I have a question about free vs open source software that's more about practical implications from the user's perspective. I'll explain the mindset first before the actual question, so you can understand specifically what I'm referring to.
Let's say I want a system that's free of closed source software, as much as possible. So I want to be completely aware of closed-source software when deciding on an installation. For example, I may either not install the app, or use a sandboxed form (like snap/flatpak), or as last resort install it anyway and be aware that I'm "trusting" the code.
To be clear, when I say closed-source, I'm talking about executable code specifically - stuff that runs on my processor, that may raise security or privacy concerns - not about closed-source assets, media or other file formats that are "safe". I'm also not talking about hardware or network services external to my machine.
So let's say I'm installing a program or library in a package manager (e.g. using apt, snap, npm, etc), and I see that the main package has a FLOSS license, but I didn't check the licenses of every dependency it has.
While the package itself may be open source, it's often possible that it depends on closed-source software (and maybe even include closed-source code as components?). Which licenses give me a guarantee that I'm not indirectly installing closed-source code together with the main package? In particular, among:
- GNU AGPL, GPL, LGPL; 3.0, 2.0
- MPL 2.0
- Apache 2.0
- BSD-3-Clause, BSD-2-Clause, MIT
I presume only the GNU licenses (at least AGPL and GPL, not sure about LGPL) would give me that guarantee by just inspecting the main package, is that right?
Addionally, what if I inspect the license of every dependency, would all FLOSS licenses give me that guarantee? Or would the permissive licenses still allow a package to include and run closed-source components (code) within them, even though the package's license is considered OSS (assuming only that license is specified on the repo)?
- Can a Free Software package have a dependency that runs closed source code?
- Can an Open Source repository include and run closed source code or components?