Copied Code Brings Its Licence Along: What Open Source Licences Ask of You
Open source code is free to use, and it comes with conditions. Every open source project comes with a licence, and the licence is the deal: you may copy, change and share this code, as long as you do certain things in return. Those things are usually small. Sometimes they’re large enough to decide how you can ship your whole product.
The conditions travel with the code. When a function moves from a library into your project, however it got there, its licence comes with it, even if the licence text stays behind. Here’s what the common licences ask, from the least to the most.
No Conditions
A few licences give the code away completely: the Unlicense, CC0, 0BSD and MIT-0. You can copy it without keeping a name or a notice. They’re rare in practice, but they’re the one case where copying needs nothing at all.
Keep the Notice
Most open source uses a permissive licence: MIT, BSD, ISC, Apache 2.0, zlib. You can do nearly anything with the code, including selling it inside a closed product. What they ask is that you keep the copyright line and the licence text with your copy, so whoever gets your software can see where that part came from and under what terms. Apache 2.0 also asks you to mark files you changed and to pass on the project’s NOTICE file if it has one, and it comes with a patent licence from the people who wrote the code.
Most teams break this one without meaning to. The function gets copied, the copyright line at the top of the original file doesn’t, and the product ships without the credit the licence asked for. It’s easy to fix: add the notice to a third-party notices file, which most apps already have for their dependencies.
A Person Should Look
Some licences sit in between, and they usually work file by file or library by library. Code under the Mozilla Public License 2.0 can go into a closed product, but MPL files stay under the MPL, and changes to them have to be published. The LGPL lets you link to a library from closed code, but changes to the library stay under the LGPL, and copying LGPL code into your own files works differently from linking to it. These cases depend on how the code is used, so they need a person’s judgement.
A Conflict
The GPL is a copyleft licence: if you distribute a program that contains GPL code, the whole program has to be available under the GPL, with its source code, to everyone you give it to. Copy one GPL function into an app you ship under MIT or a commercial licence and the two sets of terms collide. The fixes are to remove the code, rewrite it without looking at the original, or release your program under the GPL. The AGPL goes further and counts letting people use the program over a network, so it reaches web services too.
Licences can also collide with each other. Apache 2.0 code can’t go into a program licensed under GPL version 2 only, because the two disagree about patents, and code under GPL version 2 only can’t be combined with GPL version 3 code. Licences that say “version 2 or later” avoid that last problem.
No Permission at All
Code with no licence isn’t free to use. Copyright applies to it automatically, and without a licence nobody has given you permission to copy it. That covers a lot of code in public repositories and gists whose authors never added a licence. The only fixes are to leave it out or to ask the author.
When It Matters
Most of these conditions apply when you give your software to someone else: you ship an app, sell a device, or hand code to a customer. The AGPL also counts serving the program over a network. Code that never leaves your company triggers fewer conditions, but buyers, investors and large customers often ask for a list of the open source inside, and they look at internal code too.
AI coding assistants add a new way for code to arrive. They learn from public code, and now and then they reproduce a well-known function nearly word for word. When a copy is close enough to the original, the original’s licence can still apply, however the copy was made.
Finding Out What You Have
You can’t follow a licence you don’t know about. Remixware compares your project with open source code, finds the parts that match, and sorts them into these same groups, so you know which copies need a notice, which need a look and which need to go. It flags licensing questions; it isn’t legal advice, and for the cases that matter, a lawyer who knows open source is worth the call.