Open-Source Licence Reference: Texts, Identifiers and Obligations
Every software company ships other people’s code. The licence attached to each package decides whether you can keep your own source closed, what notices you must ship, whether a patent grant protects you, and what an acquirer’s diligence team will flag. This page is the reference layer for our GPL contamination and licence audit article: the canonical texts of the licences that appear in almost every dependency scan, identified by their SPDX short identifiers, grouped by what they actually oblige you to do, plus the source-available licences that look open but are not.
Licence map
| Licence (SPDX id) | Type | What it obliges you to do | Watch for |
|---|---|---|---|
| MIT | Permissive | Keep the copyright and licence notice in copies. | No express patent grant. |
| BSD-2-Clause / BSD-3-Clause | Permissive | Keep notices; 3-clause adds a ban on using the authors’ names for endorsement. | No express patent grant. |
| ISC | Permissive | Keep notices. Functionally MIT with shorter wording; common in the npm ecosystem. | — |
| Apache-2.0 | Permissive | Keep notices and the NOTICE file, state changes you made, include the licence text. Grants an express patent licence that terminates if you sue over the covered patents. | Incompatible with GPL-2.0-only (compatible with GPL-3.0). |
| MPL-2.0 | Weak copyleft (file level) | Publish source of the MPL-licensed files you modify; your own files can stay proprietary. Patent grant included. | Keep MPL files in separate files; do not paste MPL code into your own. |
| LGPL-3.0 | Weak copyleft (library level) | Publish source of modifications to the library itself; applications that link to it can remain closed if users can relink or replace the library. | Static linking and mobile app stores need care. |
| EPL-2.0 | Weak copyleft (module level) | Publish source of modified EPL modules; separate modules may be proprietary. Optional secondary licence for GPL compatibility. | Common in the Java and Eclipse world. |
| GPL-2.0 | Strong copyleft | Anyone who receives a binary must be able to get the complete corresponding source of the whole program under the GPL. | The Linux kernel licence. “-only” and “-or-later” are different SPDX ids and different compatibility profiles. |
| GPL-3.0 | Strong copyleft | As GPL-2.0, plus an express patent grant, anti-tivoization terms and Apache-2.0 compatibility. | Triggered by distribution, not by running the software as a service. |
| AGPL-3.0 | Network copyleft | As GPL-3.0, and users who interact with a modified version over a network must be offered the source (Section 13). | The licence that catches SaaS companies. Most acquirers ask for an AGPL inventory. |
| SSPL-1.0 | Source-available, not OSI-approved | Offering the software as a service requires releasing the source of the entire service stack. | MongoDB’s licence since 2018; treat as proprietary for compliance purposes. |
| BUSL-1.1 | Source-available, time-limited | Production use is restricted as stated by the licensor until a Change Date (no more than four years), when it converts to an open licence named in the text. | Read the “Additional Use Grant” line; it differs per project. |
| Elastic-2.0 | Source-available, not OSI-approved | Free to use and modify, but you may not provide the software as a managed service or circumvent licence keys. | Common in infrastructure tooling. |
| Commons Clause | Rider, not a licence | Added on top of an open licence; removes the right to sell the software or a service whose value derives substantially from it. | “Apache-2.0 + Commons Clause” is not open source. |
| CC-BY-4.0 / CC0-1.0 | Content and data licences | Attribution (CC-BY) or a public-domain dedication (CC0). Designed for documentation, datasets and media. | Creative Commons advises against CC licences for software; CC-BY-NC and CC-BY-ND are not open licences. |
| Unlicense | Public-domain dedication | None. | Public-domain dedications are not recognised in every jurisdiction; some counsel prefer MIT or CC0’s fallback licence. |
Canonical sources and tooling
SPDX License List
The machine-readable registry of licence identifiers and full texts maintained by the Linux Foundation’s SPDX project (the SPDX specification is ISO/IEC 5962). Use the ids in your SBOM, package metadata and diligence answers.
OSI Approved Licenses and the Open Source Definition
The Open Source Initiative’s list of licences that meet the ten criteria of the Open Source Definition. A licence not on this list is not “open source” in diligence, whatever the README says.
Choose a License
GitHub’s plain-language comparison of permissions, conditions and limitations for the common licences, useful when you release your own code and need to pick one deliberately.
OpenChain (ISO/IEC 5230)
The international standard for an open-source licence compliance programme: policy, roles, inventory, notices. The framework enterprise buyers and acquirers increasingly reference in vendor questionnaires.
REUSE
The Free Software Foundation Europe’s specification and tool for marking every file in a repository with SPDX licence and copyright headers so that scanners produce clean results.
Cyber Resilience Act (Regulation (EU) 2024/2847)
The EU product-security regulation that created the “open-source software steward” role and carved out non-commercial open-source development. Relevant if your product with digital elements embeds open-source components sold in the EU.
Computer programs are protected as literary works under Law No. 5846 (Art. 2), and a transfer or licence of economic rights must be in writing and specify the rights covered (Art. 52); an open-source licence text satisfies this as a written standard-form licence, but your own outbound licences and contributor agreements should be drafted with that formality in mind. For the EU AI Act, the open-source exemption covers model publishers, not products built on top of them; see our analysis of what the exemption actually covers. For a diligence-ready inventory, run the VC Due Diligence Preparation Checklist alongside your dependency scan.
Licence texts belong to their stewards (OSI, FSF, Mozilla, Eclipse Foundation, MongoDB, MariaDB, Elastic, Creative Commons) and are linked in their canonical SPDX form for reference only. Statute: Law No. 5846 on Intellectual and Artistic Works.