License Complexity
Software licenses grant rights and impose obligations. Understanding your dependencies’ licenses is essential:
MIT/Apache/BSD: Permissive licenses allowing commercial use with minimal restrictions.
GPL: Copyleft licenses requiring derivative works to be open source.
AGPL: Network copyleft requiring open source even for network-accessed software.
Proprietary: Restrictions on use, distribution, and modification.
The Copyleft Trap
Using GPL-licensed code in commercial software creates obligations:
- GPL v2/v3: Derivative works must be open source
- LGPL: Allows proprietary derivatives if the library can be replaced
- AGPL: Even SaaS services are “derivative works” if they use AGPL code
Accidentally using GPL code in proprietary software creates legal exposure. Some companies avoid GPL entirely to eliminate this risk.
License Compatibility
Can you combine licenses? GPL is incompatible with some other licenses. Combining incompatible licenses is legally problematic.
GPL+Proprietary: Usually not compatible. GPL propagates to entire work.
MIT+Apache: Generally compatible; both are permissive.
MIT+GPL: Proprietary+GPL is problematic. Using GPL in proprietary software violates GPL.
Practical Compliance
License auditing: Know what licenses are in your dependencies. Tools like FOSSA and Black Duck automate this.
License approval: Establish policy on which licenses are acceptable. Many companies prohibit GPL.
Documentation: Document which licenses apply to your software and dependencies.
Legal review: For high-risk situations, consult lawyers.
The Business Impact
Licenses affect business strategy:
- Open sourcing: If using permissive licenses, your code can be open source
- Proprietary software: If using GPL, you must open source derivatives or find alternatives
- Acquisition: Investors and acquirers care about license compliance
Enterprise Challenges
Large enterprises with thousands of dependencies face compliance challenges:
- Dependency drift: Over time, dependencies change. Licenses might change.
- Transitive dependencies: Your dependencies have dependencies. All must be tracked.
- Security vs. license: Sometimes avoiding GPL means using older, less secure libraries.
Open Source Perspectives
The open source community debates license choice:
- Permissive advocates: MIT, Apache allow innovation without restrictions
- Copyleft advocates: GPL ensures code remains open and community-driven
Neither is objectively correct; they reflect different philosophies about how software should be shared.
Forward Trends
License proliferation: The number of licenses is growing, creating complexity.
License consolidation: Communities increasingly standardize (Node.js on MIT, Python on PSF license).
SBOM requirements: Regulations increasingly require knowing what’s in your software.
Open source growth: As more projects open source, licensing becomes more important to understand.
Successfully navigating software licensing requires maintaining awareness of your dependencies’ licenses, establishing clear policies about acceptable licenses, and ensuring compliance before licenses create problems.