3

Some times I step into software that I believe that is fully-open-source, but then I discover that it actually contains a lot of dependencies (either by the same author, or by different authors) for which the source is not provided.

In order to avoid the overhead of manually checking this, I would like to know whether there are some software licenses, which require that there are no closed-source dependencies on the licensed software.

Improve this question
1
  • 1
    I recommend that you read the Free Software definition. It is similar to the open source definition, but easier to understand. It will clear up a lot of your confusions. (Maybe not this one, but some others that I detect in you question)
    – ctrl-alt-delor
    May 31, 2019 at 8:31

1 Answer 1

Reset to default
4

There is no such license. Instead of looking for a particular license, it might be better to look at a curated selection of free software. Debian is notable for rigorously checking the licensing of any software they package.

From a legal perspective, the problem is that an open source license is generally just an unilateral grant of rights from the author to the public. It doesn't really bind the author, unless the author is also a licensee of more upstream code.

Dependencies can take on a variety of forms. Depending on context, you might experience non-free dependencies as fine: Would you be OK using a non-free operating system? A non-free SaaS offering? A non-free library?

The GPL does have language that is relevant here. The GPL requires the complete corresponding source of a GPL-covered binary to be published under the GPL or a compatible license. But the exact effect of this is rather subtle:

  • this does not bind the original author, but binds authors who are also licensees of upstream GPL-covered software
    • the original author could always issue an exception to the GPL that allows linking with some non-free component, a bit like the LGPL or Classpath Exception
  • this excludes system libraries or general purpose tools such as operating systems or compilers
  • this excludes freely available software
  • this only covers code that is part of the software
    • it is not entirely clear when dependencies form a single software with the GPL-covered code
    • the FSF thinks that dynamically linked libraries are part of the software
    • but that is only about binaries
    • in the source code, merely declaring a dependency likely doesn't count
    • this means that it is possible for GPL-covered code to exists that can be distributed only in source form but not in binary form
Improve this answer
5
  • I don't quite follow your point "this excludes freely available software" -- is your point here that merely having freely-available binaries is not sufficient? Or that dependencies need not themselves be copyleft, only sufficiently permissive? (Whatever your point is, I'm sure I will agree with you; I just don't quite know what specific point that item is making.)
    – apsillers ♦
    May 23, 2019 at 16:35
  • 1
    @apsillers The GPLv3 includes the weird sentence that “generally available free programs which are used unmodified in performing those activities but which are not part of the work” do not have to be provided as part of the corresponding source. I'm not 100% sure how to interpret it, but Id did want to mention it.
    – amon
    May 23, 2019 at 16:46
  • 1
    I don't totally follow that passage either, but it is limited in scope to programs "which are not part of the work" being licensed, so is it relevant? The intent here, as best as I understand, is to allow the omission of public build tools. (Whereas private build tools would fall outside the category described there and need to be included as Corresponding Source.) But I'm nitpicking hard on one item of an excellent answer; perhaps I should make a new question.
    – apsillers ♦
    May 24, 2019 at 1:17
  • What about maven dependencies? Could someone create a java software under any open-source license whose maven dependencies are all closed-source?
    – Marinos An
    May 27, 2019 at 9:11
  • 1
    @MarinosAn yes, that is my point with “the license does not bind the author”. Even with the GPL, the original author would be free to take on proprietary dependencies. And for permissive licenses like MIT, BSD, Apache this would be no problem at all.
    – amon
    May 29, 2019 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.