Navigating software licenses means knowing, for every dependency you ship, which license applies, what it requires of you, and whether combinations conflict. Use SPDX identifiers to name licenses precisely, keep an inventory alongside your dependency list, and ask a lawyer about any copyleft or custom terms before you ship. This is not legal advice.
Why are license names ambiguous?
People say "BSD-style" or "MPL/MIT" as if it were precise. The SPDX project points out that "a BSD-style license" can mean a wide range of licenses with quite different requirements, while BSD-3-Clause means one specific license. It maintains the SPDX License List, a curated set of licenses, and short-form identifiers that go in a single comment line in each file, such as SPDX-License-Identifier: MIT.
The identifiers are both human-readable and machine-readable, so gathering license information across a project can be as easy as searching for that line.
What do AND and OR mean?
SPDX expressions combine licenses with exact meaning. Apache-2.0 OR MIT means the licensee may choose either license. Apache-2.0 AND MIT means the file is subject to both, and the licensee must comply with both. GPL-2.0-only means version 2.0 and no later version, while GPL-2.0-or-later allows later versions at the licensee's option.
A dependency tagged "MPL/MIT" without those words leaves you guessing whether you must meet one set of obligations or two.
What counts as open source?
The Open Source Initiative's Open Source Definition has ten criteria. Among them: free redistribution with no royalty, source code available, permission for modifications and derived works, no discrimination against persons or groups, and no restriction on fields of endeavor. The definition's own example is that a license may not stop software being used in a business or for genetic research. A license that restricts commercial use therefore fails the definition, even if the source is visible. Such "source-available" licenses can still be legitimate to use, but their terms deserve a specific read.
The definition also says the license must not restrict other software distributed alongside, and the rights must apply to everyone who receives the program without an extra license.
What do licenses require of you?
That varies, and it is the part to take to counsel. In broad terms, permissive licenses mainly ask for attribution and keeping notices. Copyleft licenses add conditions on how you distribute combined or modified works. Custom or commercial licenses can restrict use, field, user count or hosting. The word to watch is "distribute": obligations often trigger when you ship software to others, and may differ for software run only on your own servers. Check each license text for how it treats network use.
Where do the problems usually come from?
Transitive dependencies are the usual surprise. You chose three libraries, and they pull in two hundred more, each with its own license. License files may be missing, files may carry different licenses than the package, and a dependency may change its license in a later version.
NIST's inventory control, CM-8, lists software license information among the data an organization tracks for system components, next to owners and version numbers. License tracking is part of a normal component inventory, not a separate legal exercise.
A constructed example
A team ships a desktop application. The inventory shows 180 packages. Most are MIT, Apache-2.0 or BSD-3-Clause. One analysis library is GPL-2.0-or-later, pulled in by a charting package, and the application links to it. The team asks counsel what that means for distribution, and then replaces the charting package with a permissively licensed alternative before the release, which costs two days. Finding it a week before shipping beat finding it after a customer asked.
How to check or apply this
- Generate an inventory of all dependencies, direct and transitive, with license identifiers in SPDX form.
- Flag any package with no license, a custom license or a conflicting expression.
- Write a policy: licenses allowed, licenses needing review, licenses banned for your distribution model.
- Check the policy in the build, not only at release time.
- Re-check when versions change, since licenses can change between releases.
- Keep copies of license texts and notices for what you ship.
- Take hard cases to a lawyer, and keep the answer with the inventory.
Safeguard's SBOM and dependency scanning give you the full dependency inventory that steps 1 and 2 depend on, and its policies and gates can enforce rules in the build. Interpreting a license is a legal question, and Safeguard does not give legal advice.
Quick check
What does Apache-2.0 AND MIT mean?
According to SPDX, the file is subject to both licenses, and the licensee must comply with both. With OR, the licensee can pick either.
Is source-available software open source?
Not necessarily. The Open Source Definition requires, among other things, no restriction on fields of endeavor and free redistribution. A license that restricts commercial use does not meet it.
Sources
- SPDX, Handling license info (SPDX identifiers)
- Open Source Initiative, The Open Source Definition
- NIST SP 800-53 Rev. 5, CM-8 System Component Inventory (control text)
Last reviewed: 18 October 2026.
