Overall information and licence lists
Permissive and copyleft licenses
- Permissive licences have simple requirements – to credit original work, describe changes, provide disclaimer…
- Copyleft licences (“reciprocal”, “protective”, “restrictive”, derogatory: “viral”) require the rights to be preserved in derivative works
- If you use any components (libraries) with copyleft, you are obliged to make derived source code available, which may include the entire product/project!
- Permissive – do anything
- MIT – short and simple
- ISC (OpenBSD) – further shortened equivalent
- BSD – some versions require to include the disclaimer
- Apache 2.0 – requires notice of changes, grants licence to patents unless litigating and mentions preservation of trademark rights
- Weak copyleft – file (library) scope
- MPL 2.0 – simple, allows static linking and licence variants with additional terms
- LGPL 2.1 – cleaned text of LGPL 2.0, allows dynamic linking without enforcing copyleft
- LGPL 3.0 – grants use of patents; the end-user must be able to install a modified version – it prohibits closed devices, DRM or hardware encryption or patents retaliation; compatible with Apache2.0
- Strong copyleft – project scope
- GPL 2.0 – often used
- GPL 3.0 – grants use of patents, the end-user must be able to install modified software, compatible with Apache2.0
- AGPL 3.0 (Affero) – network protective: external use of modified(!) code requires its availability – network use is a distribution of the software, modified source code must be available
- Proprietary – typically restrict user rights and protect commercial interests of copyright owners
Per-feature or tabular comparisons of licences and categorised lists
Licence compatibility
GPL licences compatibility
(From https://www.gnu.org/licenses/quick-guide-gplv3.html)
- Arrows are transitive and go from licences of the components toward the one of your project
- Dotted line – “GPL 2 only” is not compatible with GPL 3”, but ”GPL 2 or later” is
- AGPL
- (L)GPL 3.0(+) components can be used, thanks to an explicit GPL rule
- Code under AGPL cannot be used in (L)GPL projects unless dual-licensed
A more detailed view with precisely stated licences:
(From David A. Wheeler 2007, https://web.archive.org/web/20210101030518/https://dwheeler.com/essays/floss-license-slide.html, SVG variant: https://en.wikipedia.org/wiki/License_compatibility#/media/File:Floss-license-slide-image.svg)
Dual and multi-licensing
- Dual and multi-licences help in avoiding licence compatibility issues, which makes the use of components more flexible
- Dual and multi-licences help in avoiding licence compatibility issues, which makes the use of components more flexible
- You can choose a licence compatible with the one used for your software. But you cannot dual-licence your software to match some components with one and others with another licence. Licences of all used components must be compatible with all of your licences!
- “Or later”(often as “+”) licenses variants just imply the applicability of later, possibly still non-existing, versions of these licences. This is sometimes implied unless you explicitly decline it.
- Some licences include automatic relicensing (MPL 2.0, EUPL 1.2, CeCILL) – EUPL comes with the full and exhaustive list…
License compatibility matrices or checkers
Joinup Licensing Assistant, https://joinup.ec.europa.eu/collection/eupl/solution/joinup-licensing-assistant/jla-compatibility-checker
License Compatibility Checker software
In-licences (licences of components) are in rows, out-licences in columns:
(From https://github.com/HansHammel/license-compatibility-checker)
Open Source Automation Development Lab (OSADL) matrix and rules
In-licences are in columns, out-licences in rows:
(From https://events19.linuxfoundation.org/wp-content/uploads/2018/07/OSLS-2019-Fulfilling-Open-Source-license-obligations-Can-checklists-help.pdf)
More at
GNU GPL licences compatibility
EUPL 1.2
Creative Commons licences
Risks of permissive licences
Risk mitigation against potentially harmful legal threats or behaviours by free-software licenses
Frequently used protective and permissive licenses |
| AGPLv3 | GPLv3 | GPLv2.1 | LGPLv3 | LGPLv2.1 | MPL-2 | BSD |
SaaS/cloud | Yes | No | No | No | No | No | No |
Tivoization | Yes | Yes | No | Yes | No | No | No |
Patent trolling | Yes | Yes | No | Yes | No | No | No |
Proprietization | Yes | Yes | Yes | Partial | Partial | Partial | No |
Granularity / reach | Project | Project | Project | Library | Library | File | N/A |
Trademark grant | Yes | Yes | ? | Yes | ? | No | No |
(From https://en.wikipedia.org/wiki/Free-software_license)
Licence selection tools
WhiteSource resources
Alternative software inventory tools
Ideally, compliance should be continuously monitored as a part of the build process.
Compliance methodology
