Home / Knowledge hub / Open source licence compliance
Knowledge hub
Open source licence compliance
Meeting the legal terms attached to the open-source code you use.
What it means
Every open-source library comes with a licence, a set of legal terms for how you may use it. Open source licence compliance means knowing which licences your product carries and doing what each one requires. It is a legal and business matter more than a technical one.
Licences differ. Permissive ones, such as MIT and Apache 2.0, mostly ask you to keep a notice. Copyleft ones, such as the GPL, can require you to share your own source under the same terms when you distribute software that includes theirs.
Why it matters
A licence problem can block a sale or a funding round. Buyers and investors ask for a list of components during due diligence, and a hidden copyleft licence can force a rewrite or a legal dispute. These are expensive surprises, and they usually surface late.
The AGPL goes further than most. Its terms can apply when users interact with the software over a network, so a hosted product is not automatically outside its reach. This is why the check belongs in your build process and not in a yearly spreadsheet.
How it shows up
Compliance starts with an inventory. A software bill of materials in SPDX or CycloneDX format records components and their licences. Scanners read it and flag licences your policy does not allow. Run the check in the build so a new licence is caught the day it is added, not at the next audit or sale.
Typical mistakes are checking only direct dependencies, forgetting container image contents, copying code snippets from the web, and not keeping the required notices in the product. Agree a list of allowed licences, check on every build, and ask a lawyer about the grey cases. This is not legal advice.
Questions people ask
Open source licence compliance, answered
Is open source free of obligations?
No. Open source means the source is available under a licence, and the licence has terms. Some only ask for credit, others set conditions on how you share your own code.
Free to use does not mean free of conditions.
What is the difference between permissive and copyleft?
Permissive licences let you use the code in closed products if you keep the notice. Copyleft licences require changes or combined works to be shared under the same or a compatible licence in certain cases.
Which cases apply depends on the licence and how you use the code.
Does using GPL code in a web app force us to share our code?
For the standard GPL, the conditions are generally triggered by distributing software, and serving a web app is usually not distribution. The AGPL was written to cover network use.
Take legal advice on your actual case.
How does an SBOM help with licences?
An SBOM lists every component with its version and licence, so you can check them against your policy.
Without the list, you only learn about a problem when someone else finds it.
Who should own licence compliance?
Usually legal and engineering together. Engineering keeps the inventory and the build checks. Legal decides which licences are acceptable.
Name an owner, or it will not be done. Review the list every release.
Sources
Where this comes from
Related
Terms that sit next to this one
SBOM
A list of every component your application includes, with versions.
SPDX
A standard format for listing software components and their licences.
CycloneDX
A standard format for writing an SBOM so tools can exchange it.
Software composition analysis
Inventorying your open-source parts and flagging the ones with known flaws.
SBOM requirement
A customer or regulator asking you to supply an SBOM with your software.
Does your inventory say enough?
Licence terms are a legal question and not something we test. What we can evidence is the security side: which flaws in your application are real, each with proof. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.