I'm not sure if this question makes sense here although in my point of view it does. Otherwise I would be happy to post it in the right SO.


I would like to rise a few scenarios concerning licensing obligations under the perspective of components and libraries usages. I will not talk about code language or package management but how would be the best (or close enough to it) approach to fulfill the component licensing obligations.


Below I will describe a few usage scenarios and I would like to get your feedback/answer how to deal with the obligations.

1) An internal team XPTO developed a component using an open-source component who obligates who use it to open their code publicly. Other teams from this same company are using this component in final projects that will be published in online stores. Question: Who must to open their source code? The internal component from XPTO team or the projects from other teams?

2) An internal team XYZ developed a back-end REST API based on an open-source framework who demands the usage projects to make a quote about this framework in the about view. This REST API has no friendly interface once is consume exclusively by a project who will be publish in an online store. Question: How to properly quote this framework? In an static land-page for the REST API if accessed by browser? In the about of the project consumer?


In short I would like to know how far the responsibility of the obligations would be scaled to the usage projects.

  • "using an open-source component who obligates who use it to open their code publicly" - give an example, please. GPL for example, does not obligate anyone to open code just because of usage - that part requires distribution or publication, not just usage. Or in other words: what you are asking depends on the precise license text, you cannot expect to get a good answer for this if you don't mention the exact license. If you mean "GPL", then write "GPL", please. – Doc Brown Aug 10 '18 at 5:06
  • @DocBrown I don't mean anything but a generic scenario although I see that I need to give some context e.g. GPL but your comment and the answer below is exactly what I would like to get from this... Unfortunately I won't give any example once there are many and I want to your thoughts about it... – Marcelo Filho Aug 10 '18 at 14:08

This depends on the exact licenses. There isn't a general answer.

Scenario 1 – indirect library usage

Let's assume we have a third party library that was licensed under the GPL, an “XTPO” component using this library, and some application using the XTPO-component as a library. Then the component and the application are derived works of the GPL library. They can only be published under the terms of the GPL. You may not add additional licensing terms. Note that this is incompatible with some online stores.

Using software components under so-called copy-left licenses such as the GPL is therefore only suitable if you are OK with publishing your derived software under the same license, or if you are OK with not publishing your software at all (purely internal use).

If you want to publish without fulfilling the terms of a copyleft license, the only legal alternative is to replace the copyleft components with replacements under a different license. It is best to check libraries for a suitable license before you start depending on them.

Scenario 2 – attribution over a network

Carefully read the license to determine which kind of attribution is required under what circumstances. It is unusual that REST APIs would have to disclose any open source components, unless AGPL-licensed components are involved. If the license in question only requires attribution, providing this attribution in the API documentation would be the usual approach.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.