Formal terms: GPL vs AGPL · GPL copyleft mainly applies on binary distribution; AGPL adds a network-use trigger.
Teams often lump "GPL family" licenses together. For compliance work they behave differently. SourceTrust shows separate checkboxes so you do not treat a SaaS-only AGPL dependency like a plain GPL library.
GPL (and most copyleft except network variants)
- Typical trigger: you convey or distribute the software (installer, mobile app, on-prem VM image, firmware).
- SaaS-only use of GPL libraries has traditionally been analyzed differently from distribution. Many products never trigger GPL source-offer duties if they never ship binaries.
- SourceTrust checkbox: "Review source duties if you distribute this package" (Review source duties if you distribute this package).
AGPL (Affero GPL) and other network-copyleft licenses
- AGPL was written to close the "ASP loophole": offering modified AGPL software as a network service can require offering source to users who interact with it remotely.
- Two checkboxes on the same AGPL component appear only in Mixed. The default SaaS context shows the network / SaaS review. Source-distribution review appears in Distributed binary, Library or SDK, and Mixed; actual source duties depend on what you convey and the applicable license terms.
- SourceTrust checkbox for SaaS: "Review network / SaaS exposure" (Distribution and network-use review). Not shown for GPL-only licenses.
Quick decision table
- GPL library, SaaS only, no binaries shipped → focus on whether distribution ever happens; network checkbox does not appear.
- GPL code delivered in desktop/mobile/on-prem binaries or a compiled/bundled SDK → review the conditional source checklist, then acknowledge after meeting the applicable terms.
- AGPL library in your live API or hosted UI → acknowledge network review (and copyleft if you also ship binaries).
SSPL, OSL, and similar licenses follow the network-copyleft pattern like AGPL, not the GPL-only pattern. This article is a plain-language map, not legal advice.