You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 4 Next »

Overall information and licence lists

Permissive and copyleft licenses

  • Permissive licences have simple requirements – to credit original work, describe changes, provide disclaimer…
  • Copyleft licences (“reciprocal”, “protective”, “restrictive”, derogatory: “viral”) require the rights to be preserved in derivative works
  • If you use any components (libraries) with copyleft, you are obliged to make derived source code available, which may include the entire product/project!
  • Permissive – do anything
    • MIT – short and simple
    • ISC (OpenBSD) – further shortened equivalent
    • BSD – some versions require to include the disclaimer
    • Apache 2.0 – requires notice of changes, grants licence to patents unless litigating and mentions preservation of trademark rights
  • Weak copyleft – file (library) scope
    • MPL 2.0 – simple, allows static linking and licence variants with additional terms
    • LGPL 2.1 – cleaned text of LGPL 2.0, allows dynamic linking without enforcing copyleft
    • LGPL 3.0 – grants use of patents; the end-user must be able to install a modified version – it prohibits closed devices, DRM or hardware encryption or patents retaliation; compatible with Apache2.0
  • Strong copyleft – project scope
    • GPL 2.0 – often used
    • GPL 3.0 – grants use of patents, the end-user must be able to install modified software, compatible with Apache2.0
    • AGPL 3.0 (Affero) – network protective: external use of modified(!) code requires its availability – network use is a distribution of the software, modified source code must be available
  • Proprietary – typically restrict user rights and protect commercial interests of copyright owners

Tabular or per-feature comparisons of licences and categorised lists

Licence compatibility

GPL licences compatibility


A chart illustrating compatibility relationships between different free software licenses. For details, see the FSF's license list page.

(From https://www.gnu.org/licenses/quick-guide-gplv3.html)

  • Arrows are transitive and go from licences of the components toward the one of your project
  • Dotted line – “GPL 2 only” is not compatible with GPL 3”, but ”GPL 2 or later” is
  • AGPL
    • (L)GPL 3.0(+) components can be used, thanks to an explicit GPL rule
    • Code under AGPL cannot be used in (L)GPL projects unless dual-licensed

A more detailed view with precisely stated licences:

Floss license slide, showing connections from public domain to MIT, MIT to BSD-new, BSD-new to Apache and various versions of LGPL, LGPL to GPL, and GPL version 3 to Affero GPL version 3

(From David A. Wheeler 2007, https://web.archive.org/web/20210101030518/https://dwheeler.com/essays/floss-license-slide.html, SVG variant: https://en.wikipedia.org/wiki/License_compatibility#/media/File:Floss-license-slide-image.svg)

Dual and multi-licensing

  • Dual and multi-licences help in avoiding licence compatibility issues, which makes the use of components more flexible
  • Dual and multi-licences help in avoiding licence compatibility issues, which makes the use of components more flexible
  • You can choose a licence compatible with the one used for your software. But you cannot dual-licence your software to match some components with one and others with another licence. Licences of all used components must be compatible with all of your licences!
  • “Or later”(often as “+”) licenses variants just imply the applicability of later, possibly still non-existing, versions of these licences. This is sometimes implied unless you explicitly decline it.
  • Some licences include automatic relicensing (MPL 2.0, EUPL 1.2, CeCILL) – EUPL comes with the full and exhaustive list…

License compatibility matrices or checkers

Joinup Licensing Assistant, https://joinup.ec.europa.eu/collection/eupl/solution/joinup-licensing-assistant/jla-compatibility-checker

License Compatibility Checker software

In-licences (licences of components) are in rows, out-licences in columns:

Licences

(From https://github.com/HansHammel/license-compatibility-checker)

Open Source Automation Development Lab (OSADL) matrix and rules

In-licences are in columns, out-licences in rows:

(From https://events19.linuxfoundation.org/wp-content/uploads/2018/07/OSLS-2019-Fulfilling-Open-Source-license-obligations-Can-checklists-help.pdf)

More at

GNU GPL licences compatibility 

EUPL 1.2

Creative Commons licences

Risks of permissive licences

Risk mitigation against potentially harmful legal threats or behaviours by free-software licenses

Frequently used protective and permissive licenses


AGPLv3

GPLv3

GPLv2.1

LGPLv3

LGPLv2.1

MPL-2

BSD

SaaS/cloud

Yes

No

No

No

No

No

No

Tivoization

Yes

Yes

No

Yes

No

No

No

Patent trolling

Yes

Yes

No

Yes

No

No

No

Proprietization

Yes

Yes

Yes

Partial

Partial

Partial

No

Granularity / reach

Project

Project

Project

Library

Library

File

N/A

Trademark grant

Yes

Yes

?

Yes

?

No

No

(From https://en.wikipedia.org/wiki/Free-software_license)

Licence selection tools

WhiteSource resources

Understanding of licence data and compatibility in WhiteSource

https://whitesource.atlassian.net/wiki/spaces/WD/pages/483786970/Understanding+Risk+Score+Attribution+and+License+Analysis

More on WhiteSource setup assistance, WhiteSource scan analysis and other software review services provided by WP9T2: https://wiki.geant.org/display/GSD/Software+Reviews

Alternative software inventory tools

Ideally, compliance should be continuously monitored as a part of the build process.

Compliance methodology

  • No labels