Third-party component licensing obligations, usage and obligations scale

Question

I'm not sure if this question makes sense here although in my point of view it does. Otherwise I would be happy to post it in the right SO.

Scope

I would like to rise a few scenarios concerning licensing obligations under the perspective of components and libraries usages. I will not talk about code language or package management but how would be the best (or close enough to it) approach to fulfill the component licensing obligations.

Scenarios

Below I will describe a few usage scenarios and I would like to get your feedback/answer how to deal with the obligations.

1) An internal team XPTO developed a component using an open-source component who obligates who use it to open their code publicly. Other teams from this same company are using this component in final projects that will be published in online stores. Question: Who must to open their source code? The internal component from XPTO team or the projects from other teams?

2) An internal team XYZ developed a back-end REST API based on an open-source framework who demands the usage projects to make a quote about this framework in the about view. This REST API has no friendly interface once is consume exclusively by a project who will be publish in an online store. Question: How to properly quote this framework? In an static land-page for the REST API if accessed by browser? In the about of the project consumer?

Conclusion

In short I would like to know how far the responsibility of the obligations would be scaled to the usage projects.

Answer 1

This depends on the exact licenses. There isn't a general answer.

Scenario 1 – indirect library usage

Let's assume we have a third party library that was licensed under the GPL, an “XTPO” component using this library, and some application using the XTPO-component as a library. Then the component and the application are derived works of the GPL library. They can only be published under the terms of the GPL. You may not add additional licensing terms. Note that this is incompatible with some online stores.

Using software components under so-called copy-left licenses such as the GPL is therefore only suitable if you are OK with publishing your derived software under the same license, or if you are OK with not publishing your software at all (purely internal use).

If you want to publish without fulfilling the terms of a copyleft license, the only legal alternative is to replace the copyleft components with replacements under a different license. It is best to check libraries for a suitable license before you start depending on them.

Scenario 2 – attribution over a network

Carefully read the license to determine which kind of attribution is required under what circumstances. It is unusual that REST APIs would have to disclose any open source components, unless AGPL-licensed components are involved. If the license in question only requires attribution, providing this attribution in the API documentation would be the usual approach.