Skip to main content
SourceTrustSign in

Help center

Guides for SourceTrust: Importing dependencies, reviewing licenses, external obligations, publishing attestation pages, billing, plain-language license explainers, and procurement-oriented explainers for common open-source licenses.

Review source duties if you distribute this package

← All articles

Copyleft source duties depend on the license and the covered code you actually deliver, including a compiled or bundled SDK. A listed dependency alone does not prove redistribution.

Review whether you convey covered code. Meet the applicable license’s source requirements, or acknowledge after confirming that the stated distribution trigger does not apply.

When this review appears

Shown for copyleft licenses in Distributed binary, Library or SDK, and Mixed. Actual duties depend on what you convey. AGPL network use has a separate review: GPL vs AGPL (two different triggers).

Before you acknowledge

  1. Check whether this package’s code ships in your app, installer, compiled library or bundled SDK. Merely listing a dependency does not establish that you convey it.
  2. For code you convey, identify the license’s covered source scope and permitted delivery method. GPL may cover a combined work; MPL/EPL focus on their covered files or component. A public URL or written offer is not always sufficient.
  3. Satisfy the applicable terms before acknowledging. Source-only delivery need not add a binary source offer. If the stated trigger does not apply, acknowledge after confirming that conclusion.

GPL can require corresponding source for a covered combined work. MPL covers its covered source files and modifications; EPL covers the Program and applicable Modified Works. These scopes do not automatically cover every independent part of your product. Check the actual license version, exceptions and delivery method.

For a source-only library, comply with the applicable source-distribution terms; an additional binary source offer is not automatically required. For a dependency you merely declare and never convey, you may acknowledge after confirming the stated trigger does not apply. SourceTrust records your review; it does not determine which bytes you ship or supply source for you.

AGPL shows both the source and network reviews only in Mixed. SaaS shows the network review; Distributed binary and Library or SDK show the source review. See GPL vs AGPL (two different triggers) and Distribution and network-use review.