Reporight

License families

Licenses come in patterns. Learn the six and you can reason about a repository before you have read a word of its LICENSE file.

Permissive

Permissive

Broad reuse — including inside proprietary products — in exchange for keeping notices intact.

MIT · ISC · Apache-2.0 · BSD-3-Clause · BSD-2-Clause

You can

  • Use the code commercially, privately, and inside closed-source products
  • Modify it and distribute your modified version
  • Sublicense it as part of a larger work under your own terms

You must

  • Keep the original copyright notice and license text with copies you distribute
  • State the license of the incorporated code in your distribution or docs

You cannot

  • Strip required notices or claim you wrote the original work
  • Expect a warranty, support, or liability cover from the authors
  • Imply the authors endorse your product

Weak copyleft

Weak copyleft

Changes to the licensed files stay open; the rest of your program usually does not have to be. Read before embedding.

MPL-2.0 · EPL-2.0 · LGPL-3.0 · LGPL-2.1

You can

  • Use the library in a larger work that has a different license, including a proprietary one
  • Distribute the combined work commercially

You must

  • Publish your changes to the licensed files under the same license
  • Keep notices, and tell recipients where to get the licensed source
  • Preserve the recipient's ability to relink or replace the library (LGPL)

You cannot

  • Take modifications to the licensed files private
  • Add restrictions that block the rights this license grants downstream

Strong copyleft

Strong copyleft

Share-alike reaches the whole derivative work. Combining it with proprietary code you ship is the classic contamination risk.

GPL-3.0 · GPL-2.0 · AGPL-3.0

You can

  • Use, study, and modify the code, including commercially
  • Distribute your derivative work under the same license

You must

  • License the entire derivative work under the same license when you distribute it
  • Offer complete corresponding source to anyone who receives a binary
  • Keep notices and document your changes

You cannot

  • Ship a derivative work as closed source
  • Add terms that restrict the freedoms this license grants downstream
  • Apply DRM or patent terms that defeat the license's guarantees

Public domain / equivalent

Public domain / equivalent

The author waived essentially all copyright interest. Maximal freedom, but a few caveats survive.

Unlicense · CC0-1.0

You can

  • Use, modify, and distribute for any purpose, with or without attribution
  • Relicense the result however you like

You must

  • Nothing, in copyright terms — attribution is courtesy, not obligation
  • Still check for trademark and patent claims, which a waiver may not cover

You cannot

  • Assume the waiver is valid in every jurisdiction (some do not permit dedication to the public domain)
  • Assume any warranty or patent grant comes with it

Source-available / restricted

Source-available / restricted

The source is published, but the license restricts what you may do with it. This is not open source, and the restriction is usually aimed squarely at commercial use.

You can

  • Read the source, and generally use it internally or for development and testing
  • Modify it for uses the license actually permits

You must

  • Read the specific restriction before you build on it — competing-service clauses (SSPL), change dates (BUSL), and non-commercial limits all behave differently
  • Check your company's policy: most treat these as blocked by default

You cannot

  • Assume OSI-style freedoms — offering it as a service, or shipping it commercially, is what these licenses exist to prevent
  • Treat it as interchangeable with the permissive license the project may have used previously

Proprietary / no license

Proprietary / no license

Default copyright applies. Public visibility on GitHub is not permission to reuse.

You can

  • View the code, and fork or clone it through GitHub's own features (GitHub's Terms of Service grant that much)

You must

  • Get written permission from the copyright holder before using this in your project

You cannot

  • Copy, modify, distribute, or ship this code without a license from the owner
  • Treat 'public on GitHub' as 'open source'

Unknown / conflicting

Unknown / conflicting

The signals do not agree or the text is not a recognizable standard license. Do not guess — read the evidence and get a human to decide.

You can

  • Read the evidence below and check the source on GitHub

You must

  • Have a person review the actual license text before you depend on this code
  • Treat it as 'no permission granted' until that review lands

You cannot

  • Assume it is permissive because the project looks like others that are
  • Rely on Reporight's family guess here — there isn't one

License-specific landmines

  • Apache-2.0Apache License 2.0
    • Ships an express patent grant — and terminates it if you sue a contributor over patents in this work.
    • If the project has a NOTICE file, you must pass it along with your distributions.
    • You must mark files you changed.
  • BSD-3-ClauseBSD 3-Clause "New" or "Revised" License
    • The third clause bars using the project's or contributors' names to endorse your product without permission.
  • CC0-1.0Creative Commons Zero v1.0 Universal
    • CC0 explicitly does not grant patent or trademark rights.
    • Creative Commons recommends against CC0 for software; some organizations' policies flag it.
  • MPL-2.0Mozilla Public License 2.0
    • Copyleft is per-file: modified MPL files stay MPL, the rest of your codebase does not have to.
  • EPL-2.0Eclipse Public License 2.0
    • File-level copyleft plus a patent grant; commercial distributors take on indemnity obligations to other contributors.
  • LGPL-3.0GNU Lesser General Public License v3.0
    • Dynamic linking from a closed-source program is generally fine; static linking obliges you to let users relink a modified library.
  • LGPL-2.1GNU Lesser General Public License v2.1
    • Same linking nuance as LGPL-3.0, with older, vaguer wording around 'works that use the library'.
  • GPL-3.0GNU General Public License v3.0
    • Adds anti-tivoization: consumer devices must let users install modified versions.
    • Includes an express patent grant.
  • GPL-2.0GNU General Public License v2.0
    • Check whether the project says 'version 2 only' or 'version 2 or later' — it changes what you can upgrade to.
  • AGPL-3.0GNU Affero General Public License v3.0
    • The network clause is the landmine: if users interact with your modified version over a network, you must offer them its source — no distribution required.
    • Many companies block AGPL outright in their open-source policy. Check yours before you start.

Families are assigned from Reporight's own guidance catalogue, falling back to the license category published by the ScanCode LicenseDB (AboutCode, CC-BY-4.0), which covers 821 SPDX identifiers. This is not legal advice. Your obligations depend on how you use the code and your jurisdiction. Consult counsel for production risk.