Is CC-BY-SA 3.0 compatible with Apache 2.0?

Question

Creative Commons explicitly states that GPL3 is compatible with CC-BY-SA 3.0. However, there is no information on its compatibility with Apache 2.0. Currently, I am hosting Apache licensed content on a CC-BY-SA 3.0 (It's not ideal, I am aware), and want to make sure that I'm not facing any licensing incompatibility. Would sublicencing Apache 2.0 licensed content on CC-BY-SA 3.0 content would cause issues?

Answer 1

They are not directly compatible. Two licenses A and B are compatible if both licenses allow the combination to be covered by licensing terms that don't contradict each other.

Implicit and explicit compatibility.

Sometimes this compatibility is achieved through explicit compatibility paths. E.g. the Creative Commons licenses have license version upgrade clauses, and CC-BY-SA-4.0 is one-way compatible with GPL-3.0.

In other cases this compatibility is achieved implicitly because the license terms don't conflict. For example, the MIT license is compatible with the Apache-2.0 license: all the MIT license requires is that the license notice shall be included in all copies or substantial portions of the software. This can be achieved in an Apache-2.0 licensed software by including the MIT license notice in a NOTICE file. And even without the notice file mechanism the two licenses would be compatible because neither license prevents other components from having different licenses – quite unlike copyleft licenses.

The CC-BY-SA-3.0 is a copyleft license.

In clause 4.b, permissible licenses for Adaptations are listed:

(i) this License;
(ii) a later version of this License with the same License Elements as this License;
(iii) a Creative Commons jurisdiction license (either this or a later license version) that contains the same License Elements as this License (e.g., Attribution-ShareAlike 3.0 US));
(iv) a Creative Commons Compatible License

where

"Creative Commons Compatible License" means a license that is listed at https://creativecommons.org/compatiblelicenses that has been approved by Creative Commons as being essentially equivalent to this License, including, at a minimum, because that license: (i) contains terms that have the same purpose, meaning and effect as the License Elements of this License; and, (ii) explicitly permits the relicensing of adaptations of works made available under that license under this License or a Creative Commons jurisdiction license with the same License Elements as this License.

That website currently mentions that “no non-CC licenses have been designated as compatible with BY-SA 3.0”. It is worth noting that the Apache-2.0 cannot be a Compatible License because Apache-2.0 has no ShareAlike style license element.

The list of allowed licenses for Adaptations is exhaustive. It is not allowed to modify the CC-BY-SA license terms. For example, it is not allowed to add terms that require preservation of additional attribution notices.

Issues with Apache-2.0 to CC-BY-SA-3.0 one-way compatibility.

With this background, we can consider whether Apache-2.0 material could be included in a CC-BY-SA-3.0 work. At first glance, this seems to be the case: section 2 gives permission to sublicense the Apache-2.0 covered material. However, such sublicensing cannot circumvent the conditions of the license. There are many details where I think that the Apache-2.0 terms might be incompatible with CC-BY-SA-3.0. For example:

• The Apache-2.0 license requires a NOTICE file to be preserved, if present. Additionally, Apache-2.0 requires retention of all copyright, patent, trademark, and attribution notices in the Source form of the Work, if it is distributed. This goes far beyond the CC-BY-SA-3.0 concept of attribution in clause 4.c. The CC-BY-SA-3.0 does not allow corresponding license terms to be added (compare discussion of clause 4.b above).
• The Apache-2.0 license includes a patent license along with termination conditions. The CC-BY-SA-3.0 does not discuss patents and arguably has different license termination conditions in clause 7.
• The Apache-2.0 license requires that all recipients of the Work be given a copy of the Apache-2.0 license. The CC-BY-SA-3.0 has no mechanism to preserve a large block of text – it doesn't even expect the CC-BY-SA-3.0 terms themselves to be included.

So it is possible to argue that Apache-2.0 has terms that cannot be fulfilled via the CC-BY-SA-3.0, so that there's no one-way Apache → CC compatibility.

Opposing arguments in favor of Apache-2.0 to CC-BY-SA-3.0 compatibility.

It is possible to make different arguments:

• The attribution requirements are in fact compatible, and the patent clauses don't conflict because CC-BY-SA-3.0 doesn't address patents, whereas the Apache-2.0 patent termination clause only affects patents and not the copyright license. The Apache license copy is not a problem because it can be given as a link, and CC-BY-SA-3.0 attribution can include the preservation of links.
• A specific Apache-2.0 covered work might not have any contributors that hold patents and might only have notices that also fall within the scope of CC-BY-SA-3.0 attribution. Then, there would be one-way compatibility to CC-BY-SA-3.0 for that specific work.

I feel somewhat uncomfortable with those arguments. The safest path is to assume that the licenses are not compatible.

Indirect compatibility via GPL-3.0 is unlikely to help.

Regardless of this discussion of direct compatibility, it is clear that there's an indirect compatibility path:

• Apache-2.0 is one-way compatible with GPL-3.0.
• Adaptations of CC-BY-SA-3.0 material can be licensed under CC-BY-SA-4.0.
• Adaptations of CC-BY-SA-4.0 material can be licensed under GPL-3.0 as it is explicitly recognized as a compatible license.

Thus, CC-BY-SA-3.0 material that has undergone multiple adaptations can be combined with Apache-2.0 covered material, if the combination is covered by the GPL-3.0 license. Unlike the CC-BY-SA licenses, the GPL-3.0 has an “additional terms” mechanism that can be used to smooth over minor differences like specific attribution requirements.

But if the site in question expects content to have a CC-BY-SA-3.0 compatible license in the sense that the content can be used under the terms of the CC-BY-SA-3.0, then this indirect compatibility doesn't help. The CC→GPL compatibility is one-way only, and it is not possible to use GPL material under CC license terms.

Copyright exceptions are worth considering.

Whenever considering license conditions, it can also be a good idea to take a step back and consider whether the licenses even apply. Copyright law typically allows some use of copyrighted material without a license, e.g. fair use in the US.

Such exceptions might apply e.g. if you're not copying large parts of code, but are only reproducing short snippets for discussion/analysis, where your own content clearly dominates. For example, if I were to write a blog post about some internals of the Docker engine, I would feel comfortable quoting short snippets from the Docker source code without fulfilling the Apache-2.0 license conditions.

But whether it would be appropriate to rely on such exceptions depends on the specific laws in your jurisdiction and the jurisdiction of the site you're submitting content to.