34

No Open Source license does that. Even the GNU GPL license allows one program to interact with another non-free program via pipes, sockets, streams etc. While the licenses can't do this, there are Linux distributions where the distribution creators make a commitment to only including free software, for example the Debian main package repository.


18

Which licenses give me a guarantee that a software I'm installing is completely open-source, free of closed-source dependencies or components? Unfortunately, a license cannot do that. Here's the problem. Anyone can attach put any license file into their project repo that they want to. The text of the license file may assert that that everything in their ...


5

You distribute your product. Thus you are liable. Draw whatever conclusion you want. Usually you want to make sure that your product and all the dependencies you use really are under a license which is compatible with what you ship. Just checking the top-level license does not cut it in the least and might make you target of possible copyright infringement ...


4

You could argue that in theory, if Express, for argument's sake, is licensed under the MIT license, it shouldn't depend on anything that conflicts with that license, but that statement essentially boils down to you trusting their process. At the end of the day, you are distributing a product, so you are accountable for everything you distribute, including ...


3

Ultimately, your project relies on functionality supplied by some package X. It doesn't matter if your code relies on it directly or if it relies on package Y which in turn relies on package X - the bottom line is that without package X, your project wouldn't work. In short - you need to acknowledge all the packages you're using, whether directly or ...


3

How to repackage somebody else's free software as part of your own proprietary offering is arguably not very on-topic here, and in any case the precise obligations will depend very much on the licensing and usage detail of each such contributory piece. But in very broad outline: avoid AGPL. You are OK with GPL if and only if you aren't distributing your ...


2

You need to differentiate 2 cases: a) you have your code on GitHub, and b) you distribute your code (e.g. executable) including the dependencies, e.g. as pre-built packages. In case a) you it is sufficient to list the dependencies properly. You need to declare your own license and copyright notice. I recommend (not required) to have SPDX identifiers in each ...


2

When you use Dependencies (direct or transitive) and you are not actually including this code of dependencies into your distribution, but you are just referencing it (and the user of the software will have to download and install it), then you can consider the information about the dependencies as metadata related to your code. So in your own license.txt you ...


2

Here is the question: Is the mere change of the version of the dependency a modification of DDep_v1 that makes it a 'Derivative Work' with all its implications (notice of modification, etc)? I am not sure if you are creating a derivative work from a purely legal standpoint, but from a practical perspective, I would treat your modification as if it is. From ...


2

To me, there are two issues here. One is the system library exception, and the other is whether one's regular GPL source provisioning obligations can be satisfied by pointing to a third-party repository. Firstly, regarding the system library exception, GPLv2 s3 does indeed contain the language you quote. GPLv3 s1 contains a similar exception, but it makes ...


2

Not directly answering the question, but the Free Software Foundation maintains a list of Free GNU/Linux distributions here Since in freedom 1 is stated that "Access to the source code is a precondition for this.", I believe that all the distributions listed there are fully open-source too (otherwise the precondition of freedom 1 would not hold)


1

If you are running your web app (as a service) on your own server (or a server under your control) regardless if public or in-house, then you are not actually distributing/publishing anything, you are just offering the service. Under the MIT license if you are not distributing the code then you have no obligations. (under AGPL license it would be very ...


1

Yes, you have to fulfil the licenses of all the software that you distribute, including transitive dependencies. So if you distribute the pg-jdbc binaries, you also have to comply with all the licenses for all the software in those binaries. However, it is common in the Java world to include all licenses within the JAR. As long as this license information is ...


1

As others have noted, someone distributing software cannot change substitute their license for whatever license a third part distributed the third-party software under. So no license can offer any assurance there's no third-party components with a more restrictive license. There is no substitute for examining all third-party pieces and their licenses. When I ...


Only top voted, non community-wiki answers of a minimum length are eligible