I found several libraries on GitHub that I plan to use for a commercial application. They are all licensed under MIT or Apache 2.0. Having studied them, I realized that I can use them for free in development, but does this oblige me to publish its code in open sources after developing the application?
2Note that you can also open source your commercial application. Here is a list of Business models for open-source software. One more thing, if your application rely on open source, you may want to contribute or donate to them to keep them alive and thriving.– aloisdgJul 28, 2022 at 8:50
You'll want to read the actual licenses yourself and understand what is required. If you don't understand, then you'll want to consult an attorney.
But neither of these licenses are all that complex in my opinion.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
- Apache 2.0:
- Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
(a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
Nowhere does either license require you to publish your application's source code, even if your application is directly based on the original code.
2I don't know how log4j came in here, but there are widespread versions around containing the mother of all vulnerabilities, so be very very very careful to get the correct version of this library if you think you need it. Jul 27, 2022 at 11:57
11"Call it turbolog4j. Now you are required to make your source code available since you have created a derivative work." - this is not true, for MIT or Apache. You only need to include the copyright notice. If log4j was GPL or LGPL, you'd have to make the source code available, unless you didn't make your library available at all. Jul 27, 2022 at 12:00
Thanks for the clarification.– jwh20Jul 27, 2022 at 12:44
9Please do not, in future, include images of text in posts to this site, either in questions or in answers. See law.meta.stackexchange.com/questions/1479/… Jul 27, 2022 at 17:10
Neither the MIT license nor the Apache 2.0 license requires a user to publish anything, even if the user has created a modified version or a derivative work based on an original that s/he received under either license. What they do require is that if the user distributes the code, it must be with similar rights.
More specifically, the MIT license requires that if the user "furnishes" the software to others, they must be granted the same permissions to "deal in" the work that the user got under the MIT license.
The Apache 2.0 license requires that if the user decides to "reproduce and distribute copies of the Work or Derivative Work" then certain things must be included in the distribution, which will have the effect of putting that distribution under the same license. See the detailed license text elsewhere in this thread or available on the web through an easy search.