# Open source license compliance
> Source: https://legalcode.md/skills/legalcode-open-source-license-compliance | [HTML version](https://legalcode.md/skills/legalcode-open-source-license-compliance)

Audit open-source software license compliance for any project or dependency inventory.

Audit open-source software license compliance for any project or dependency inventory. Use when reviewing a software project for OSS license obligations before distribution, when assessing license compatibility in combined works, when evaluating copyleft obligations triggered by binary distribution or SaaS network use, when reviewing contributor license agreements (CLAs) and Developer Certificate of Origin (DCO) frameworks, when generating SBOM documentation to meet EO 14028 or EU CRA (Reg. 2024/2847) requirements, or when designing an enterprise open-source policy. Covers: license identification and classification (permissive / weak copyleft / strong copyleft / network copyleft); license compatibility analysis for combined works; attribution and NOTICE file requirements (MIT, Apache 2.0, BSD, GPL, AGPL); copyleft obligation triggers (distribution, static/dynamic linking, AGPL § 13 network use); patent grant and retaliation clause analysis (Apache 2.0 § 3, GPL v3 § 11); commercial distribution requirements; SaaS network use implications; CLA and DCO review; open-source policy framework development; SBOM generation requirements; dependency chain analysis for transitive obligations; and remediation strategies for license conflicts. Produces a compliance audit report with severity- classified findings and prioritized action items. Jurisdiction-agnostic with [JURISDICTION-SPECIFIC] markers for US, EU, Germany, and France.

This skill audits software projects for open-source license compliance obligations. It identifies all licenses present in a dependency tree, classifies them by copyleft strength and compatibility, determines which obligations are triggered by the distribution model, flags attribution gaps and missing SBOM documentation, and produces a confidence-scored, auditable compliance report with a prioritized remediation plan. **Covers:** - License classification (permissive, weak copyleft, strong copyleft, network copyleft, source-available, no license) across npm, Maven, PyPI, Go modules, Cargo, and other ecosystems - License compatibility analysis for combined works (especially GPL v2/v3, Apache 2.0, LGPL, MPL 2.0, AGPL interactions) - Copyleft obligation triggers: distribution, static/dynamic linking, AGPL § 13 network use - Attribution and NOTICE file requirements (MIT, Apache 2.0, BSD, GPL, AGPL, MPL) - Patent grant and patent retaliation clause analysis (Apache 2.0 § 3, GPL v3 § 11, MPL 2.0 § 2.1) - CLA review (ICLA, CCLA, DCO, Harmony Agreements) - SBOM generation requirements under EO 14028, NTIA minimum elements, and EU CRA (Regulation 2024/2847 Articles 13–14, Annex I Part II) - Dependency chain analysis for transitive license obligations - Open-source policy development (inbound/outbound, license approval tiers, governance) - Remediation strategies for license conflicts **Does not:** - Provide legal advice or replace ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*