Software Licensing
Software licensing is the legal framework that states who may use, copy, modify, or distribute software and under what conditions. It turns a copyright owner's exclusive rights into defined permissions and obligations for users, developers, and distributors.
itSoftware engineering | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - Software Licensing
Software licensing is the set of permissions and conditions that govern how software may be used, copied, modified, and distributed. Copyright gives an owner exclusive rights over a program's protected expression. A license lets that owner authorize others to exercise some of those rights under stated terms.
The core model is simple: copyright ownership, then a license grant, then permitted activity plus conditions. A license does not transfer copyright unless a separate agreement says so. Rights may be broad, as in many open source licenses, or narrow, as in proprietary end-user terms. Statutory exceptions and the public domain are separate bases.
Open source licenses are published texts with defined obligations. The Open Source Initiative maintains the Open Source Definition and a license list. SPDX provides standard license identifiers that help tooling inventory components. Neither replaces reading the actual terms that apply to what you distribute. Unknown or missing license metadata is a stop sign for redistribution.
This course explains operational concepts, not legal advice. Use the real license text and qualified counsel for acquisition, distribution, or compliance decisions. Inventory before you ship.
Read the Intro for the copyright-versus-license model. Use the Cheatsheet when you need OSI and SPDX landmarks. Landscape and Timeline place licensing among related compliance practices; Updates tracks the SPDX license list that feeds those identifiers. Measure twice when the stakes are operational. Measure twice when the stakes are operational. Measure twice when the stakes are operational. Measure twice when the stakes are operational.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://www.copyright.gov/what-is-copyright/
Supports
- Copyright ownership, exclusive rights, authorization, protected software, work made for hire, exceptions, transfers, and distinctions from other rights
- https://www.copyright.gov/help/faq/faq-digital.html
Supports
- Software license agreements and statutory limits for backup copies
- https://www.copyright.gov/timeline/timeline_1950-2000.html
Supports
- December 1980 confirmation that computer programs are copyrightable in United States law
- https://choosealicense.com/no-permission/
Supports
- Default copyright and absence of broad permission when software has no license
- https://opensource.org/osd
Supports
- Open Source Definition criteria, including source, modification, redistribution, and non-discrimination
- https://opensource.org/licenses
Supports
- OSI approval status and reviewed open source license catalog
- https://opensource.org/licenses/review-process
Supports
- Public license review and conformity with the Open Source Definition
- https://opensource.org/about/history-of-the-open-source-initiative
Supports
- February 1998 open source naming and OSI formation, October 1999 approved-license list, and 2004 proliferation work
- https://www.debian.org/social_contract.1.0
Supports
- July 1997 DFSG ratification and its relationship to the Open Source Definition
- https://www.gnu.org/gnu/gnu-history.en.html
Supports
- September 1983 GNU announcement, 1984 project start, and October 1985 Free Software Foundation formation
- https://www.gnu.org/licenses/old-licenses/gpl-1.0.html.en
Supports
- GPL version 1 terms and source-distribution conditions
- https://www.gnu.org/licenses/old-licenses/gpl-2.0.html.en
Supports
- June 1991 GPL version 2 and its redistribution and source conditions
- https://www.gnu.org/licenses/gpl-3.0.en.html
Supports
- June 2007 GPL version 3, conveyance, corresponding source, patent terms, charging, and copyleft conditions
- https://www.gnu.org/licenses/agpl-3.0.en.html
Supports
- Network interaction condition for a modified covered program
- https://www.gnu.org/licenses/license-list.en.html
Supports
- Free-software license categories and license compatibility guidance
- https://www.apache.org/licenses/LICENSE-2.0
Supports
- January 2004 Apache License 2.0 grant, conditions, NOTICE handling, modification markings, and patent terms
- https://apache.org/foundation/license-faq.html
Supports
- Applying Apache License 2.0, preserving license and notice material, and commercial use
- https://www.mozilla.org/en-US/MPL/2.0/FAQ/
Supports
- MPL file-level copyleft boundary and larger-work treatment
- https://spdx.dev/learn/handling-license-info/
Supports
- SPDX identifiers, file annotations, AND, OR, WITH, only and or-later distinctions, and purpose of the license list
- https://spdx.dev/use/specifications/
Supports
- SPDX as ISO IEC 5962:2021 and specification versions
- https://spdx.dev/about/overview/
Supports
- SPDX drafting in 2010, releases from 2011 onward, and ISO publication in 2021
- https://reuse.software/
Supports
- File-level licensing workflow, copyright identification, machine-readable records, and compliance boundary
- https://reuse.software/spec/
Supports
- Repository convention for copyright and licensing information
- https://github.com/sindresorhus/awesome
Supports
- Required starting point for awesome-list discovery
- https://github.com/magnologan/awesome-sca
Supports
- Discovery of OWASP Dependency-Check, Snyk, and Sonatype as relevant SCA ecosystem entries
- https://owasp.org/www-project-dependency-check/
Supports
- Dependency-Check SCA purpose, dependency analysis, vulnerability mapping, build integrations, and awesome-link rationale
- https://docs.snyk.io/scan-with-snyk/snyk-open-source/scan-open-source-libraries-and-licenses/open-source-license-compliance
Supports
- Snyk direct and indirect license scanning, policies, SPDX updates, OR and AND treatment, and awesome-link rationale
- https://help.sonatype.com/en/sonatype-lifecycle.html
Supports
- Sonatype component intelligence, policy evaluation, application governance, and awesome-link rationale
- https://scancode-toolkit.readthedocs.io/en/stable/
Supports
- ScanCode license, copyright, package, dependency, and vulnerability detection plus scanner limits and product role
- https://www.fossology.org/
Supports
- FOSSology license, copyright, export scanning, database, web interface, and compliance workflow
- https://oss-review-toolkit.org/ort/
Supports
- ORT analysis, source scanning, license mapping, policy evaluation, reports, SBOMs, and product role
- https://docs.fossa.com/product-guides/compliance
Supports
- FOSSA license detection, obligations, policies, attribution, snippet and binary analysis, and product role
- https://documentation.blackduck.com/bundle/bd-hub/page/Welcome.html
Supports
- Black Duck SCA documentation, license compliance workflow, inventory, policy, and product role
- https://docs.mend.io/wsk/best-practices-for-mend-sca-policies
Supports
- Mend license policy, exception, multiple-license, compatibility, and product-role concepts
- https://spdx.org/licenses/
Supports
- SPDX license list used as Updates source