Buyers scan for copyleft because GPL terms can reach the whole program when you link and distribute. Internal use triggers little. Shipping software to customers or offering AGPL code over a network is where obligations start. Sellers should know where each copyleft component sits and how it is used.
This is not legal advice. Have counsel review any real deal.
What the GNU FAQ says
The GNU project's own FAQ states that linking a GPL covered work with other modules, statically or dynamically, makes a combined work covered by the GPL. A program that links a GPL library must then be released under the GPL or a compatible license.
The same FAQ says the GPL does not require you to release modifications you only use privately, and that making copies inside one organization is not distribution. Giving copies to other organizations, including off site contractors, is.
The AGPL differs: offering a modified AGPL program over a network requires offering its source to users who interact with it.
Why this matters in a deal
A buyer pays for proprietary code. If a core product links a GPL library and ships to customers, the buyer may face a choice between releasing source, replacing the component or negotiating another license.
What buyers look for
- Copyleft packages in shipped builds, not only in development tools.
- How each is linked: separate process, dynamic library or compiled in.
- AGPL components in network services.
- Vendored copies with license headers removed.
What sellers should prepare
- A license report from the shipped build.
- For each copyleft item, a note: where, how used, whether distributed.
- A replacement plan for any that are a problem.
- A record of any prior license questions from customers.
Fixing before the sale
Replacing a library takes engineering time, so start early. Where a dual license exists, a commercial license may be cheaper than a rewrite. Counsel should decide.
Safeguard's SBOM and dependency scanning includes license data, and a free scan is at https://gold.safeguard.sh/scan.
Reading a license report like a buyer
Start with the shipped artifact, then filter to copyleft licenses: GPL, LGPL and AGPL families. For each hit, ask four questions. Is the component in what customers receive? Is it linked into your code or run as a separate program? Did you modify it? Is it reachable over a network by outside users?
A GPL tool used only in your build pipeline is usually a different matter from a GPL library compiled into a mobile app. An LGPL library loaded dynamically is treated differently from one copied into your source tree. These distinctions are fact specific, so counsel makes the call, but the engineering notes decide how quickly counsel can answer.
Record decisions. If counsel approved a usage, store that memo with the license report so the next diligence round starts from it.
Quick check
Does using GPL software internally force us to publish our code?
According to the GNU FAQ, private modification and internal use do not require releasing source. Distribution to others changes that.
Sources
Last reviewed: 19 October 2026.
