How open-source licences affect what you can ship
Permissive, weak copyleft and strong copyleft impose very different obligations. The distinction decides what you must publish.
Open-source licences fall into families, and the family determines your obligations far more than the specific licence name does.
Permissive
MIT, BSD and Apache-style licences allow use, modification and redistribution, including in proprietary products, subject mainly to preserving copyright notices and licence text. Apache adds an explicit patent grant, which is why it is often preferred for commercial use.
Obligations are real but light: ship the notice.
Strong copyleft
GPL-family licences require that when you distribute a work derived from the licensed code, you distribute it under the same licence, including source. That is the reciprocal bargain.
The question of what counts as derived is where the difficulty lies — linking, bundling and modification are treated differently, and the analysis is genuinely contested at the edges.
Weak copyleft
LGPL, MPL and similar sit between. Broadly, modifications to the licensed files must be released, but combining with proprietary code does not automatically infect the whole product.
“Most commercial risk comes from AGPL components pulled in transitively, not from a deliberate decision to use GPL code.”
Practical points
- Generate a dependency licence inventory automatically and review it on every release.
- Flag AGPL and GPL explicitly; permissive components rarely need a decision.
- Preserve notices — the most common breach is failing to ship attribution.
- Get advice before shipping anything where the derived-work question is close.
