0

I have a specific question with respect to using a project which is licensed under MIT/Apache 2.0 in a SAAS product (proprietary). The open source project have multiple dependencies, if any of the dependency is restrictive (AGPL, GPL) what happens to my SaaS product license or do I have to open source my SaaS product code is the question here.

Product: Integrate an open source form builder to integrate with my SaaS product offering for my customers.

For eg., webiny-js (form builder library)

webiny-js library has 10 obligations - (e.g., Disclose source for projects)

Usage Scenarios:

  1. My SaaS product directly calls the 'form builder service' in its code workflow.

  2. Form builder service is not directly integrated to my SaaS app, but it gets used seperately and it redirects to my SaaS app. (and no api calls from my SaaS app)

Question:

  1. Is there any possibility where I have to open source my proprietary application code in any case, when I use open source (MIT/Apache) software which in-term uses dependency libraries (which are restrictive) as in the above example?

  2. Does the above usage scenarios have a difference, with respect to (1) based on the type of restrictive license.

I would love to hear your experience and knowledge on this.

0
  1. Is there any possibility where I have to open source my proprietary application code in any case, when I use open source (MIT/Apache) software which in-term uses dependency libraries (which are restrictive) as in the above example?

Yes. If your product contains code under a strong copyleft license (like the GPL or AGPL), either directly or via a (indirect) dependency, then any distribution of the codebase must be done under the terms of that copyleft license.

Distribution includes the obvious selling of your SaaS product to others, but front-end code that gets sent to the user's browser for execution there also falls under distribution and for the AGPL also if users can remotely interact with the server-side code.

  1. Does the above usage scenarios have a difference, with respect to (1) based on the type of restrictive license.

Yes and no. It is not so much the usage scenario, but rather if your SaaS application and the "form builder service" are one integrated application or two independent applications that communicate "at arms length" with each other.

Some criteria that are commonly used in that determination are

  • does the code in one process or in multiple processes
  • how tightly are the pieces of code connected in terms of the data they exchange
  • what kind of communication mechanism do they use? Is that customary for independently developed applications that communicate with each other.

If the "form builder service" effectively runs in a separate browser tab, it can be argued that it is independent from your SaaS front-end.


One thing that I noticed from the Fossa.io link you provided is that some of the licenses of the dependencies are mutually incompatible. The license list contains, for example, GPLv2-only, GPLv3-only and CC BY-SA-NC 3.0 in the first level of dependencies. Each of those license has the requirement that the entire project gets distributed under the terms of exactly that license, which is not possible for all of them.

If this analysis from Fossa is correct, then you cannot use webiny-js, because that project can't fulfill all the requirements that the various licenses place on them at the same time. This is something to look deeper into.

| improve this answer | |
  • Thanks a lot for the detailed answer. Really appreciate it. One additional question, in-case if the code needs to be open sourced, is it only to the client or to everyone. Hope it is based on the license, is that right ? – user2631426 May 14 at 17:23
  • @user2631426, If you need to release the source code under an open-source license, it must be made available to everyone that legally obtained a copy of the application. So, initially only to the client, but if they distribute it further you might need to give it to others as well. – Bart van Ingen Schenau May 15 at 6:21
  • Thank you Bart. – user2631426 May 15 at 8:55
  • Another conflicting argument, which says you can use it similar to what you said but it implies i can use it - opensource.stackexchange.com/questions/2338/… – user2631426 May 15 at 8:56
  • @user2631426, can you elaborate where you see a conflict in the arguments? If you use GPL code, people that receive the binaries or the source code must get it under the GPL terms. If nobody receives the code (which is the case for server-side/backend code you don't explicitly distribute), the GPL conditions don't trigger. For client-side/frontend code, the GPL conditions trigger due to the transfer of the code from your server to the client's computer. – Bart van Ingen Schenau May 15 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.