Open-Source Software Risk

Engineers do not write every line. They take code that is already public, often from GitHub, and build with it. That code is open source. It is not “free of law.” It arrives with a licence.

Two families matter in this course.

Permissive licences, such as MIT and Apache, generally let a company use the code inside a commercial product without publishing the company’s own source.

Copyleft licences, of which the GNU General Public Licence is the example this course uses, can require that a work combining the licensed code with the company’s code be released under the same terms. Teams call this viral because the obligation is argued to reach beyond the snippet.

If a startup has folded GPL-licensed code into the core of a product it hopes to sell or finance, the proprietary story may already be compromised. You will not run a licence scanner on day one of practice. You will ask whether anyone has, and you will put a warranty in the contract: the supplier has not introduced a copyleft component that would oblige the client to publish the product.

The warranty is only as good as the repository. A scan of the repo is the fact. The clause is the promise about that fact.