Open source license risk comes down to what a license requires when you distribute or offer software: permissive licenses (MIT, BSD, Apache-2.0) ask for notices, weak copyleft (LGPL, MPL, EPL) asks you to share changes to the covered library or files, and strong copyleft (GPL, AGPL) can reach your whole work. This is a reference, not legal advice.
The table
Data below comes from the comparison at choosealicense.com. All listed licenses allow commercial use, distribution, modification and private use.
| License | Family | Express patent grant | Network use triggers source sharing | Main conditions |
|---|---|---|---|---|
| MIT | Permissive | No | No | Keep license and copyright notice |
| BSD-2-Clause, BSD-3-Clause | Permissive | No | No | Keep license notice |
| Apache-2.0 | Permissive | Yes | No | Notice, state changes |
| MPL-2.0 | Weak copyleft (file level) | Yes | No | Share source of covered files, same license for them |
| EPL-2.0 | Weak copyleft | Yes | No | Source disclosure, notice, same license |
| LGPL-3.0 | Weak copyleft (library) | Yes | No | Source disclosure for the library, notice, state changes |
| GPL-2.0 | Strong copyleft | No | No | Source disclosure, same license, state changes |
| GPL-3.0 | Strong copyleft | Yes | No | Source disclosure, same license, state changes |
| AGPL-3.0 | Strong copyleft | Yes | Yes | As GPL-3.0, plus network users can get the source |
Every license disclaims liability and warranty. Apache-2.0 and MPL-2.0 also exclude trademark rights.
How do you read it?
Permissive licenses are rarely a blocker. The work is bookkeeping: ship the notices. Apache-2.0 adds an express patent grant, which some legal teams prefer.
Weak copyleft limits the sharing duty to the library or files you modified. The sharing duty attaches to changes you make to the covered library or files. Where the line sits for linking depends on the license and on your legal advice.
Strong copyleft is where distribution matters. If you distribute a work that is derived from GPL code, the GPL asks that the result be offered under the same license. Offering software only as a hosted service is a different case for GPL than for AGPL, and that gap is the point of the AGPL: it adds a condition that network users can get the source.
How do you identify a license precisely?
Use SPDX identifiers. The SPDX License List gives each license a short identifier such as MIT, Apache-2.0, GPL-3.0-only and GPL-3.0-or-later. For GNU licenses, the suffixes say whether a single version or that version and later ones apply. The older GPL-3.0 and GPL-3.0+ forms are deprecated but still valid. A WITH clause attaches a license exception, for example GPL-2.0-or-later WITH Autoconf-exception-2.0. Exceptions can change the answer, so do not discard them when you normalize data.
What goes wrong in practice?
- Transitive dependencies. The license of a package you never chose still applies to what you ship. Scan the full dependency tree.
- Missing or odd licenses. A package with no license is not free to use. Flag unknowns for review.
- Dual licensing. "MIT OR GPL" lets you choose. "AND" means both apply.
- Version mismatches. GPL-2.0-only and GPL-3.0 are not interchangeable. Check the
-onlyand-or-laterwording. - Changed licenses. A project may change its license between versions. Check the version you actually use.
Tools that inventory dependencies can list licenses and flag obligations, as Safeguard's software composition analysis documentation describes for license obligations and incompatibilities across the dependency graph. The decision about what is acceptable is yours, set with counsel, as policy.
What to do
- Decide your allowed, review and blocked license lists with legal counsel.
- Generate an inventory with SPDX license identifiers for every shipped product.
- Flag unknown licenses and AGPL for manual review.
- Keep the license text and notices with each release.
- Re-check when dependencies change.
Quick check
Does Apache-2.0 include a patent grant?
Yes. Per the choosealicense comparison, Apache-2.0, MPL-2.0, EPL, LGPL-3.0, GPL-3.0 and AGPL-3.0 include an express patent grant. MIT, BSD and GPL-2.0 do not.
Which license in the table covers network use?
AGPL-3.0, which adds a condition that users who interact with the software over a network can get the source.
Sources
- choosealicense.com, License appendix
- SPDX License List
- Safeguard docs, Software composition analysis
Last reviewed: 18 October 2026.
