Open Source Software Licenses Compliance and Risk: A Comprehensive Guide

67 questions on open source software licenses compliance and risk, answered and cited by the UpLaw editorial team.

• Can an open source license be enforced as a contract as well as a copyright license?
• Does copyleft apply to a company that only runs software as a cloud service?
• Does the GPL violate antitrust law?
• How can two entirely different legal outcomes follow from one afternoon of coding?
• How did the SBOM go from best practice to near-mandate?
• How does AI raise the stakes on inventory discipline?
• How do MIT, BSD, and Apache 2.0 compare?
• How do the four linking scenarios rank on risk?
• How do the Free Software Definition and the Open Source Definition differ?
• How much open source enforcement happens outside U.S. courts?
• How much open source is inside a typical commercial software product?
• If a company uses one GPL library, must it open-source its entire product?
• Is open source a hobbyist sideshow?
• Is open source really free?
• Is open source software in the public domain?
• Is the open source culture litigation-first or compliance-first?
• What are a startup's options when two libraries turn out to be incompatible?
• What are express patent grants and patent-retaliation clauses?
• What are GPLv3's anti-Tivoization and anti-deal provisions?
• What are the first five criteria of the Open Source Definition?
• What are the four operational habits of a working compliance program?
• What are the graded strengths of copyleft?
• What are the last five criteria of the Open Source Definition?
• What are the remediation options for tainted code?
• What are the two true stories about open source?
• What business problem drove the relicensing wave?
• What clause does every open source license share?
• What copyright question does AI training on open source code raise?
• What did Jacobsen v. Katzer decide, and why is it the cornerstone?
• What did Neo4j v. PureThink hold about editing an open license?
• What did the BusyBox suits show about remedies in practice?
• What does a compatibility matrix add that a list of approved licenses does not?
• What does a permissive license require?
• What does copyleft do, and why should a lawyer avoid the word "viral"?
• What does GPLv2 Section 2(b) require?
• What does policy and governance look like in an open source compliance program?
• What is a software bill of materials?
• What is the Business Source License?
• What is the community's ultimate check on a relicensing licensor?
• What is the one-sentence summary of the license spectrum?
• What is the open-core model, and how does it differ from relicensing?
• What is the "open source AI" definition problem?
• What is the Open Source Definition, and who maintains it?
• What is the provenance-and-obligation risk in diligence?
• What is the Server Side Public License, and why isn't it open source?
• What is the textbook license incompatibility?
• What is the third-party-beneficiary theory in SFC v. Vizio?
• What is the trap people forget about permissive licenses?
• What license-obligation tracking does a program need?
• What loophole does the AGPL close?
• What open source warranties appear in acquisition agreements?
• What should a startup's open source policy actually contain?
• What warning follows from the relicensing wave for counsel?
• What were the enduring lessons of the SCO–Linux saga?
• Where does the highest-value legal work in a compliance program happen?
• Who is liable when open source code breaks or infringes a patent?
• Why can two open source licenses be incompatible?
• Why do copyleft disclosure duties always concern source rather than binaries?
• Why does an SBOM serve both compliance and security?
• Why does open source draw the most scrutiny in M&A diligence?
• Why does the condition-versus-covenant line matter beyond bookkeeping?
• Why don't MIT and BSD address patents?
• Why do the loudest voices disagree about linking and derivation?
• Why is criterion 6 the quiet linchpin of the Open Source Definition?
• Why is "derivative work" the phrase on which copyleft turns?
• Why is "open source runs on copyright" the master key to the field?
• Why is the governing discipline avoidance rather than litigation?