Understanding Open Source Licensing

Every open source project you use comes with a license, usually a single file called LICENSE that most people never open. They should. Open source licenses are some of the shortest, most readable legal documents you'll ever encounter, and they've been tested in court more often than people realize.

I'm not a lawyer, and this isn't legal advice. It's what every engineer and engineering manager should know before shipping software built on other people's code.

The two families

Permissive licenses let you do almost anything, including using the code in proprietary software, as long as you keep the copyright and license notices.

  • MIT: a few paragraphs. Keep the notice, and the code comes with no warranty.
  • BSD (2-clause and 3-clause): essentially the same. The 3-clause version adds that you can't use the authors' names to promote your product.
  • Apache 2.0: permissive, plus an explicit patent license from every contributor and a clause that ends your license if you sue anyone over patents in the code. You must also note changes you made to files. For companies, that patent clause is why Apache 2.0 is often preferred.

Copyleft licenses require that when you distribute the software, modified or not, you pass on the same freedoms, including the source code.

  • GPL v2 and v3: if you distribute a program that includes GPL code, the whole program must be available under the GPL, with complete corresponding source. Version 3 adds patent terms and requires that users of consumer devices can actually install modified versions.
  • LGPL: a weaker copyleft for libraries. You can link it from proprietary software, as long as users can replace the LGPL library with a modified version.
  • MPL 2.0: copyleft per file. Changes to MPL files stay open, but you can combine them with proprietary files.
  • AGPL v3: the GPL plus one important clause. If users interact with a modified version over a network, they're entitled to its source, even though nothing was "distributed." That closes the software-as-a-service gap.

What triggers the obligations

This is where most confusion lives.

  • Using GPL software internally triggers nothing. Run modified GPL tools on your own servers all day long. You don't have to publish anything.
  • Distribution triggers the GPL. Shipping a device, an installer, a container image or an app that contains GPL code means providing the source to whoever receives it.
  • Network use triggers the AGPL. That's its whole purpose.
  • Permissive licenses mostly require attribution. Keep the notices, typically in an "open source licenses" screen or a NOTICE file.

And the source you provide must be the complete corresponding source: the actual code that built that binary, including your modifications and build scripts. Not a link to the upstream project's home page.

The cases that proved it

The GPL used to be described as untested. It isn't any more.

  • gpl-violations.org, started by Harald Welte in 2004, won the first court injunctions enforcing the GPL in Germany against router makers that shipped Linux without source.
  • BusyBox, 2007–2009. The Software Freedom Law Center, on behalf of BusyBox's developers, sued a string of electronics makers and retailers, including Best Buy and Westinghouse, for shipping BusyBox in devices without source code. The companies settled or lost, and a court ordered Westinghouse's infringing TVs donated to charity.
  • Cisco, 2009. The Free Software Foundation sued Cisco over GPL software in Linksys routers. Cisco settled, appointed a compliance officer and made a payment to the FSF.
  • Jacobsen v. Katzer, 2008. A US appeals court held that the conditions of an open source license are enforceable as copyright conditions, not just as a contract, which opens the door to injunctions and statutory damages.
  • Microsoft, 2009. A developer found GPL code in a Windows 7 download tool Microsoft distributed. Microsoft investigated, agreed, and released the tool's source under the GPL. That's how a violation should be handled.
  • Hellwig v. VMware. A Linux kernel developer sued VMware in Germany, alleging that ESXi's core incorporated Linux code. The case was dismissed in 2016 and the appeal failed in 2019, on the grounds that he hadn't proven which of his own contributions were used, not on the substance of the GPL. VMware said it would remove the disputed component anyway.
  • Software Freedom Conservancy v. Vizio, filed in 2021 and still going, asks something new: whether users who bought a TV, and not just copyright holders, can enforce the GPL as beneficiaries of it. A California court has let that theory proceed. If it succeeds, every buyer of a GPL-powered device would have standing to demand the source.

The pattern in most of these: the companies didn't set out to steal anything. They didn't know what was in their own products.

How not to end up in that list

  • Know what you ship. Generate a software bill of materials with tools like Syft, or the scanners in your CI platform, and keep it with each release.
  • Check licenses automatically. Tools like ScanCode, FOSSA or ORT flag new dependencies with licenses your policy doesn't allow.
  • Have a policy. For example: permissive licenses fine everywhere, LGPL fine with dynamic linking, GPL fine for internal tools and needing review for anything distributed, AGPL needing review for anything network-facing.
  • Keep the notices. Attribution is the most common and most easily avoided violation.
  • Publish the source properly when you distribute copyleft software. Tag it, host it, and keep it available for as long as the license requires.
  • Watch for source-available licenses like the BSL and SSPL. They look like open source and aren't. I wrote about that in Free as in Freedom.

Open source licenses are a remarkably fair deal. You get decades of other people's work for free, and the price is reading a page of text and doing what it says.

Since then

Added October 2026. The Vizio case kept going into 2026, and the theory that users can enforce the GPL survived Vizio's attempts to have it thrown out along the way.