►
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
BoF: Intro to Open Source Licenses and Q&A - Jeff Shapiro, The Linux Foundation
Speakers: Jeff Shapiro
All open source projects contain one, and possibly many open source licenses. Whether you are consuming, contributing, or using a project downstream with your own code, you need to understand how those licenses will impact your project and your company. We will start with an overview of basic license information, and then open up the floor to discussion and Q&A for more advanced license topics, as well as your specific project use cases. This BoF session is suitable for anyone who wants to know more about open source licenses, from beginner to advanced topics. The presenter is the License Scanning Manager for The Linux Foundation, and has 30 years experience in the software industry, including 10 years in software auditing, open source license scanning, and training developers in OSS license compliance.
A
So
what
I
want
to
do
today
is
talk
to
talk
to
you
guys
and
first
get
an
idea
of
what
you
want
and
I.
Don't
know
how
many
virtual
attendees
there
are
so
I
think
what
what
I
have
to
do
is
work
with
the
feedback.
I
can
get
from
you
guys
so
to
start
with
I'm
Jeff
Shapiro
I
work
for
the
Linux
Foundation
I'm,
the
licensed
scanning
manager,
so
I've
worked
been
working
with
open
source
licenses
for
a
long
time.
A
A
A
A
My
goal
is
to
basically
teach
you
about
open
source
licenses
and
why
they're
important
and
what
is
that?
What
do
the
license
mean
and
and
then
specifically
for
today,
because
it's
a
birds
of
feather
format?
My
goal
is
also
to
answer
as
many
questions
as
possible
and
and
listen
to
listen
to
what
you
guys
want.
A
So
a
license
defines
the
rights
and
obligations
that
a
licenser
grants
to
a
licensee.
What
does
that
mean?
It
means
that
the
person
who
writes
the
code,
the
author,
they
get
to
choose
what
license
it's
under.
If
they
don't
choose
anything,
it's
not
open
source.
It's
essentially
like,
like
I
mean
you
can
still
put
the
code
up
on
the
internet,
but
if
you
don't
specify
a
license,
then
it
doesn't.
It
doesn't
give
anybody
any
rights
to
use
it
in
any
particular
way.
A
So
the
rights
that
you
typically
get
with
an
open
source
license
as
I
said,
let
you
inspect
and
copy
the
source
code,
make
modifications
and
create
derivative
works.
So
you
are
using
that
open
source,
you're,
mixing
it
with
other
open
source
or
with
maybe
commercial
or
proprietary
code,
and
the
obligations
that
you
typically
have
with
most
open
source
licenses
are
often
provide
attribution,
so
you're
acknowledging
that
you're
using
it.
A
You
may
have
to
contribute
changes
if
you
make
them,
depending
on
the
license,
depending
on
whether
the
license
is
there's
two
classes
of
license
which
I'll
talk
about
in
a
minute.
Some
of
them
require
that,
if
you
create
a
derivative
work,
where
you
combine
the
open
source,
then
you
are
required
to
license
that
that
new
work
or
that
new
body
of
code
under
the
same
license
as
the
open
source
and
also
very
important,
almost
all
licenses
will
disclaim
warranty
and
liability.
So
you
use
it
at
your
own
risk.
A
A
They
generally
allow
you
to
use
the
code
for
almost
anything.
You
want
the
copyleft
licenses
like
the
GPL
lgpl
style
licenses.
They
also
allow
you
to
use
the
code,
but
they
have
stronger
obligations.
So
if
you
are,
if
you
have
your
own
code,
that
you
are
writing
and
you
are
mixing
it
with
open
source,
that's
under
your
GPL
license
that
will
the
GPL
license
requires
that
the
combined
work,
your
code
plus
the
open
source
together
that
that
be
released.
A
If
you,
if
you
distribute
it,
if
you
send
it
out,
you
don't
have
to
sell
it
just
even
giving
it
away.
Then
you
are
required
to
license
that
new
combined
work,
including
your
code
under
that
GPL
license,
and
that's
why
they're
called
copyleft
licenses
they're
sometimes
called
viral
licenses.
I'm,
not
everybody
likes
that
name,
but
but
it
is
a
common
term.
A
So
the
the
main
purp
one
of
the
main
purposes
of
a
copy
left
license
is
to
ensure
that
the
code
will
remain
open
source.
So
if
you
have
code
under
a
permissive
license
like
a
BSD
or
MIT
license-
and
you
combine
it
with
your
own
code,
you
can
then
re-license
all
of
that
under
a
proprietary
license.
Let's
say
you
work
for
a
company.
A
Your
company
may
want
to
sell
that
as
a
product
and
they
can
re-license
that
combined
work
and
then
that
original
code
excuse
me
the
the
open
source
that
you
use
is
still
available
to
anyone
else
under
the
same
open
source
license.
But
the
combined
work
is
now
under
the
license
that
you
choose,
because
the
permissive
license
allows
you
to
re-license
the
combined
work.
The
copyleft
license.
Does
not
allow
you
to
do
that,
so
let
me
let
me
take
a
moment
and
stop
since
again,
since
this
is
more
of
a
a
discussion
format.
A
B
A
A
No
that's
a
great
question,
so
it
depends
on
the
services
that
you're,
providing
if
you're,
providing
tech
support
or
if
you're
answering
questions
or
giving
tips
on
how
to
use
it.
If
you're
not
actually
Distributing
the
code,
then
you
can
provide
whatever
Services
you
want
and
the
license
doesn't
impact
your
providing
services.
In
most
cases,
the
license
takes
effect
when
you
distribute
the
code
or
redistribute
it
so.
B
B
B
A
A
The
agpl
is
a
little
bit
different
than
most
other
licenses.
The
agpl
says
in
so
other
licenses
typically
say
these.
These
obligations
take
effect.
When
you
ship
the
code
you
distributed
somebody
the
agpl
is
different.
It
says
these
obligations
take
effect
if
you
use
our
code
on
your
server
and
it's
on
the
same
server
or
the
same
network
as
your
other
code.
So
it's
license
obligations.
Basically
Reach
Out,
And
Touch,
everything
on
the
server
or
on
the
network.
So
it
is
a
a
a
lot.
A
It's
a
very
tricky
complex
license
if
you
are
having
a
hosted
Solution
on
AWS
and
by
the
way.
I
should
preface
this
with
saying
that
I'm,
not
a
lawyer,
I'm,
an
engineer,
and
even
if
I
were
a
lawyer,
I
couldn't
give
you
legal
advice
in
this
forum.
I
would
need
to
need
to
advise
you
to
consult
your
own
legal
counsel.
That's
my
you
know
warranty
that
I
have
to
give,
but
the
agpl
will
affect
other
things
on
the
server
and
it
really
depends
on
what
you're
doing
with
that.
A
But
if
you
are,
if
you
have
other
code
on
that
server,
the
agpl
will
most
definitely
or
most
likely
almost
certainly
affect
everything
else
on
the
server
now,
not
necessarily
the
operating
system.
You
have
to
think
about
what
sort
of
like
the
what
layer
it's
at,
but
but
if,
if
you
are
using
agpl
licensed
code
on
a
server,
it
will
impact
and
and
very
likely
require
you
to
re-license
your
own
code
on
the
server
as
a
GPL.
A
A
Just
because
you
can
do
something
doesn't
mean
you
should
do
something.
I
think
a
an
analogy
that
I,
like
with
open
source
licenses,
is
most
people
here.
Probably
everybody
here
has
a
driver's
license
and
drives
on
the
freeway
at
some
point.
In
time,
most
areas
of
the
country
have
a
speed
limit
on
the
freeway
of
65
miles
an
hour,
sometimes
a
little
more.
How
many
people
here
in
the
audience?
Let's
see
a
show
of
hands,
how
many
people
here
drive
exactly
65
or
less
all
the
time?
A
Okay,
I,
don't
see
a
single
hand,
I'm,
not
raising
my
hand
either.
So
you
know
we
all
drive
70
75,
sometimes
so
open
source
licenses
are
kind
of
the
same
way.
You
can
do
something
that
violates
the
terms
of
the
license,
but
it
doesn't
mean
that
you
should
right.
You
can
use
code
under
a
BSD
license,
which
is
very
permissive
and
forget
to
acknowledge
or
give
attribution
doesn't
mean
that
your
program
is
going
to
implode
and
stop
working.
It
just
means
that
you
didn't
follow
the
terms
of
the
license.
In
many
cases
nothing
will
happen.
A
The
people
who
wrote
the
code
couldn't
could
come
back
and
say:
hey
you
didn't
give
us
acknowledgment,
you
know
if
you're,
a
small
company
or
an
individual
that
may
be
pretty
unlikely,
I'm,
not
suggesting
you
do
it,
but
if
you're
a
really
big
company,
you
have
more
risk
exposure.
You
need
to
be
more
careful
about
it.
A
A
A
A
This
is
a
licensed
example
that
I
normally
talk
about
in
in
detail.
I'm
not
gonna,
talk
about
it
except
to
say
that
this
this
is
the
MIT
license
and
if
you
read
through
it,
it
gives
an
example
of
basically
what
I've
talked
about.
The
top
part
are
the
permissions
or
the
rights
that
the
license
gives
you
the
middle
paragraph,
that
middle
sentence
says
notice
shall
be
included.
That's
the
that's
your!
That's
your
attribution,
that's
the
obligation
that
you
have.
You
have
to
give
attribution,
and
the
bottom
is
the
warranty
disclaimer.
A
The
software
is,
as
is
I,
want
to
point
out
that
a
copyright
is
not
a
license.
I'm
not
going
to
talk
about
this
in
too
much
detail
at
the
moment,
and
then
we
have
a
few
other
things
that
people
in
the
open
source
Community
you
know
about
that
are
different
than
open
source
licenses.
We
have
a
contributor
license
agreement,
which
is
it's
a
license.
So
it's
an
agreement,
but
it's
not
the
same
as
an
open
source
license.
What
the
con
with
the
CLA
is,
what
it
does.
A
Is
it
you
as
a
contributor
or
an
author?
If
you
are
giving
codes
to
an
open
source
project
kubernetes
or
something
else,
it
basically
gives
the
project
the
right
to
use
the
code
that
you're
contributing,
and
it
also
requires
that
you
are
giving
them
the
right
to
re-license
your
code
or
license
your
code
under
the
same
license
as
the
project
itself.
A
So,
if
you
go
to
the
kubernetes,
GitHub
page
you'll
see
a
contributing.md
and
you
go
down
a
couple
levels
and
you'll
find
a
contributor
license.
Agreement
and
you'll
see
the
the
legal
text
that
says
you
number
one.
You
have
the
right
to
contribute
this
code,
you
you
were
the
author
or
otherwise
have
the
right
to
contribute
it
and
you
are
giving
us
the
right
to
release
it
under
the
project
license
which
in
that
case
is
Apache.
2.0
there's
also
something
called
a
dco
developer
certificate
of
origin.
A
Lgco
is
a
bit
different
than
a
cla.
A
dco
is
essentially
a
certificate
or
a
representation.
Saying
I
am
I,
am
the
author
of
the
code
or
I
otherwise
have
the
right
to
contribute
the
code
so
there's
some
similarities,
similarities
between
the
two
but
they're
not
the
same,
and
then
I
talk
about
spdx
I'm
going
to
come
back
to
that
later.
If
we
have
time
just
simply
you've
most
of
you
may
hopefully
you've
heard
of
a
bill
of
materials
or
an
s-bomb.
A
The
spdx
one
small
piece
of
the
spdx
is
something
called
a
license
identifier.
So
if
you're,
if
you
are
contributing
or
or
or
writing
your
own
open
source
project,
it's
a
really
good
idea
to
use
these
license
identifiers.
It
makes
other
people's
lives
much
easier.
As
far
as
identifying
the
license
that
the
code
is
under,
there
are
examples
of
dual
licenses.
A
A
So
at
the
top
we
have
permissive
open
source,
mixing
it
with
proprietary
code
and
what
we
end
up
with
is
proprietary
code
in
the
middle
we
have
a
weak
copyleft
license
such
as
lgpl
Mozilla,
Eclipse
public
license,
and
what
we
end
up
with
is
a
combination
where
the
the
way
you
are
releasing
the
code
actually
matters
a
lot.
So
are
you
releasing?
Are
you
combining
source
code
and
compiling
it
into
one
binary,
object
or
one?
You
know,
processor,
one
executable?
A
A
So
I
asked
you
know,
what's
your
level
of
expertise
and
licenses,
and
a
lot
of
you
were,
you
know
pretty
pretty
new
to
licenses.
Let
me
ask
by
a
show
of
hands
for
everybody
here.
How
many
of
you
are
are
mostly
consuming
or
are
an
end
user
of
Open
Source
okay,
looks
like
about
half
and
how
many
of
you
are
contributing
code
to
open
source
projects
also,
roughly
about
half.
So
that's
a
good
mix
so.
A
A
Are
you
mixing
it
with
proprietary
code,
which
I
gave
the
example
of
so
you
need
to
you
need
to
think
about
that.
That
makes
a
big
difference.
You
know
whether
you
are
looking
at
open
source
under
a
permissive
versus
a
copy
left
license
if
you're
contributing
code,
then
you
know,
are
you
writing
all
that
code
yourself?
A
A
So
you
wanna,
you
wanna,
take
a
careful
look
at
those.
If
you
work
for
a
company
most
of
many
of
us
work
for
companies.
If
you
work
for
a
company,
then
the
company
may
be
responsible
for
the
CLA
or
the
dco,
and
then
you
want
to
check
with
your
your
legal
team
at
the
company
that
you
work
for,
if
you.
A
A
Okay,
a
couple
of
you
so
a
few
of
you.
If
you
are
writing
your
own
and
you're,
choosing
a
license,
also
think
about
your
use
case.
I
like
that
word,
a
lot
so
I
are.
You
is
your
intention
to
make
that
code
available
to
as
wide
of
an
audience
as
possible?
You
want
anybody
and
everybody
to
be
able
to
use
it
for
whatever
they
purpose.
Whatever
purpose
they
like.
A
Is
your
use
case
that
you
are
writing
open
source
and
it's
really
important
to
you
that
that
code
always
remain
open
source?
If
other
people
want
to
use
your
code,
great
you're
happy
to
have
them
use
it,
but
if
somebody
wants
to
sell
the
code,
you
know,
then
you
know
you,
you
aren't
you,
you
don't
want
them
to
re-license
your
code.
A
A
So
it's
very
common
that
open
source
projects
may
be
released
under
a
what's
called
a
dual
license,
sometimes
even
more
than
two,
but
a
dual
license
does
not
mean
that
both
licenses
apply.
At
the
same
time,
a
dual
license
means
that
there
are
two
licenses
and
the
end
user
gets
to
decide
which
license
applies
to
that
to
to
to
that
use
case.
A
So
so
let
me
mention.
Let
me
talk
about
that
bottom
example:
QT
most
people
have
heard
of
QT
it's
a
a
gooey
gooey
tool
kit.
They
sell
QT
under
a
commercial
license
and
they
also
make
it
available
on
as
open
source
under
the
GPL
license.
Why?
Why
would
they
do
that?
Well,
they
want
anybody
to
be
able
to
look
at
QT,
examine
it.
A
Look
at
the
source
code,
give
it
a
try
and,
if
you're,
using
it
for
your
own
purpose
or
maybe
say
researcher
at
a
university,
you
know
or
something
like
that,
where
you're
not
giving
it
to
anyone
else
or
you
don't
care.
If
your
code
is
open
source,
then
they're
happy
to
let
you
use
it
like
that
for
free.
A
But
if
you're
a
commercial
company-
and
you
want
to
create
a
product
and
sell
it-
and
you
want
to
use
QT
as
part
of
your
product,
then
they're
more
than
happy
to
tell
you
A
commercial
license
for
QT,
which
allows
you
to
redistribute
it
and
keep
all
of
your
code.
Proprietary
and
and
and
then
sell
it
as
a
product
without
any
risk
to
your
code.
And
you
don't
have
to
release
your
code.
A
As,
open
source
and
you're
happy
because
you
get
to
build
a
cool
product
and
ship
it
and
sell
it,
and
QT
is
happy
because
they
get
to.
You
know,
make
a
little
money
and
they
sell
you
a
commercial
license
and
then
there's
essentially
no
open
source
involved.
So
that's
a
good
example
of
of
something
that's
a
dual
licensed
and
then
the
end
user
has
the
choice.
A
A
A
C
C
C
A
A
A
So
if
Q
flow
is
under
Apache
and
they
have
this
dependency
and
then
they
and
then
so
by
the
way
you
touched
on
an
important
point,
which
is,
if
you
own
the
right
to
the
code
you're
the
author
and
you
have
the
copyright
to
the
code,
you
are
allowed
to
change
the
license
anytime.
You
want
that
being
said.
A
If
you
release
open
source
under
the
Apache
License,
whatever
this
dependency,
is
you
release
it
under
Apache,
as
version
1.0,
and
then
you
write
version
2.0
and
you
release
that
under
agpl
1.0
is
always
out
there
under
Apache.
That
will
never
change.
You
cannot
retroactively
change
a
license
for
something
that
you've
already
released.
So
that's
important,
so
Q
flow.
They
can
continue
to
use
that
version
1.0
under
Apache
indefinitely,
and
then
this
dependency
they
they
change
the
license
in
version
2.0
to
agpl
the
Q
flow.
A
They
don't
want
to
use
it
anymore
because
it
would
re-license
it
would
force
them
to
re-license
their
code,
which
they
don't
want
to
do
so.
So
the
people
who
wrote
that
dependency
they
have
every
right
to
to
change
the
license
later
on,
because
it's
their
code
but
yeah.
If,
if,
if
the
original
code
qflow,
if
they,
if
they
were
to
use
that
newer
version,
then
that
copyleft
license
would
would
effectively
relicense
their
code.
So
that's
almost
certainly
why
they
are
choosing
not
to
update
that
code
or
update
the
dependency.
C
A
A
C
A
D
D
A
So
are
you're
asking
about
using
code.
That's
on
stack
Overflow,
for
example.
Yes,
yes,
so
that's
a
great
question
just
because
code
is
available
or
visible
or
on
a
website
does
not
automatically
make
it
open
source
many
websites,
including
a
lot
of
the
websites
like
stack
overflow,
stack
exchange.
Where
you
can
answer
questions
give
code
examples.
Many
of
them
have
a
a
license
or
a
you,
have
to
sign
an
agreement
or
or
acknowledge
that
the
code
that
you
contribute
to
that
website
is
available
to
anybody
under
an
open
source
license.
A
So
some
websites
are
are
better
about
that
and
proactive
and
say
you,
you,
post
code
on
here,
it's
available
to
anybody
under
this
license,
but
before
you
grab
code
off
of
a
website
find
out.
If
does
that
website
specify
that
the
code
is
available
under
us
to
any
reader
under
under
a
specific
license
or
the
person
who
posted
it?
They
may
put
a
license
with
the
code
either
in
the
comment
saying
this
is
available
under
the
Apache
license
or
the
GPL
or
whatever,
or
it
may
be
in
the
header
of
the
code.
A
If,
if
you
can't
find
any
information
about
a
license,
then
you
legally,
you
must
assume
that
the
code
is
not
open
source
and
therefore
it's
essentially
like
proprietary
code.
So
you
don't,
even
though
you
can
read
it,
you
don't
have
the
license.
It's
the
same
thing
like
the
speeding
on
the
freeway
example.
A
A
E
A
A
F
Let's
say,
for
example,
I
author,
a
open
source
code
for
today
and
I
release
it
with
the
Apache
and
a
few
years
down
the
line.
I
change
it
to
something
else.
So
is
this
possible.
That
is
first
question
and
second,
how
will
the
prime,
how
will
the
users
with
the
Apache
License
be
impacted,
meaning
the
primary
license?
What
I
had
open
sourced
with.
A
Okay,
so
if
you
so
so
you
you
release
open
source
under
Apache
and
then
later
you
change
it
to
something
else.
Yes,
so
again,
the
the
the
the
code
that
you
released
under
Apache
will
always
remain
under
the
Apache
license.
And
if
you
change
your
code
or
if
you,
if
you
change
the
license
later,
the
people
who
are
using
it
under
Apache
still
get
to
use
it
under
Apache
forever.
A
And
then,
if
you
change
it,
then
somebody
can
use
your
new
version
under
the
new
license,
but
not
under
Apache,
so
it
impacts
the
code
going
forward.
So
all
the
code
that's
out
there
under
a
certain
license,
will
always
be
under
that
license.
And
if
you
change
the
license
later,
then
people
who
use
the
code,
the
the
original
code
is
well,
it's
a
little
tricky.
A
If
you
make,
if
you
release
a
new
version,
an
updated
version
under
a
new
license,
then
it's
kind
of
easy
to
understand
because
you
have
version
1.0
under
this
license
and
version
2.0
under
a
different
license.
If
you
don't
change
the
code
and
you
just
change
the
license,
but
the
code
is
identical,
then,
essentially
what
you're
doing
is
you're
dual
licensing
the
code.
So
if
you
change
a
license
without
making
any
changes
to
the
code
at
all,
I'm,
not
sure,
if
that's
what
you're
asking
about.
A
But
if,
if
you
don't
make
any
changes,
then
you
have
a
version
of
your
code
under
this
license
an
identical
version
of
your
code
under
a
different
license,
and
then
somebody
can
choose
to
use
it
under
either
license
because
you
already
put
it
out
there
under
the
first
license.
So
you
can't
force
people
retroactively
to
change.
You
know
to
use
it
under
a
different
license
once
you've
put
it
out
there
under
under
the
first
license.