Software Licensing Guides Series

Table of Contents

This page provides an overview of various tools and resources for checking and selecting open source software licences and their compatibility.

Overall information and licence lists

Permissive and copyleft licences

(Based on materials from ORCRO)

Permissive licences have simple requirements – to credit original work, describe changes, provide a disclaimer, etc. Copyleft licences (“reciprocal”, “protective”, “restrictive”, derogatory: “viral”) require the rights to be preserved in derivative works. If you use any components (libraries) with copyleft, you are obliged to make derived source code available, which may include the entire product/project!

  • Permissive – do anything
    • MIT – short and simple
    • ISC (OpenBSD) – further shortened equivalent
    • BSD – some versions require including the disclaimer
    • Apache 2.0 – requires notice of changes, grants a license to patents unless litigating and mentions the preservation of trademark rights
  • Weak copyleft – file (library) scope
    • MPL 2.0 – simple, allows static linking and licence variants with additional terms
    • LGPL 2.1 – cleaned text of LGPL 2.0, allows dynamic linking without enforcing copyleft
    • LGPL 3.0 – grants the use of patents; the end-user must be able to install a modified version – it prohibits closed devices, DRM or hardware encryption or patents retaliation; compatible with Apache 2.0
  • Strong copyleft – project scope
    • GPL 2.0 – often used
    • GPL 3.0 – grants the use of patents, the end-user must be able to install modified software, compatible with Apache 2.0
    • AGPL 3.0 (Affero) – network protective: external use of modified(!) code requires its availability – network use is a distribution of the software, modified source code must be available
  • Proprietary – these licences restrict user rights and protect the commercial interests of copyright owners

Per-feature or tabular comparisons of licences and categorised lists

Licence compatibility

GPL licences compatibility

Arrows are transitive and go from licences of the components toward the licence of your project


A chart illustrating compatibility relationships between different free software licenses. For details, see the FSF's license list page.

(From https://www.gnu.org/licenses/quick-guide-gplv3.html)

Above, per the dotted line, “GPL 2 only” is not compatible with GPL 3”, but ”GPL 2 or later” is. A more detailed view with precisely stated licences:

(From David A. Wheeler 2007, https://web.archive.org/web/20210101030518/https://dwheeler.com/essays/floss-license-slide.html, SVG variant: https://en.wikipedia.org/wiki/License_compatibility#/media/File:Floss-license-slide-image.svg)

On AGPL compatibility:

  • (L)GPL 3.0(+) components can be used in software under AGPL, thanks to an explicit rule in GPL
  • Code under AGPL cannot be used in (L)GPL projects unless dual-licensed

Relationship between most used licences in GÉANT

Following is a graph of licences that are most frequently used in GÉANT projects that were scanned using the Mend tool. It is based on the two previous graphs.

Dual and multi-licensing

  • Dual and multi-licences can help avoid licence compatibility issues, making the use of components more flexible.
  • You can choose a licence compatible with the one used for your software. But you cannot dual-license your software to match some components with one licence and others with another. Licences of all used components must be compatible with all of your licences.
  • “Or later”(often expressed as “+”) licence variants imply the applicability of later, possibly still non-existing, versions of these licences. This is sometimes implied unless you explicitly decline it.
  • Some licences include automatic relicensing (MPL 2.0, EUPL 1.2, CeCILL), while EUPL comes with a full list of licences it can be combined with.

Licence compatibility matrices or checkers

Joinup Licensing Assistant – Compatibility Checker, https://joinup.ec.europa.eu/collection/eupl/solution/joinup-licensing-assistant/jla-compatibility-checker

Licence Compatibility Checker software

In-licences (licences of components) are in rows and out-licences are in columns:

(Source: https://github.com/HansHammel/license-compatibility-checker)

Open Source Automation Development Lab (OSADL) matrix and rules

In-licences are in columns and out-licences are in rows:

(Source:  Meeker, H., & von Wendorff, C. (2019). Fulfilling open source license obligations: Can checklists help?, https://events19.linuxfoundation.org/wp-content/uploads/2018/07/OSLS-2019-Fulfilling-Open-Source-license-obligations-Can-checklists-help.pdf)

More at

GNU GPL licences compatibility 

EUPL 1.2

Creative Commons licences

Risks of licences

Risk mitigation against potentially harmful legal threats or behaviours by free-software licences

Frequently used protective and permissive licenses


AGPLv3

GPLv3

GPLv2.1

LGPLv3

LGPLv2.1

MPL-2

BSD

SaaS/cloud

Yes

No

No

No

No

No

No

Tivoization

Yes

Yes

No

Yes

No

No

No

Patent trolling

Yes

Yes

No

Yes

No

No

No

Proprietization

Yes

Yes

Yes

Partial

Partial

Partial

No

Granularity/reach

Project

Project

Project

Library

Library

File

N/A

Trademark grant

Yes

Yes

?

Yes

?

No

No

(Source: https://en.wikipedia.org/wiki/Free-software_license)

Mend resources

Other software composition analysis (SCA, software inventory) tools

Ideally, compliance should be continuously monitored as a part of the build process.


Commercial SCA tools and services:

OSS tools that perform SCA:

Licence selection tools and resources

Compliance methodology

  • No labels