I have a github repository that I plan on making public, and I'm in the process of choosing a license for it. It's a Python project that utilizes a number of open source libraries. The code for those libraries are not actually part of my repo, but my users will inevitably install those libraries when installing my own repo. Usually when describing obligations licenses talk about "this software in modified or original form must ...", but I'm tempted to think my own software is not a modified form of theirs simply for depending it. How do the licensing obligations of these dependencies transfer here ? Do they even matter, as I am not actually modifying or shipping their software, but I am building software whose installation procedure requires installing those libraries first, as detailed in my setup.py ? If so, what exactly does the license apply to ? If one of the libraries is copy-left, does this mean my own license must be copy-left as well, or just that I have to point my users towards their license ?
-
See also opensource.stackexchange.com/questions/2139/…– BrandinOct 17, 2021 at 20:31
1 Answer
When you use Dependencies (direct or transitive) and you are not actually including this code of dependencies into your distribution, but you are just referencing it (and the user of the software will have to download and install it), then you can consider the information about the dependencies as metadata related to your code. So in your own license.txt you do not have to (for example) include all of the attribution notices and license terms of these dependencies that you are not distributing.
License-compatibility, however, is a separate thing. If you include strong-copyleft-licensed libraries as a dependency, then it is likely that your own code also needs to be licensed under the same strong-copyleft license. This has to be looked at in each individual case. For GPL (as a mainstream example of a strong-copyleft license) you will need to carefully study the guidance of FSF.
Very often, libraries are not exclusively licensed under strong-copyleft licenses, you can frequently see that they are dual- or tri-licensed. In such case you can usually select the license terms (from the 2 or 3 offered options) that you want to have applied in your project. You will just have to clearly identify that in your project and in your license.txt.
-
Thanks for the answer ! I'm going to do a thorough review of the licenses involved but I think most are actually fairly permissive MIT like licences. I'm actually fine having a copy-left license myself, I would however also like to be able to add a few custom (monetization related) clauses to my license. What is particularly annoying here is that the parts of my code that depend on those libraries are somewhat derivative to the core product, so if worst comes to worst I could do a file level license (splitting the code into 2 repos would be a hassle I just don't have the time or energy for).– ticsterOct 18, 2021 at 14:23
-
1Note that "just using dependencies" can get you into hot water, if the interfaces are under some restrictive license (see e.g. GNU readline, you can link to it only from GPL programs) or if the "use" means compiling against --licensed-- header files or using other details (perhaps calling functions for internal use or such).– vonbrandOct 19, 2021 at 0:48
-
I do not understand the answer. In the first paragraph it is said that dependencies are just some metadata and irrelevant for the choice of a license. In the second paragraph, however, now it is important? So what is it now? Do the dependencies used in a python project have an effect on the license of the project itself? Or not? And how?– AlexSep 14, 2022 at 12:21
-
@Alex It is not as black&white as you might hope. You have to assess the actual situation and then make your determination. The small amount of details provided here does not allow me to make a definitive assessment of your situation. Sep 15, 2022 at 6:26
-
So then where can I find all the information so that I can make a decision for myself? I search and search and did not find anything related to dependencies, and used libraries, IF they need to be considered or not. No idea...– AlexSep 15, 2022 at 9:20