Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.
34 votes
Accepted

Which licenses give me a guarantee that a software I'm installing is completely open-source, free of closed-source dependencies or components?

No Open Source license does that. Even the GNU GPL license allows one program to interact with another non-free program via pipes, sockets, streams etc. While the licenses can't do this, there are ...
user avatar
21 votes
Accepted

What are software dependencies, and what are the implications of FLOSS dependencies for other projects?

Software dependencies: A not-too-technical introduction Summary Programs depend on other programs, often with many deep levels of indirection. Million of packaged FLOSS programs are available through ...
user avatar
18 votes

Which licenses give me a guarantee that a software I'm installing is completely open-source, free of closed-source dependencies or components?

Which licenses give me a guarantee that a software I'm installing is completely open-source, free of closed-source dependencies or components? Unfortunately, a license cannot do that. Here's the ...
user avatar
  • 411
8 votes

Should you give attributions to the libraries your library uses?

But what about the libraries that x-library uses? Is it my job to give attribution to it or is it x-library's job? If you redistribute libraries with you app --whether or not they are your direct, ...
user avatar
7 votes
Accepted

Are we liable for license problems posed by transitive OSS libraries?

You should practice due diligence also for transitive dependencies. Open-source licensing is frequently shoddy, inaccurate, or slightly misleading. There's no malice involved, but especially smaller ...
user avatar
  • 33k
6 votes

Should you give attributions to the libraries your library uses?

Let's assume for the sake of simplicity that x-library only depends on libraries that are licensed under MIT as well. The only requirement of the MIT license is: The above copyright notice and ...
user avatar
  • 5,257
6 votes

What are software dependencies, and what are the implications of FLOSS dependencies for other projects?

I'd describe software with library dependencies as like a car. If you want to make your own car, you can do it from the ground up, or you can produce only the body and purchase, say, the engine/...
user avatar
5 votes
Accepted

External libraries on GitHub

I wouldn't recommend uploading static binaries and header files to GitHub. A better approach might be to create a script that is executed before compilation that downloads these dependencies. ...
user avatar
  • 1,844
5 votes
Accepted

Release code with MIT dependencies under GPL

Yes, you can release your code under the GPL. The MIT license is compatible with the GPL: you can combine MIT-licensed code with GPL'ed code, as long as the result is licensed under the GPL. This is ...
user avatar
  • 33k
5 votes
Accepted

When does a dependency imply a derivative work?

The OSL defines "Derivative Works" as to translate, adapt, alter, transform, modify, or arrange the Original Work, thereby creating derivative works ("Derivative Works") based upon the ...
user avatar
  • 2,488
5 votes
Accepted

GNU Lesser General Public License with signed C# assembly

Firstly, and this is important, IANAL/IANYL. If you are betting a business on this idea, you had better get some proper legal advice, and not rely solely on postings by random strangers on internet ...
user avatar
  • 37.7k
5 votes
Accepted

Do I have to worry about software dependency licence management?

You distribute your product. Thus you are liable. Draw whatever conclusion you want. Usually you want to make sure that your product and all the dependencies you use really are under a license which ...
user avatar
  • 8,042
4 votes
Accepted

Get the list of projects which depend on given library

npm will show you any packages which depend on another package. Here's what it says for sweetalert2. But that won't include dev-dependencies, or projects which haven't been published to GitHub. ...
user avatar
4 votes
Accepted

Should I credit indirect depended package in my open source credit notice too?

You added this important comment: it's frontend project. So packages are bundled and minimized then redistributed to end user. So the answer to: Should I credit indirect depended package in my open ...
user avatar
4 votes

Which licenses require that the third-party dependencies used by the licensed software are also open-source?

There is no such license. Instead of looking for a particular license, it might be better to look at a curated selection of free software. Debian is notable for rigorously checking the licensing of ...
user avatar
  • 33k
4 votes

Is browser a dependency?

If you bundle a browser (or one of its components, such as the gecko engine) as part of your application or force the user to install it, it's a dependency like any other component your application ...
user avatar
  • 3,757
4 votes
Accepted

Sub-dependencies and code disclosure

You are required to comply with all the licenses that apply to the different code parts that make up your project, including the licenses on transitive dependencies (dependencies of dependencies and ...
user avatar
4 votes
Accepted

How to include licenses of dependencies in commercial closed-source proprietary software?

How to repackage somebody else's free software as part of your own proprietary offering is arguably not very on-topic here, and in any case the precise obligations will depend very much on the ...
user avatar
  • 37.7k
4 votes

Do I have to worry about software dependency licence management?

You could argue that in theory, if Express, for argument's sake, is licensed under the MIT license, it shouldn't depend on anything that conflicts with that license, but that statement essentially ...
user avatar
  • 3,757
3 votes

What is the appropriate way to include third-party libraries copyright notice and permission notice in my project source code?

If you are running your web app (as a service) on your own server (or a server under your control) regardless if public or in-house, then you are not actually distributing/publishing anything, you are ...
user avatar
3 votes
Accepted

NPM - can I use module with MIT license, even if it requires submodule with CC-BY license?

I would like to use the packages I required in a project for commercial use. What are my obligations regarding the licenses? Are there any, as I've not required the non-permissive licensed modules ...
user avatar
3 votes

Third-party component licensing obligations, usage and obligations scale

This depends on the exact licenses. There isn't a general answer. Scenario 1 – indirect library usage Let's assume we have a third party library that was licensed under the GPL, an “XTPO” component ...
user avatar
  • 33k
3 votes
Accepted

Use package / package-lock for acknowledgments?

Ultimately, your project relies on functionality supplied by some package X. It doesn't matter if your code relies on it directly or if it relies on package Y which in turn relies on package X - the ...
user avatar
  • 3,757
3 votes
Accepted

Using maven artifacts without going insane over licensing

You need to differentiate 2 cases: a) you have your code on GitHub, and b) you distribute your code (e.g. executable) including the dependencies, e.g. as pre-built packages. In case a) you it is ...
user avatar
2 votes

Copyright of MIT licenced libraries usage within GPL licensed code

To license each part of your work under a specific license (GPLv3 for some components and MIT for others), one way is to place a header in each file or directory that states the license under which ...
user avatar
  • 1,463
2 votes
Accepted

Code generation, source-only dependencies and GPLv3

This is probably OK, depending on the licensing status of the code that you generate. You only hold the copyright to your annotation processor. You do not hold any copyright to the user's programs. ...
user avatar
  • 33k
2 votes
Accepted

Maven jar-with-dependencies - any violation of distribution license?

As long as you preserve the NOTICE file(s) when distributing your binary, what you're doing is OK per the Apache License. For instance, this is the NOTICE file for the current Commons Lang. You ...
user avatar
2 votes
Accepted

Can I use the EPL-licensed library (Paho) for a proprietary project and NOT disclose the source code of the project?

I wrote a letter to the Eclipse Foundation. The consultant pointed me to point 5 in their FAQ. My case falls under the term "linking". He warned that he isn't a lawyer, but offered the following short ...
user avatar
  • 151
2 votes
Accepted

How can you check if your dependencies comply to their dependencies' licenses?

No, you cannot get such guarantees because compliance cannot be checked automatically. It's not even possible manually because some facts might only become known in the future. At most, it can be ...
user avatar
  • 33k
2 votes

Which licenses give me a guarantee that a software I'm installing is completely open-source, free of closed-source dependencies or components?

Not directly answering the question, but the Free Software Foundation maintains a list of Free GNU/Linux distributions here Since in freedom 1 is stated that "Access to the source code is a ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible