Permissive licenses mostly ask you to keep notices. Weak copyleft licenses add source obligations for the covered files. Strong copyleft licenses extend source obligations to larger combined works. Always read the exact text, because each license words its duties differently, and take hard cases to counsel.
The checklist
| Family | Examples | What it typically asks when you distribute |
|---|---|---|
| Permissive | MIT, BSD, Apache 2.0 | Keep copyright and license notices; Apache adds change notes and NOTICE handling |
| Weak copyleft | MPL 2.0 | Share source for the covered files; larger work can have another license |
| Strong copyleft | GPL family | Offer source for the combined work; read the specific version |
What the texts actually say
MIT. The permission is granted on one condition: the copyright notice and permission notice must be included in all copies or substantial portions of the software.
BSD 3-clause. Keep notices in source, reproduce them in documentation for binaries, and do not use the holder's name to endorse your product without permission.
Apache 2.0. Give recipients a copy of the license, mark modified files, keep notices, and carry the attributions from a NOTICE file if one exists. It also contains a patent license that ends for you if you start patent litigation alleging the work infringes.
MPL 2.0. The MPL FAQ says that if you distribute an executable built with MPL code, you must tell recipients where to get the source for the MPL covered code, and you may license the executable under terms of your choosing so long as they do not interfere with recipients' rights to that source.
For strong copyleft, this post gives no summary of obligations, because the details differ by version and by how you combine code. See the related posts on GPL for specifics, and read the license itself.
A per release checklist
- Generate the list of third party components in the release.
- Group by family using the table.
- For each permissive component, confirm notices are in the shipped artifact.
- For each weak copyleft component, confirm where the source is available.
- For each strong copyleft or unknown component, route to review before release.
- Store the output with the release record.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one piece of evidence can support more than one requirement.
Quick check
Does permissive mean no obligations?
No. Permissive licenses still ask for notices, and Apache 2.0 asks for more.
Do these duties apply to internal use?
Most of these duties are tied to distribution. Whether hosting counts depends on the license and on your counsel's view.
Safeguard's compliance and evidence automation can keep the release record in one place.
Sources
Last reviewed: 19 October 2026.
