34

No Open Source license does that. Even the GNU GPL license allows one program to interact with another non-free program via pipes, sockets, streams etc. While the licenses can't do this, there are Linux distributions where the distribution creators make a commitment to only including free software, for example the Debian main package repository.


21

Software dependencies: A not-too-technical introduction Summary Programs depend on other programs, often with many deep levels of indirection. Million of packaged FLOSS programs are available through public repositories for easy dependencies download and installation. How dependent programs relate to and interact with each other can be more or less intimate....


18

Which licenses give me a guarantee that a software I'm installing is completely open-source, free of closed-source dependencies or components? Unfortunately, a license cannot do that. Here's the problem. Anyone can attach put any license file into their project repo that they want to. The text of the license file may assert that that everything in their ...


8

But what about the libraries that x-library uses? Is it my job to give attribution to it or is it x-library's job? If you redistribute libraries with you app --whether or not they are your direct, first level deps or deps of deps at full depth-- you are responsible to ensure that you comply with each licenses, all the way. It is always your job even if and ...


6

You should practice due diligence also for transitive dependencies. Open-source licensing is frequently shoddy, inaccurate, or slightly misleading. There's no malice involved, but especially smaller libraries treat licensing as an afterthought. So it is unwise to blindly trust your immediate dependencies' authors. You have to comply with the licenses of all ...


6

Let's assume for the sake of simplicity that x-library only depends on libraries that are licensed under MIT as well. The only requirement of the MIT license is: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. which is a very light way to require attribution. You did not say ...


6

I'd describe software with library dependencies as like a car. If you want to make your own car, you can do it from the ground up, or you can produce only the body and purchase, say, the engine/wheels/gears separately. You are free to embed them into your car and it's still your car, but parts' manufacturers still have their rights to those parts (like, ...


5

I wouldn't recommend uploading static binaries and header files to GitHub. A better approach might be to create a script that is executed before compilation that downloads these dependencies. Alternatively, you could use what is already installed on the machine, if that is applicable. If you choose to upload the external libraries to GitHub, you must ...


5

Yes, you can release your code under the GPL. The MIT license is compatible with the GPL: you can combine MIT-licensed code with GPL'ed code, as long as the result is licensed under the GPL. This is possible because the MIT license explicitly allows you to sublicense the code (i.e. republish with a completely different license), and only requires you to ...


5

Firstly, and this is important, IANAL/IANYL. If you are betting a business on this idea, you had better get some proper legal advice, and not rely solely on postings by random strangers on internet fora. That said, the interesting point here is the code signing. One of the major differences between GNU GPLv3 and GNU GPLv2 (I know your question is about ...


5

You distribute your product. Thus you are liable. Draw whatever conclusion you want. Usually you want to make sure that your product and all the dependencies you use really are under a license which is compatible with what you ship. Just checking the top-level license does not cut it in the least and might make you target of possible copyright infringement ...


4

If you bundle a browser (or one of its components, such as the gecko engine) as part of your application or force the user to install it, it's a dependency like any other component your application might use. Otherwise, it's not a dependency, at least not in the traditional sense - people who use the application can decide what browser to install, or, in ...


4

You are required to comply with all the licenses that apply to the different code parts that make up your project, including the licenses on transitive dependencies (dependencies of dependencies and deeper). If there is a transitive dependency with a license that states that all source code of the entire project must be available (like the GPL license does), ...


4

npm will show you any packages which depend on another package. Here's what it says for sweetalert2. But that won't include dev-dependencies, or projects which haven't been published to GitHub. GitHub itself however also has a list of all public repositories which depend on your package.


4

You added this important comment: it's frontend project. So packages are bundled and minimized then redistributed to end user. So the answer to: Should I credit indirect depended package in my open source credit notice too? ... is a clear YES. Since you are redistributing your code with directs deps, and with deps of deps, and with deps of deps of deps ...


4

The OSL defines "Derivative Works" as to translate, adapt, alter, transform, modify, or arrange the Original Work, thereby creating derivative works ("Derivative Works") based upon the Original Work; This would on the face of it seem to permit linking by omission. A little further research confirms that in the OSL FAQ (mirror): The ...


4

You could argue that in theory, if Express, for argument's sake, is licensed under the MIT license, it shouldn't depend on anything that conflicts with that license, but that statement essentially boils down to you trusting their process. At the end of the day, you are distributing a product, so you are accountable for everything you distribute, including ...


3

I would like to use the packages I required in a project for commercial use. What are my obligations regarding the licenses? Are there any, as I've not required the non-permissive licensed modules directly? When you redistribute NPM packages (or any package) you need to consider the chain of dependencies at full depth all the way down. I provided a ...


3

There is no such license. Instead of looking for a particular license, it might be better to look at a curated selection of free software. Debian is notable for rigorously checking the licensing of any software they package. From a legal perspective, the problem is that an open source license is generally just an unilateral grant of rights from the author ...


3

This depends on the exact licenses. There isn't a general answer. Scenario 1 – indirect library usage Let's assume we have a third party library that was licensed under the GPL, an “XTPO” component using this library, and some application using the XTPO-component as a library. Then the component and the application are derived works of the GPL library. ...


3

How to repackage somebody else's free software as part of your own proprietary offering is arguably not very on-topic here, and in any case the precise obligations will depend very much on the licensing and usage detail of each such contributory piece. But in very broad outline: avoid AGPL. You are OK with GPL if and only if you aren't distributing your ...


3

Ultimately, your project relies on functionality supplied by some package X. It doesn't matter if your code relies on it directly or if it relies on package Y which in turn relies on package X - the bottom line is that without package X, your project wouldn't work. In short - you need to acknowledge all the packages you're using, whether directly or ...


2

As long as you preserve the NOTICE file(s) when distributing your binary, what you're doing is OK per the Apache License. For instance, this is the NOTICE file for the current Commons Lang. You would need to ensure its contents are available to the consumer.


2

This is probably OK, depending on the licensing status of the code that you generate. You only hold the copyright to your annotation processor. You do not hold any copyright to the user's programs. The user's programs are merely input data to your processor. Your annotation processor uses automated techniques to transform the input, which does not produce a ...


2

To license each part of your work under a specific license (GPLv3 for some components and MIT for others), one way is to place a header in each file or directory that states the license under which that part is distributed, and then refer to the full license text. For the MIT license, you can just use the entire full license text in your file because it is ...


2

I wrote a letter to the Eclipse Foundation. The consultant pointed me to point 5 in their FAQ. My case falls under the term "linking". He warned that he isn't a lawyer, but offered the following short answer: The Eclipse Foundation does not consider linking with EPL content to be a derivative work and so you are not required to disclose your source code.


2

No, you cannot get such guarantees because compliance cannot be checked automatically. It's not even possible manually because some facts might only become known in the future. At most, it can be verified e.g. whether a project has processes to ensure compliance, such as requiring contributors to sign a DCO. However, you can trust someone else to do some ...


2

Not directly answering the question, but the Free Software Foundation maintains a list of Free GNU/Linux distributions here Since in freedom 1 is stated that "Access to the source code is a precondition for this.", I believe that all the distributions listed there are fully open-source too (otherwise the precondition of freedom 1 would not hold)


2

To me, there are two issues here. One is the system library exception, and the other is whether one's regular GPL source provisioning obligations can be satisfied by pointing to a third-party repository. Firstly, regarding the system library exception, GPLv2 s3 does indeed contain the language you quote. GPLv3 s1 contains a similar exception, but it makes ...


2

Here is the question: Is the mere change of the version of the dependency a modification of DDep_v1 that makes it a 'Derivative Work' with all its implications (notice of modification, etc)? I am not sure if you are creating a derivative work from a purely legal standpoint, but from a practical perspective, I would treat your modification as if it is. From ...


Only top voted, non community-wiki answers of a minimum length are eligible