SourceTrust automates notice obligations: we store license text and show it on your attestation page and in exports. External obligations are different. They are real-world steps only your team can perform (shipping source, placing attribution in the product, copying NOTICE into installers). We surface them as checkboxes on each package so nothing ships by accident.
GPL vs AGPL (read this first if both checkboxes appear)
GPL copyleft mainly applies when you ship binaries. AGPL (and SSPL, OSL) can also apply when users access your service over the network. SourceTrust shows separate checkboxes so you handle each trigger. Full comparison: GPL vs AGPL (two different triggers)
Apache-2.0 asks you to carry its NOTICE file into what you distribute. ECL-2.0 is Apache-2.0 with one added clause, so it carries the same step, and a package under it now raises the same checkbox when you distribute.
Guides for each obligation type
- GPL vs AGPL (two different triggers)
- Review source duties if you distribute this package
- LGPL linking compliance
- Distribution and network-use review
- Review NOTICE duties if you distribute this package
- Review the terms for fonts you distribute
- CC-BY: credit the creator