Open Source Licensing and Usage Guidelines
Licensing is where most marks are lost, because obligations attach to distribution and to combination, not to intent. This domain tests whether you can classify a license, name the obligations it triggers, and judge compatibility in a concrete build.
License families
- Permissive: MIT, BSD-2-Clause, BSD-3-Clause, ISC, Apache-2.0. They require retention of copyright and permission notices; they do not require you to publish your own source.
- Weak or file-level copyleft: MPL-2.0 (per file), LGPL-2.1/3.0 (library-level; dynamic linking is usually fine, but users must be able to relink a modified library).
- Strong copyleft: GPL-2.0-only, GPL-3.0-or-later. Distributing a work based on the code obliges you to provide the corresponding source under the same license.
- Network copyleft: AGPL-3.0, whose section 13 treats interaction with the software over a network as triggering the source-offer obligation.
Details that decide cases
Apache-2.0 grants an express patent license (section 3), terminates it if you sue over patents, requires NOTICE-file retention, and makes contributions inbound=outbound (section 5). Write identifiers in SPDX form: GPL-2.0-only, GPL-2.0-or-later, Apache-2.0, not the deprecated bare GPL-2.0.
Worked example
An engineer wants to link an Apache-2.0 library into a GPL-2.0-only binary. Apache-2.0's patent-termination and notice terms are additional restrictions that GPLv2 section 7 forbids, so the combination is not permitted. Options: move the whole work to GPL-3.0, which is compatible with Apache-2.0; replace the library with an MIT- or BSD-licensed alternative; or buy a commercial license. Note that internal use with no distribution triggers no GPL source obligation at all.
Traps
- Treating GPL as contagious into unrelated software that merely runs beside it.
- Forgetting that LGPL static linking requires shipping object files or another relinking mechanism.
- Assuming a missing license means public domain.
- Dropping Apache NOTICE text when bundling.