license-compliance

# Open Source License Compliance

Comprehensive guidance for open source license compliance before and during development.

## When to Use This Skill

- Evaluating open source dependencies for new projects
- Checking license compatibility between packages
- Understanding obligations for distribution
- Creating attribution notices and NOTICES files
- Establishing license policies for your organization

## License Categories

### Permissive Licenses

Allow use, modification, and distribution with minimal restrictions.

| License | Obligations | Commercial Use | Patent Grant |
|---------|-------------|----------------|--------------|
| **MIT** | Attribution | ✓ | No |
| **BSD-2-Clause** | Attribution | ✓ | No |
| **BSD-3-Clause** | Attribution, no endorsement | ✓ | No |
| **Apache-2.0** | Attribution, state changes, NOTICE | ✓ | Yes |
| **ISC** | Attribution | ✓ | No |

### Copyleft Licenses

Require derivative works to use the same license.

| License | Copyleft Scope | SaaS Trigger | Distribution Obligations |
|---------|---------------|--------------|-------------------------|
| **GPL-2.0** | Strong | No | Source disclosure |
| **GPL-3.0** | Strong | No | Source disclosure, anti-Tivoization |
| **LGPL-2.1** | Weak (library) | No | Source for library, linking allowed |
| **AGPL-3.0** | Strong + Network | Yes | Source disclosure on network use |
| **MPL-2.0** | File-level | No | Source for modified files |
| **EPL-2.0** | Module-level | No | Source for modified modules |

### Weak Copyleft vs Strong Copyleft

```text
Strong Copyleft (GPL):
┌──────────────────────────────────────────┐
│  Your Application (becomes GPL)          │
│  ┌──────────────────────────────────┐   │
│  │  GPL Library (linked/included)   │   │
│  └──────────────────────────────────┘   │
└──────────────────────────────────────────┘

Weak Copyleft (LGPL):
┌──────────────────────────────────────────┐
│  Your Application (any license)          │
│  ↓ dynamic link                          │
│  ┌───────