2

We are trying to use a package released by a commercial entity for use with one of their reporting software. I think it was closed source at one point then they converted it to a "Community" release and re-released it as a open source project on Github.

Now, the problem I'm facing is that the project is released under Apache 2.0 license but when I looked through the sources, some of the files under the "lib" folders have "CC BY-NC-SA" license at the top of the source file like this:

/**
 * CC BY-NC-SA License
 * (...) by (...) is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
 * Based on a work at http://github.com/(...) 
 *
 */

How does this work in terms of licensing? Does this make the whole project Non-Commercial? Or, does this get overridden by the Apache 2.0 license at the project level? By the way, the author of the source mentioned above is also part of the team that released the top level project.

blissfool
  • 163
  • 3

1 Answers1

6

There is no universal rule. You have to file a bug and ask.

In general, it is probably safest to assume that the most restrictive or most specific license terms apply, unless there is some indication that the author intended to dual-license (i.e. that they wanted to let you choose which license terms to follow). In this case, that means you're probably safest in assuming that the individual files are CC-BY-NC-SA as indicated, and not under the Apache license. It is possible that the author(s) intended to let you choose between the Apache license and the CC-BY-NC-SA license, but this would make very little sense as the Apache license is much less restrictive than CC-BY-NC-SA.

The project really should have some sort of README or LICENSE file which explains these issues more explicitly. If they have a copy of the Apache license in the project root, but some of the individual files have a different license, then it's unclear what the Apache license is meant to apply to. If you can't find any clear explanation of the licensing terms and what falls under them, you should file a bug and ask for this information to be documented somewhere.

Finally, note that Creative Commons licenses were not intended to apply to software. Using them for software, as this author has apparently done, is generally not recommended. In particular, the ShareAlike condition does not require licensees to release their source code, unlike (say) the GPL, so ShareAlike licenses are less effective than the GPL in most contexts. This isn't really something you can fix, but the authors of this software should probably reconsider their choice of license.

Kevin
  • 5,307
  • 1
  • 17
  • 23
  • Thank you for the answer. I have created an issue in their github repository. It's been a week and they have not provided any response. I will have to see if there is a way to contact them more directly. – blissfool Oct 01 '21 at 21:32
  • You should know that in the US, restrictions on use in licenses have no effect. See 17 USC 106 which lists the six things you need permission or a license to do with a copyrighted work. You can simply refuse to agree to the license and you still have all the rights to the normal use of the work because US law doesn't restrict normal use to just the copyright holder or licensees. Just as you don't need a license to read a book you lawfully acquired, you don't need a license to use a library you lawfully acquired. – David Schwartz Oct 04 '21 at 19:02
  • @DavidSchwartz: In this context, "using" a library means creating a piece of software which dynamically or statically links to that library. Static linking almost certainly implicates at least one of the rights in 17 USC 106 because it requires you to incorporate the entire library as part of the software. Dynamic linking is contended to create a derivative work, but there is no clear legal precedent for or against this position. Regardless, the "use" of a library without actually doing some kind of linking is not meaningful because libraries do not have other reasonable uses. – Kevin Oct 04 '21 at 19:07
  • @Kevin I agree with everything you've said. I think you may think it contradicts something I said, but it doesn't. Yes, the right to ordinary use might sometimes include things that would, if not part of ordinary use, implicate a right in 17 USC 106. Nevertheless, ordinary use is permitted. Once you lawfully own a work, you have the right to its ordinary use. You don't need a license to use a work you lawfully possess in the ordinary and expected ways -- that's what you acquire when you acquire the work. – David Schwartz Oct 04 '21 at 19:35
  • @DavidSchwartz: There are two cases: Either you distribute the resulting software, or you don't. If you don't, then neither of the licenses I discuss in this answer purports to impose any restrictions on you in the first place (nor does the GPL, or indeed any open source license, with some odd exceptions like the AGPL). If you do, then you're potentially engaged in the distribution of a derivative work (and/or copies thereof), which is not "ordinary use" under any theory of law I have ever heard of. – Kevin Oct 04 '21 at 19:54
  • @Kevin Nothing in the question suggests that the OP is interested in commercial distribution. The OP could, for example, engage in non-commercial distribution to people who plan to use the software commercially or just their own local commercial use. That's why I made it clear that this was just something the OP should know and not a complete answer to their question. This is a quirk of US law that might be helpful to the OP, not an answer to the licensing question. (Also, it's US only. Many other jurisdictions are very different.) – David Schwartz Oct 04 '21 at 20:01
  • @DavidSchwartz: I never said "commercially" in my comment. Where did you get that from? Any distribution of copies of a derivative work is going to implicate the license. If it is noncommercial, it could be fair use, of course, but that's largely irrelevant to the question. – Kevin Oct 04 '21 at 20:04
  • @Kevin Then I'm a bit confused. The impression I got is the OP is concerned that he has a work whose license forbids commercial use. He asks if this makes the entire project non-commercial. I'm pointing out to him that, at least in the US, you can engage in commercial use even if the license forbids it because a license has no effect on someone who doesn't accept it. So long as there are some parties who only wish to engage in commercial use, they are okay under US law. – David Schwartz Oct 04 '21 at 20:06
  • @DavidSchwartz: Ah, I see. Let me repeat myself: Both licenses already allow unlimited use of any kind which is permitted by copyright law. CC-BY-NC-SA says this very clearly in section 8(a) (in version 4.0, older versions may be sectioned differently). The Apache license does not say so explicitly, but it may reasonably be inferred from the overall structure and character of the license. So if OP wasn't planning on doing things which require a license, then they would not need to inquire about which license applies in the first place. It would be a moot question. – Kevin Oct 04 '21 at 20:10
  • @Kevin Yes. So we are in complete agreement. We have now pointed out the same thing -- use (even commercial use) doesn't require a license under US law. This is surprising to a lot of people, but not an answer to the OP's question, so I pointed it out in a comment. – David Schwartz Oct 04 '21 at 20:17
  • @DavidSchwartz: I see. I struggle to understand how I can improve my answer by incorporating this information, however. OP clearly asked "How do I determine which license applies?" and I answered that question. I don't think that adding "And also you should read the license, and familiarize yourself with the copyright law of your jurisdiction" would actually improve my answer, because it has nothing to do with determining the applicable license (which was the question asked). Perhaps you should have commented on the question instead. – Kevin Oct 04 '21 at 20:20
  • Wow. I didn't realize there were so many follow-up comments. I am planning to use this project as one of the component in our commercial product, which is why I'm having this dilemma. – blissfool Oct 18 '21 at 18:51