2

A website lists numerous aggregate clauses for systems that include open source software:

https://www.lawinsider.com/clause/open-source-software

In effect, rather than list the individual components and licenses, the aggregate clauses basically state, "We use open source software licensed under Apache, GPL, and other licenses." However, they list neither the components, nor indicate what components subscribe to which OSS license, nor provide the full OSS license itself.

For example, Xerox PostScript Driver includes:

  1. THIRD PARTY SOFTWARE. The Software may include code developed by one or more third parties ("Third Party Software"). Some Third Party Software may be subject to other terms and conditions that may be found in an open source software disclosure package provided with the Software or available for download with the product documentation. Notwithstanding the terms and conditions of this Agreement, the Third Party Software is licensed to you subject to the terms and conditions of the software license agreement identified in the open source software disclosure. If the third party terms and conditions include licenses that provide for the availability of source code (such as the GNU General Public License), the open source software disclosure or the media on which the Software may be delivered will contain the source code or provide instructions where a copy of such source code can be obtained.

For another example, SLA0048 includes:

Some portion of the software package may contain software subject to Open Source Terms (as defined below) applicable for each such portion (“Open Source Software”), as further specified in the software package. Such Open Source Software is supplied under the applicable Open Source Terms and is not subject to the terms and conditions of license hereunder. “Open Source Terms” shall mean any open source license which requires as part of distribution of software that the source code of such software is distributed therewith or otherwise made available, or open source license that substantially complies with the Open Source definition specified at www.opensource.org and any other comparable open source license such as for example GNU General Public License (GPL), Eclipse Public License (EPL), Apache Software License, BSD license and MIT license.

On the other hand, some vendors list each component's licensing terms, such as Oracle's redistribution of Debian:

https://docs.oracle.com/cd/E56021_01/html/E24527/z40001041148957.html

All these software packages that have their own licensing terms pose a few practical problems. First, collating the list of licenses is worse than herding cats. Consider the following command:

find /usr/share/ -type f -name "*copyright*" -exec grep -i "^license:" {} ; | sort | uniq -i

This produces a long and inconsistent list of licenses (see here, here, or here) that isn't guaranteed to be exhaustive. Moreover, it'd take over twelve hours to read all the unique agreements. Nobody will spend two hours reading such agreements, much less twelve.

Questions:

  • Are such aggregate license clauses legal?
  • When redistributing a product containing software that has transient dependencies, must the End User License Agreement list all the constituent third-party licenses to end users?
  • Would it be sufficient to instruct the user where to find the licenses on the system for all the various components (e.g., /usr/share/doc/*/copyright) as part of an aggregation clause in the EULA?
Improve this question
8
  • 1
    "with a short notice indicating that the system aggregates other software, each having its own terms, without explicitly listing those terms in advance" -- But normally the full terms (e.g. COPYING.GPL file, etc.) are still there in the GNU/Linux distribution. The convention is that you should look into the source directory or tarball file of the program you're interested in.
    – Brandin
    Commented Oct 13, 2022 at 18:34
  • For your other question I don't quite understand why you think that the licenses must agree. Suppose I give you a CD with 100 open source programs on it (e.g. just source code). In such a situation, potentially there could (conceivably) be 100 different licenses, a differently crafted license for each program. In practice, programs on GNU/Linux distros tend to use one of the popular ones, though ((L)GPL, MIT, etc.).
    – Brandin
    Commented Oct 13, 2022 at 19:46
  • Also could you specify an example Linux distribution that has the "aggregate clause" that you are asking about? I looked at Debian and couldn't find anything like this. Debian maintains a pretty detailed list of all the licenses for each component, but I didn't see any aggregate license or EULA. In the past, Fedora had something similar (a "EULA") but notes on fedoraproject.org/wiki/Legal:Licenses/LicenseAgreement that that terminology was misleading, so they abandoned it.
    – Brandin
    Commented Oct 14, 2022 at 12:42
  • 1
    I've rephrased the questions. Hopefully the intention of the questions is less muddy now.
    – Dave Jarvis
    Commented Oct 18, 2022 at 17:06
  • The Xerox and SLA0048 terms both appear to circumscribe the companies' own rights; i.e., they effectively say, "We have told you how you may and may not use this software, but we must note that our exclusive rights over this product do not extend to any FLOSS packages used herein, which have been licensed to us by other authors." It doesn't appear to be an attempt at satisfying the obligations of those licenses (which I assume they do on some kind of per-package basis, somewhere else), but rather this is just a true statement of limitation of their own rights.
    – apsillers ♦
    Commented Oct 19, 2022 at 2:34

1 Answer 1

Reset to default
5

These aggregate notices are legally OK, there is no reason why they are not as long as all the requirements of the individual licenses are fulfilled (e.g. delivery of a plain text copy of the license language where required, delivery of copyright attribution and notice files where required,...).

These aggregate license notices are not an EULA. Therefore the end user does not have to agree to each of the OSS licenses individually before receiving/using the software.

Where 'transient dependencies' are shipped with the software, all of the requirements of the licenses of these dependencies need to be fulfilled. The requirements are not limited to direct dependencies.

For many OSS licenses it is sufficient to have the legalese, copyright attribution and notice files in a separate, dedicated subdirectory (if it is easy to be found by a reasonable person). However, some OSS licenses require that this information is visible somewhere in the GUI of the software (if a GUI exists). Therefore many projects have a page to display this (e.g. in Firefox the page about:license).

If you are looking for software to help you identify the licenses used in a project, then FOSSology or any tool recommended by the Open Chain Project might help.

Improve this answer
3
  • 1
    "These aggregate license notices are not an EULA" - However, some of the mentioned agreements do call themselves with that name. In theory, it seems like you'd have to agree to the EULA to use the non-open source parts, if any exist.
    – Brandin
    Commented Oct 19, 2022 at 6:07
  • 3
    Agreed, you will have to agree to the EULA to use the non-open source parts. But the OSS licenses are stand-alone legal documents, even if the pointer to the OSS licenses (and/or the respective sub-directory) is within the EULA, and the use of the OSS parts would be allowed even if you don't accept the EULA.
    – Martin_in_AUT
    Commented Oct 19, 2022 at 6:17
  • I'll just note, in congruence with what's already been said, that both quoted sections seem to exist solely to clarify that you don't have to agree to the EULA to use the OSS components: "Notwithstanding the terms and conditions of this Agreement, the Third Party Software is licensed to you..." and "Such Open Source Software... is not subject to the terms and conditions of license hereunder."
    – apsillers ♦
    Commented Oct 19, 2022 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.