Open source license compliance

This page is general information, not legal advice. For decisions about a specific product, talk to a lawyer.

Types of open source licenses

Type	Examples	What it usually asks
Permissive	MIT, BSD, Apache-2.0	Keep the copyright and license notices. Apache-2.0 also has patent terms.
Weak copyleft	LGPL, MPL-2.0	Share changes to the licensed component itself
Strong copyleft	GPL-2.0, GPL-3.0	Software distributed with it must be offered under the same terms, with source
Network copyleft	AGPL-3.0	As strong copyleft, and it also applies when users interact with the software over a network
Source-available	BUSL, SSPL	Not open source: the source is visible, but use is restricted

What is a copyleft license?

A copyleft license lets you use, change and share software, on the condition that what you distribute stays under the same terms. It keeps open source open. The risk for a commercial product is that a strong copyleft component linked into your code can raise the question of whether your own code must be released too.

Whether that applies depends on how the component is used and how the product is delivered. Software you distribute to customers is more exposed than an internal tool, and a SaaS product usually avoids GPL distribution terms but not those of the AGPL.

Common compliance risks

• Transitive licenses. A permissive package can depend on a copyleft one. Checking only direct dependencies misses this.
• Missing notices. Most licenses ask you to keep attribution, and a forgotten notices file is the most common failure.
• Changed licenses. A project can relicense in a new version, so an upgrade can change your terms.
• Declared vs actual. A package's metadata can be wrong or incomplete, and vendored code may carry its own license.
• Due diligence. Acquirers and large customers ask for a license inventory, usually at short notice.

How to stay compliant

1. Write a policy. Decide which licenses are allowed, which need review and which are banned, by type of product.
2. Build an inventory. An SBOM lists each component with its license, including transitive dependencies.
3. Check automatically. Enforce the policy in CI, so that a new dependency fails at the point it is added rather than in an audit.
4. Meet the obligations. Generate notices files and provide source where a license requires it.
5. Keep the records. Store the inventory per release, because the question is usually about a version you already shipped.

What license compliance software does

License compliance is a standard part of software composition analysis. Tools identify components, report their licenses and flag violations of your policy. They differ in depth:

• Declared licenses: most tools read what each package declares in its metadata. This is fast and covers the common case.
• Deep license scanning: FOSSA and Black Duck also analyze license text in the code, and help with attribution reports and legal review. See CRACI vs FOSSA and CRACI vs Black Duck.
• Free tools: many SBOM generators and SCA scanners report declared licenses at no cost. See the best SCA tools.

Where CRACI fits

CRACI handles declared licenses in the build. As your GitHub Actions runner, it records every package a job pulls in, and each one carries its declared license, so copyleft licenses are caught before they end up in the product. License policy rules can block a build on a license, and SBOM exports in CycloneDX and SPDX include each component's declared license. CRACI works from what packages declare, so if you need legal review workflows or license text analysis, use a specialist tool next to it.

Open source license compliance: frequently asked questions

What is open source license compliance?

It means knowing which open source licenses apply to the software you use and meeting their conditions, such as keeping notices or sharing source code.

What is a copyleft license?

A license that lets you use and change software on the condition that what you distribute stays under the same terms. The GPL is the best-known example.

Can you use GPL code in commercial software?

Yes, but if you distribute software that includes it, you may have to offer that software's source under the GPL. How the code is combined matters, so get legal advice for your case.

Does copyleft apply to SaaS?

The GPL's terms are generally triggered by distribution, which SaaS usually avoids. The AGPL closes that gap by extending the conditions to users who interact with the software over a network.

What is the safest open source license for commercial use?

Permissive licenses such as MIT, BSD and Apache-2.0 ask the least. You still need to keep their notices.

How do you check the licenses of your dependencies?

Generate an SBOM that includes transitive dependencies and declared licenses, or use an SCA tool. Enforce your policy in CI, so that new violations fail the build.