OPEN SOURCE SOFTWARE:
Understanding Open Source Licenses
and Allied Compliance Issues
Tarun Khurana
BE (Comp. Sci.), MS (Software Systems), MBA (IIM-
Lucknow), LLB
Khurana & Khurana, Advocates & IP Attorneys
What is Open Source Software?
• OSS refers to any software subjected to a license that
makes the Source code available to everyone for:
Ø study,
Ø modification
Ø distribution
• The term freeware refers to software that can be used
with no cost. Open source software is essentially a
freeware, but freeware software does not always make
the source code available publicly.
• “Open Source Software (OSS) is freely
available, so I can use it without any kind of
restriction” – A misconception
üOSS has its own licensing terms
üVarious Licenses
üThe availability of the source code for OSS and
the right to modify and improve the code is an
important distinction between OSS and
commercial software
OSS LICENSES
• The rights range from copying and creating
derivatives of the product to its distribution.
• These licenses are similar to unilateral
contracts and one is only bound by it, once
they choose to accept them.
• The licensing terms are broadly categorized
under two different types: Copyleft and
Non-Copyleft or Permissive.
• Ex: GPL, LGPL, MIT, Apache, BSD, Microsoft,
Eclipse, Common Public Licence, Mozilla
Four “Essential Freedoms”
Copyleft Licenses: Freedom
to run, study, redistribute and
distribute copies of your
modified versions to others
Licensees must grant
downstream users the same
privileges and accessibility
of the licensee’s derivative
works under the same terms
of license.
Licensee must publish and
make available the source
code for any derivative
works.
Ex: GPL2.0, GPL 3.0
Generally used for the
creation of software libraries,
to allow other software to
link to the library, and then
be redistributed without the
legal requirement for the
work to be distributed under
the library’s copyleft license.
Ex. LGPL, Nokia Open source
license 1.0
Few Restrictions
No requirement to give
downstream users a source
code copy of modified code
Permits commercial
exploitation of the software
Ex. :Berkeley Software
Distribution License (BSD),
MIT License, Apache 2.0
Copyleft Weak
Copyleft
Permissive
Licenses
TABLE OF DIFFERENT TYPEOF LICENSES
License Type of License Legal Requirements Terms
Do's Don't
GNU
General
Public
License v3
(GPL-3)
Strong
Copyleft
Use, copy,
distribute and
modify the
software.
Track
changes/dates in
source files.
Commercial as
well as non-
commercial use
Codes shall be
GPL 3.0
compatible
license.
Exclusive Sub
contract for
making
modification.
Sublicensing
No
liability/war
ranty
Not
responsible
for
enforcing
compliance
by third
parties with
this License.
Incorporatio
n of OSS
into
proprietary
program.
•Valid as term of CR
• Exclusive control over making copies
• Restriction of others outside the
contractual obligation for the same
•Distribution of end product using the
covered product under the same license
•Survival of validity of copies/rights
•Violation shall constitute copyright
infringement.
•Automatic Licensing.
•Not responsible for enforcing compliance by
third parties with this License.
• No Incorporation of OSS into proprietary
program
•Inclusion of a covered work in an aggregate
does not cause this License to apply to the
other parts of the aggregate.
License Type of
License
Legal Requirements Terms
Do's Don't
Nokia Open
Source
License
(Nokia or
NOKOS)
Version 1.0a
Weak -
copyleft
Use, reproduce,
modify, display, perform,
sublicense and distribute
the Original Software
Commercial use.
Description or
modification and
contributors name to be
documented.
copy of this License with
every distribution of
Source Code.
Indemnify Nokia and every
Contributor for any liability
incurred by
Nokia or such Contributor
due to any terms offered
by him.
No warranty on
behalf of Nokia's
name.
Patent right in
modification
Cannot hold liable
World-wide, royalty-free, non-exclusive
license
Distribution of Source Code of Covered
Software/modified version be in
compliance.
Modified version shall be made available in
same media as an Executable version or via
an accepted Electronic Distribution
Mechanism to anyone to whom Executable
version available
Responsible for ensuring that the Source
Code version remains available by the third
party.
Documenting the changes and details of
the contributor and date of change.
May combine the covered product with
other software, and distribute the larger
work under other license.
License Type of
License
Legal Requirements Terms
Do's Don't
Nokia Open Source
License (Nokia or
NOKOS) Version
1.0a
Weak -copy
left
•The licensor has to make sure that the
covered code of the larger work shall be
governed under this License term.
•Violation leads to termination.
•Sublicense shall survive the termination of
license.
•Distribute executable version of Covered
software/ownership of rights under different
license, only when such distribution is in
compliance with terms of this license and are
not violating or limiting the recipient's right.
Apache Software
License Version 2.0
(Apache.0)
Permissive
License
•Reproduce, prepare
Derivative Works of
publicly display, publicly
perform, sublicense,
distribute the Work and
such Derivative Works in
Source or Object form.
•Sublicense
•Private use
•Commercial use
•Warranty
Hold Liable
Use
Trademark
•Redistributions of source code must retain
copyright notice
•Copyright statement of modified version may
provide additional or different license terms
and conditions
•No requirement to give downstream users a
source code copy of modified code
PLATFORM AND OSS
LICENSES
Table of Platform
PLATFORM LICENSE TERMS
JAVA (Some
Components
under Strong
Copyleft and
others (JDK)
under LGPL
(Weak Copyleft)
)
GNU General
Public
License v3
(GPL-3)
Valid for the term of copyright.
Output of modified work is covered
Distribution of end product using the covered product under the
same license.
Inclusion of a covered work in an aggregate does not cause this
License to apply to the other parts of the aggregate.
Survival of validity of copies/rights.
Violation shall constitute copyright infringement.
Automatic Licensing of Downstream Recipients/users/contributors.
Not responsible for enforcing compliance by third parties with this
License.
No Incorporation of OSS into proprietary program
PLATFORM LICENSE TERMS
Nokia (Weak
Copyleft)
Nokia Open
Source License
(Nokia or
NOKOS) Version
1.0a
•World-wide, royalty-free, non-exclusive license
•Distribution of Source Code of Covered Software/modified version be in
compliance.
•Modified version shall be made available in same media as an Executable version
or via an accepted Electronic Distribution Mechanism to anyone to whom
Executable version available
•responsible for ensuring that the Source Code version remains available by the
third party.
•Documenting the changes and details of the contributor and date of change.
•May combine the covered product with other software, and distribute the larger
work under other license.
•The licensor has to make sure that the covered code of the larger work shall be
governed under this License term.
•Violation leads to termination.
•Sublicense shall survive the termination of license.
•Distribute executable version of Covered software/ownership of rights under
different license, only when such distribution is in compliance with terms of this
license and are not violating or limiting the recipient's right.
PLATFORM LICENSE TERMS
Android
(Permissive
License)
Apache
Software
License
Version 2.0
(Apache 2.0)
üReproduce, prepare Derivative Works of publicly display,
publicly perform, sublicense, distribute the Work and such
Derivative Works in Source or Object form.
üSublicense
üPrivate use
üCommercial use
ü Warranty
üDocument the changes
üRedistributions of source code must retain copyright notice
üCopyright statement of modified version may provide
additional or different license terms and conditions
üInclude Notice
Due-Diligence while acquiring a
Software Product
• Understand the Platform/Type of OSS used for Product Development
(Android)
• Assess the License Rights given as part of the Platform.
• Evaluate modified component/part of the source code of the Software
Product, and source of such modified component.
• Confirm the License rights given by said source of the modified
component (say modified component is from a Copyleft OSS)
• Evaluate the Risk or Propriety of using the Modified source code, and type
of obligations that such license terms of the modified source code that the
Corporate gets exposed to (complete Software gets exposed to be treated
under a Copyleft OSS)
Artifex v. Hancom 2017
• The latest case involved Ghostscript, a PDF interpreter developed by Artifex
Software that was made available under the open source GPL license (free of cost)
or a commercial proprietary license (royalty charge).
• Hancom used the Ghostrip without purchasing commercial license.
• Artifex sued Hancom, both for copyright infringement and for breach of contract,
based on the terms of open source software license (GPL).
Defendant’s Argument
¨ Defendant did not sign anything,
thus no license can be constituted,
hence no breach is done.
¨ Plaintiff can not seek monetary relief
as the license was free. Thus, there
was no damage to be held.
Plaintiff’s Argument
¨ Defendant used Ghostcript without
obtaining commercial license, who
represents that the use of
Ghostscripts were used under GPL
GNU.
¨ Defendant did not comply to the
terms of GPL GNU i.e. they did not
make their software that used
Ghotscript, an open source,
conflicting the term clause 6 of OSS
license.
• COURT: Three ways to use Ghostrip:
1. Obtain commercial license
2. Use Ghoscript under GPL without modification or
distribution
3. Modify or distribute Ghostscript under GPL and make the
resulting product open source.
• The moment OSS is used, the user is obliged with its terms.
Non-compliance of OSS license leads to breach of
contractual obligations.
• GNU GPL is a legal contract
CONCLUSION
• Very important to understand how OSS is being modified by
employees, and know the source of the modified content along
with license terms that the source complies with.
• Critical to know the terms of the OSS during commercialization to
avoid obligations of sharing the modified source code (unless its
strategic and intentional)
• Have regular third-party audits
• Take declarations/undertaking from Product
Owners/Sellers/Licensors to ensure that they indemnify in case
of license non-compliance by licensee
THANK YOU
KHURANA & KHURANA | IIPRD
New Delhi . Noida. Bangalore . Mumbai. Pune . Hyderabad . Indore
US (California) . Malaysia . Vietnam . Bangladesh . Nepal . Sri Lanka . Myanmar

Open Source Software Legal Issues and Compliance

  • 1.
    OPEN SOURCE SOFTWARE: UnderstandingOpen Source Licenses and Allied Compliance Issues Tarun Khurana BE (Comp. Sci.), MS (Software Systems), MBA (IIM- Lucknow), LLB Khurana & Khurana, Advocates & IP Attorneys
  • 2.
    What is OpenSource Software? • OSS refers to any software subjected to a license that makes the Source code available to everyone for: Ø study, Ø modification Ø distribution • The term freeware refers to software that can be used with no cost. Open source software is essentially a freeware, but freeware software does not always make the source code available publicly.
  • 3.
    • “Open SourceSoftware (OSS) is freely available, so I can use it without any kind of restriction” – A misconception üOSS has its own licensing terms üVarious Licenses üThe availability of the source code for OSS and the right to modify and improve the code is an important distinction between OSS and commercial software
  • 4.
    OSS LICENSES • Therights range from copying and creating derivatives of the product to its distribution. • These licenses are similar to unilateral contracts and one is only bound by it, once they choose to accept them. • The licensing terms are broadly categorized under two different types: Copyleft and Non-Copyleft or Permissive. • Ex: GPL, LGPL, MIT, Apache, BSD, Microsoft, Eclipse, Common Public Licence, Mozilla
  • 5.
    Four “Essential Freedoms” CopyleftLicenses: Freedom to run, study, redistribute and distribute copies of your modified versions to others Licensees must grant downstream users the same privileges and accessibility of the licensee’s derivative works under the same terms of license. Licensee must publish and make available the source code for any derivative works. Ex: GPL2.0, GPL 3.0 Generally used for the creation of software libraries, to allow other software to link to the library, and then be redistributed without the legal requirement for the work to be distributed under the library’s copyleft license. Ex. LGPL, Nokia Open source license 1.0 Few Restrictions No requirement to give downstream users a source code copy of modified code Permits commercial exploitation of the software Ex. :Berkeley Software Distribution License (BSD), MIT License, Apache 2.0 Copyleft Weak Copyleft Permissive Licenses
  • 7.
    TABLE OF DIFFERENTTYPEOF LICENSES License Type of License Legal Requirements Terms Do's Don't GNU General Public License v3 (GPL-3) Strong Copyleft Use, copy, distribute and modify the software. Track changes/dates in source files. Commercial as well as non- commercial use Codes shall be GPL 3.0 compatible license. Exclusive Sub contract for making modification. Sublicensing No liability/war ranty Not responsible for enforcing compliance by third parties with this License. Incorporatio n of OSS into proprietary program. •Valid as term of CR • Exclusive control over making copies • Restriction of others outside the contractual obligation for the same •Distribution of end product using the covered product under the same license •Survival of validity of copies/rights •Violation shall constitute copyright infringement. •Automatic Licensing. •Not responsible for enforcing compliance by third parties with this License. • No Incorporation of OSS into proprietary program •Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
  • 8.
    License Type of License LegalRequirements Terms Do's Don't Nokia Open Source License (Nokia or NOKOS) Version 1.0a Weak - copyleft Use, reproduce, modify, display, perform, sublicense and distribute the Original Software Commercial use. Description or modification and contributors name to be documented. copy of this License with every distribution of Source Code. Indemnify Nokia and every Contributor for any liability incurred by Nokia or such Contributor due to any terms offered by him. No warranty on behalf of Nokia's name. Patent right in modification Cannot hold liable World-wide, royalty-free, non-exclusive license Distribution of Source Code of Covered Software/modified version be in compliance. Modified version shall be made available in same media as an Executable version or via an accepted Electronic Distribution Mechanism to anyone to whom Executable version available Responsible for ensuring that the Source Code version remains available by the third party. Documenting the changes and details of the contributor and date of change. May combine the covered product with other software, and distribute the larger work under other license.
  • 9.
    License Type of License LegalRequirements Terms Do's Don't Nokia Open Source License (Nokia or NOKOS) Version 1.0a Weak -copy left •The licensor has to make sure that the covered code of the larger work shall be governed under this License term. •Violation leads to termination. •Sublicense shall survive the termination of license. •Distribute executable version of Covered software/ownership of rights under different license, only when such distribution is in compliance with terms of this license and are not violating or limiting the recipient's right. Apache Software License Version 2.0 (Apache.0) Permissive License •Reproduce, prepare Derivative Works of publicly display, publicly perform, sublicense, distribute the Work and such Derivative Works in Source or Object form. •Sublicense •Private use •Commercial use •Warranty Hold Liable Use Trademark •Redistributions of source code must retain copyright notice •Copyright statement of modified version may provide additional or different license terms and conditions •No requirement to give downstream users a source code copy of modified code
  • 10.
  • 11.
    Table of Platform PLATFORMLICENSE TERMS JAVA (Some Components under Strong Copyleft and others (JDK) under LGPL (Weak Copyleft) ) GNU General Public License v3 (GPL-3) Valid for the term of copyright. Output of modified work is covered Distribution of end product using the covered product under the same license. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. Survival of validity of copies/rights. Violation shall constitute copyright infringement. Automatic Licensing of Downstream Recipients/users/contributors. Not responsible for enforcing compliance by third parties with this License. No Incorporation of OSS into proprietary program
  • 12.
    PLATFORM LICENSE TERMS Nokia(Weak Copyleft) Nokia Open Source License (Nokia or NOKOS) Version 1.0a •World-wide, royalty-free, non-exclusive license •Distribution of Source Code of Covered Software/modified version be in compliance. •Modified version shall be made available in same media as an Executable version or via an accepted Electronic Distribution Mechanism to anyone to whom Executable version available •responsible for ensuring that the Source Code version remains available by the third party. •Documenting the changes and details of the contributor and date of change. •May combine the covered product with other software, and distribute the larger work under other license. •The licensor has to make sure that the covered code of the larger work shall be governed under this License term. •Violation leads to termination. •Sublicense shall survive the termination of license. •Distribute executable version of Covered software/ownership of rights under different license, only when such distribution is in compliance with terms of this license and are not violating or limiting the recipient's right.
  • 13.
    PLATFORM LICENSE TERMS Android (Permissive License) Apache Software License Version2.0 (Apache 2.0) üReproduce, prepare Derivative Works of publicly display, publicly perform, sublicense, distribute the Work and such Derivative Works in Source or Object form. üSublicense üPrivate use üCommercial use ü Warranty üDocument the changes üRedistributions of source code must retain copyright notice üCopyright statement of modified version may provide additional or different license terms and conditions üInclude Notice
  • 14.
    Due-Diligence while acquiringa Software Product • Understand the Platform/Type of OSS used for Product Development (Android) • Assess the License Rights given as part of the Platform. • Evaluate modified component/part of the source code of the Software Product, and source of such modified component. • Confirm the License rights given by said source of the modified component (say modified component is from a Copyleft OSS) • Evaluate the Risk or Propriety of using the Modified source code, and type of obligations that such license terms of the modified source code that the Corporate gets exposed to (complete Software gets exposed to be treated under a Copyleft OSS)
  • 15.
    Artifex v. Hancom2017 • The latest case involved Ghostscript, a PDF interpreter developed by Artifex Software that was made available under the open source GPL license (free of cost) or a commercial proprietary license (royalty charge). • Hancom used the Ghostrip without purchasing commercial license. • Artifex sued Hancom, both for copyright infringement and for breach of contract, based on the terms of open source software license (GPL). Defendant’s Argument ¨ Defendant did not sign anything, thus no license can be constituted, hence no breach is done. ¨ Plaintiff can not seek monetary relief as the license was free. Thus, there was no damage to be held. Plaintiff’s Argument ¨ Defendant used Ghostcript without obtaining commercial license, who represents that the use of Ghostscripts were used under GPL GNU. ¨ Defendant did not comply to the terms of GPL GNU i.e. they did not make their software that used Ghotscript, an open source, conflicting the term clause 6 of OSS license.
  • 16.
    • COURT: Threeways to use Ghostrip: 1. Obtain commercial license 2. Use Ghoscript under GPL without modification or distribution 3. Modify or distribute Ghostscript under GPL and make the resulting product open source. • The moment OSS is used, the user is obliged with its terms. Non-compliance of OSS license leads to breach of contractual obligations. • GNU GPL is a legal contract
  • 17.
    CONCLUSION • Very importantto understand how OSS is being modified by employees, and know the source of the modified content along with license terms that the source complies with. • Critical to know the terms of the OSS during commercialization to avoid obligations of sharing the modified source code (unless its strategic and intentional) • Have regular third-party audits • Take declarations/undertaking from Product Owners/Sellers/Licensors to ensure that they indemnify in case of license non-compliance by licensee
  • 18.
    THANK YOU KHURANA &KHURANA | IIPRD New Delhi . Noida. Bangalore . Mumbai. Pune . Hyderabad . Indore US (California) . Malaysia . Vietnam . Bangladesh . Nepal . Sri Lanka . Myanmar