Are we liable for license problems posed by transitive OSS libraries?

Question

We (small team in large organisation, in Germany/EU) have the following situation:

• we use OSS libraries within our commercial products, licenses are checked and we are sure that we're complying (LGPL, BSD, MIT etc.., no copyleft)
• these libraries do contain/link other OSS libraries, sometimes using other licenses

Now, our legal department has a very elaborate/expensive/time consuming process to check new libraries that we want to use. Part of the process manually checks every single file, including those of transitive dependencies in source form.

My question is: Are we really liable for license problems posed by transitive dependencies of our dependencies? My feeling is that the legal department (which is external) designed the process to take as many billable hours as possible...

Answer 1

You should practice due diligence also for transitive dependencies. Open-source licensing is frequently shoddy, inaccurate, or slightly misleading. There's no malice involved, but especially smaller libraries treat licensing as an afterthought. So it is unwise to blindly trust your immediate dependencies' authors.

You have to comply with the licenses of all components in your system. Transitive dependencies can hide surprises:

• A transitive dependency might be published under the GPL, which can require your application to be made available under the GPL. This tends to be undesirable for your company.

• As a variant of the above, consider an LGPL dependency that can be used without such restrictions, but only under certain conditions such as that the dependency is dynamically linked and can be replaced by users. You have to be aware that these conditions exist so that you can choose an appropriate architecture for your code.

• A transitive dependency may only be available under a license that includes a restrictive patent grant, and could potentially prevent you from suing a competitor (e.g. older React licenses).

So what your legal department doing is not per se wrong. It is a legitimate risk mitigation strategy. The question is whether the effort is proportional to the risk – a business decision.