft resources.

If you have any further questions or anything is unclear, just let me know and I'll be happy to help.

Thank you.

@Gatlin Le (WICLOUD CORPORATION)

That is an excellent suggestion and is what I have gone with for now, thank you.

My working assumption is that GSW32.exe was taken from the VB6 ISO rather than an externally provided package so, unless there is something in the ctrlref.hlp file (which I can't open currently) that specifies it, I don't have anything beyond the VB6 ISO content to refer to.

The readme.txt alongside the controls states the following (pertinent bit in bold):

\Tools\Controls This directory contains all of the ActiveX Controls that shipped with Visual Basic 4.0/5.0 Professional and Enterprise Editions, which are no longer shipping with Visual Basic 6.0. AniBtn32.ocx Gauge32.ocx Graph32.ocx Gsw32.EXE Gswdll32.DLL Grid32.ocx KeySta32.ocx MSOutl32.ocx Spin32.ocx Threed32.ocx MSChart.ocx The \Tools\Controls\BiDi directory contains a Bi-directional version of Grid32.Ocx. If you have Visual Basic 5.0 Professional or Enterprise Editions installed on your machine, you should already have these ActiveX controls available to you in Visual Basic 6.0.
Graph32.ocx has been updated to work properly in Visual Basic 6.0 and it requires two additional support files: gsw32.exe and gswdll32.dll. You must place the three files together in the \Windows\System directory or the control will not function properly. If you do not have these controls and wish to use these in Visual Basic 6.0, you can install them by: 1. Copy all of the files in this directory to your \WINDOWS\SYSTEM directory. 2. Register the controls by either Browsing to them in Visual Basic itself, or manually register them using RegSvr32.Exe. RegSvr32.EXE can be found in the \Tools\RegistrationUtilities directory. The command line is: regsvr32.exe grid32.ocx 3. Register the design time licenses for the controls. To do this, merge the vbctrls.reg file found in this directory into your registry. You can merge this file into your registry using RegEdit.Exe (Win95 or WinNT4) or RegEd32.Exe (WinNT3.51): regedit vbctrls.reg (or other reg files associated with the controls)

I'm not sure if this qualifies as implicit permission to freely distribute the files with a licensed Graph32.ocx and the EULA just wasn't updated fully to include both files (it does mention the GSW32DLL.dll).