0

Our company is developing an enterprise application that is essentially a set of different applications (microservices). Some of these microservices are based on node.js while others are based on Python. For obvious reasons, we use packages from npm and pip. These packages are licensed differently as well assorted over MIT, BSD and Apache. There are few that are based on GPL variations as well (like AGPL).

My questions are:

  1. Can we use AGPL licensed dependencies in our applications? If not, we will look for alternatives.
  2. Do we need to include licenses and copyright information of dependencies in our distribution? If yes,
  • How to do it for services with no GUI?
  • How to do it for services with GUI?
Improve this question

2 Answers 2

Reset to default
5

How to repackage somebody else's free software as part of your own proprietary offering is arguably not very on-topic here, and in any case the precise obligations will depend very much on the licensing and usage detail of each such contributory piece.

But in very broad outline: avoid AGPL. You are OK with GPL if and only if you aren't distributing your software to anyone outside your organisation. You are OK with permissive free licences like MIT, BSD, and Apache, and if you distribute, you should take care to honour the relevant copyright notice / licence text / NOTICE file / changelog labelling and preservation requirements. There are no special requirements for GUI programs.

You should also hire an actual lawyer, with a practice in this field, to review your eventual choices. Don't bet a company on a random opinion from an internet Q&A board.

Improve this answer
-2

The AGPL licence concerns modifying source code, not using dependencies.

If you write a piece of software which has a dependency from PyPI that is released under AGPL, you have not modified the dependency so the licensing of the software you have written is not affected.

If you incorporate some code from another work released under AGPL into your software (not as a dependency but as part of the software), AGPL comes into force if you ever serve your software outside of your organisation.

This is not legal advice! This is an opinion!

Improve this answer
3
  • As MadHatter says - do not rely on a random opinion from an internet Q&A board. I'd welcome comments on whether using an open source dependency is legally equivalent to copy/pasting source code from open source licensed software into your own work. I'm claiming they are not equivalent, above.
    – DaveUU
    Feb 24, 2021 at 17:49
  • This suggests I'm wrong.
    – DaveUU
    Feb 24, 2021 at 19:18
  • 2
    So does this: if you link to a library that is GPL or AGPL (i.e., "import xyz" in Python) the importing software must be compatible with the licence of the imported software. And the whole point of AGPL over GPL is that serving over a network counts as distributing (downloading and installing GPL licenced software).
    – DaveUU
    Feb 25, 2021 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.