3

I have a github repository that I plan on making public, and I'm in the process of choosing a license for it. It's a Python project that utilizes a number of open source libraries. The code for those libraries are not actually part of my repo, but my users will inevitably install those libraries when installing my own repo. Usually when describing obligations licenses talk about "this software in modified or original form must ...", but I'm tempted to think my own software is not a modified form of theirs simply for depending it. How do the licensing obligations of these dependencies transfer here ? Do they even matter, as I am not actually modifying or shipping their software, but I am building software whose installation procedure requires installing those libraries first, as detailed in my setup.py ? If so, what exactly does the license apply to ? If one of the libraries is copy-left, does this mean my own license must be copy-left as well, or just that I have to point my users towards their license ?

1
2

When you use Dependencies (direct or transitive) and you are not actually including this code of dependencies into your distribution, but you are just referencing it (and the user of the software will have to download and install it), then you can consider the information about the dependencies as metadata related to your code. So in your own license.txt you do not have to (for example) include all of the attribution notices and license terms of these dependencies that you are not distributing.

License-compatibility, however, is a separate thing. If you include strong-copyleft-licensed libraries as a dependency, then it is likely that your own code also needs to be licensed under the same strong-copyleft license. This has to be looked at in each individual case. For GPL (as a mainstream example of a strong-copyleft license) you will need to carefully study the guidance of FSF.

Very often, libraries are not exclusively licensed under strong-copyleft licenses, you can frequently see that they are dual- or tri-licensed. In such case you can usually select the license terms (from the 2 or 3 offered options) that you want to have applied in your project. You will just have to clearly identify that in your project and in your license.txt.

2
  • Thanks for the answer ! I'm going to do a thorough review of the licenses involved but I think most are actually fairly permissive MIT like licences. I'm actually fine having a copy-left license myself, I would however also like to be able to add a few custom (monetization related) clauses to my license. What is particularly annoying here is that the parts of my code that depend on those libraries are somewhat derivative to the core product, so if worst comes to worst I could do a file level license (splitting the code into 2 repos would be a hassle I just don't have the time or energy for).
    – ticster
    Oct 18 at 14:23
  • 1
    Note that "just using dependencies" can get you into hot water, if the interfaces are under some restrictive license (see e.g. GNU readline, you can link to it only from GPL programs) or if the "use" means compiling against --licensed-- header files or using other details (perhaps calling functions for internal use or such).
    – vonbrand
    Oct 19 at 0:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.