The open source notice requirement in web-based applications

In this document

See also

More and more applications are moving to the Web. Often, such applications present a combination of client- and server-side code. Client-side code, typically written in Javascript, provides a significant performance benefit over server-side code. An enormous amount of Javascript libraries is available as open source, ranging from small snippets that provide form validation to frameworks for building complete client-side applications.

To make software open source, one or more licenses need to be declared applicable. With traditional applications, it was clear how to do this: refer to the license in every source file, and/or include a copy of the license text with each file. However, for Web applications this approach can add significant performance penalties. For example, if a one-file Javascript application were to include the GPLv3 text, that would add some 35 kilobytes to the file size.

In this article I discuss an alternative approach: can one simply refer to the license on an external location, and if so, how extensive should this reference be?

Open source licenses

Open source software is freely available for anyone, including source code. The license grants everyone permission to adapt or improve the source code, for example to fix errors, to make a more efficient implementation or to add completely new functionality. The software may also be copied and distributed freely, even in modified form.

License binding

However, open source software is not public domain. The software is protected by copyright and one must accept the license terms before the software may be modified and distributed. With open source licenses it is not required to explicitly sign an agreement with the author. Typically the author merely adds a license statement in the source code to put recipients on notice.

Including complete license texts in source code is of course sufficient, but for Javascript applications often impractical. For intentional source code distributions, e.g. a downloadable zipfile with the full code and documentation it may be acceptable to add a license text, but if the Javascript code is downloaded as part of a Web page, the overhead may be significant.

The question then arises, is it sufficient to merely refer to a license that is published elsewhere, e.g. by linking to the license text on opensource.org?

License notice by law

The law in most countries requires that a licensee at least be given notice of applicable terms. With standard contracts, especially well-known ones, it is not always necessary to actually supply a copy, as long as the licensee can easily obtain a copy and knows that this standard contract would apply. Different laws may set different rules for how to apply the terms and make the copy available. For example, Dutch law provides (art. 6:234 Civil Code) that in electronic transactions, one must supply license terms in a downloadable or printable format. This requirement can be fulfilled by presenting a hyperlink to a PDF document.

(There is debate among open source scholars whether an open source license is a contract or a 'bare license'; I do not consider that debate relevant here, as I do not think the conclusion would be different for bare license terms.)

Literature review

The legal literature is surprisingly silent on this issue. Van Lindberg, Intellectual property and open source (O'Reilly 2008, p. 150)recommends to simply use a reference and store the license text itself somewhere in the source distribution. Other standard works, such as Rosen, Open source licensing Prentice Hall 2004 and St. Laurent, Understanding Open Source and Free Software Licensing (O'Reilly 2004 do not discuss whether one can merely refer to a license text outside the files one distributes.

One relevant article is Richard M. Stallman, The Javascript trap (GNU.org July 31, 2010). This article acknowledges that "the GNU GPL is long enough that including it in a page with a JavaScript program can be inconvenient" and proposes a convention that uses the markers @licstart and @licend to mark the beginning and end of license references.

The convention suggests to use a text like this:

The JavaScript code in this page is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License (GNU GPL) as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. The code is distributed WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU GPL for more details.

This convention appears to be used in some larger Javascript-based projects (such as Plone) but is not universally adopted.

Consequences of insufficient license notice

When considering if a license notice is sufficient, one must also consider the consequences of an insufficient notice. The only consequence I can think of is that the recipient of the file cannot claim any usage right under the license in question. As a result, that recipient cannot use or distribute the file. Without a license, basic copyright applies and copyright forbids the reuse or redistribution of software without adequate permission.

A difficult situation may arise if the license notice is accompanied by a text such as "This program is free software; you can redistribute it and/or modify it under the terms of the GPL".

Such a text is by itself a permission (a mini-license) to freely redistribute and/or modify the code. The terms of the GPL could be declared inapplicable if the reference is insufficient. As a result, a recipient would have unlimited permission to redistribute or modify, without any obligation under the GPL.

Applicability as stated in open source license

Open source licenses themselves often contain statements about how they can be declared applicable to certain software. These statements may allow or instead block the use of external references.

The GNU General Public License

The most popular open source license is the GNU General Public License or GPL. Version 2 of this license states:

This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License.

The recommended format for this notice (as given below the official text on GNU.org) contains the line

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. ... You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.

Version of the GPL has no explicit statement about how to recognize whether a work is licensed under GPLv3. There is only this sentence:

The Program. refers to any copyrightable work licensed under this License.

At the bottom an example is given, which has the same text as for GPLv2. We may thus assume that the intent is the same for GPLv2 and v3. The GPL thus does not provide any obstacles against merely referring to the GPL text at an external location.

GNU Lesser General Public License

The GNU Lesser General Public License has a very similar clause in version 2.1:

This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License")

Therefore the LGPL, like the GPL, does not provide any obstacles against merely referring to the GPL text at an external location.

The Mozilla Public License 1.1

The MPL uses an explicit source code notice in an Exhibit to the license text. This notice contains the following text:

The contents of this file are subject to the Mozilla Public License Version 1.1 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.mozilla.org/MPL/

With this text it is clear that a mere reference to the license text can suffice.

The BSD license

The BSD license is a bit more problematic. The license does not define which software is covered by it. The only reference is article 1 of the license:

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

This makes it clear that the license text must be in the file to which the license applies. Furthermore, the BSD license is typically offered as a template, so that linking to that text results in an incomplete license. This reinforces the interpretation that one must copy the license text (and substitute one's details as copyright holder) before the BSD license can apply.

Arguably one can interpret the word 'retain' as "do not remove" without an obligation to actually include the notice and the conditions in any source file. Under this interpretation it could be sufficient to refer to the BSD license elsewhere on the World-Wide Web. One would still need to make a copy of the BSD license template and substitute one.s details.

The MIT license

The MIT license is a very brief and liberal open source license. The license text states that the license applies to

any person obtaining a copy of this software and associated documentation files

but also requires that

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

This requirement makes it hard to comply without actually including the verbatim text of the license in the Javascript file. We could follow the same approach as with the BSD license and interpret "shall be included" as "must not be removed"but the use of the active verb 'shall' makes this a harder interpretation.

Apache license

The Apache license 2.0 declares that a work is licensed under this license as follows:

Work ... made available under the License, as indicated by a copyright notice that is included in or attached to the work

and provides an example

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0

Like the Mozilla Public License, it is clear that a mere reference to the license text can suffice.

Use of license references in practice

Another aspect to consider is how open source licensed are declared applicable in practice. To this end I investigate several popular Javascript libraries that are available under open source licenses. For each library I reproduce the copyright notices from the source files below.

All the libraries I examined merely included a reference to the applicable open source license in the source files. Some did include the complete license text in a separate file in a source distribution, others merely referred to a webpage in all cases. None however included the license text in the Javascript source files themselves.

DHTMLX

DHTMLX is a JavaScript GUI widget library for building dynamic web applications with desktop-like user experience and Ajax data loading. DHTMLX source files provide this notice:

Copyright DHTMLX LTD. http://www.dhtmlx.com
You allowed to use this component or parts of it under GPL terms
To use it on other terms or get Professional edition of the component please contact us at sales@dhtmlx.com

jQuery

jQuery is a fast and concise JavaScript Library that simplifies HTML document traversing, event handling, animating, and Ajax interactions for rapid web development. jQuery source files provide this notice:

 * jQuery JavaScript Library v1.4.2
 * http://jquery.com/
 *
 * Copyright 2010, John Resig
 * Dual licensed under the MIT or GPL Version 2 licenses.
 * http://jquery.org/license

Plone

Plone is a Content Management System built on top of the open source application server Zope and the accompanying Content Management Framework. Plone source files provide this notice:

* @licstart  The following is the entire license notice for the JavaScript 
*            code in this page. 
* 
* Copyright (C) 2010 Plone Foundation 
* 
* This program is free software; you can redistribute it and/or modify it 
* under the terms of the GNU General Public License as published by the Free 
* Software Foundation; either version 2 of the License. 
<Rest of GPL notice omitted>
* @licend

Dojo Toolkit

Dojo Toolkit is an open source modular JavaScript library (or more specifically JavaScript toolkit) designed to ease the rapid development of cross-platform, JavaScript/Ajax-based applications and web sites. Dojo source files provide this notice:

Copyright (c) 2004-2010, The Dojo Foundation All Rights Reserved.
Available via Academic Free License >= 2.1 OR the modified BSD license.
see: http://dojotoolkit.org/license for details

YUI Library

The YUI library is a set of utilities and controls, written with JavaScript and CSS, for building richly interactive web applications using techniques such as DOM scripting, DHTML and AJAX. YUI source files provide this notice:

Copyright (c) 2010, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.com/yui/license.html

Mootools

Mootools is a compact, modular, Object-Oriented JavaScript framework designed for the intermediate to advanced JavaScript developer. Mootools source files provide this notice:

license: MIT-style license.

copyright: Copyright (c) 2006-2010 [Valerio Proietti](http://mad4milk.net/).

Date.js

Date.js is an open-source JavaScript Date Library. Date.js source files provide this notice:

 * Copyright (c) 2006-2007, Coolite Inc. (http://www.coolite.com/). All rights reserved.
 * License: Licensed under The MIT License. See license.txt and http://www.datejs.com/license/

Ext.JS

Ext.JS is a cross-browser JavaScript library for building rich internet applications. Both commercial and Open Source licenses are available. Ext.JS source files provide this notice:

 * Ext JS Library 3.3.0
 * Copyright(c) 2006-2010 Ext JS, Inc.
 * licensing@extjs.com
 * http://www.extjs.com/license

Conclusion

There is a very real desire to not nclude full open source license texts in Javascript files when those are downloaded by browsers. For distributions of Javascript projects in original form (with source code, documentation etcetera) this issue is less apparent, as the overhead of a single license file is small.

Virtually all projects that use open source and Javascript in practice simply refer to the license text as hosted on their own website. I found no project that actually copied an open source license text in a Javascript file.

Most open source licenses do not provide obstacles against this practice. As long as the license is identified and available by URL, one may consider this as adequate notice. I therefore conclude that authors of Javascript files can license by including a reference to the license and a URL where the license text can be found.

Based on the current practices I found above, I hereby recommend two forms of notice, a short form and a long form. The notice (in either form) should be included at the top of the source file in question.

Short form

* Copyright OWNER NAME. Licensed under NAME LICENSE HERE
* See license text at http://example.com/license

Long form

* @licstart
* 
* Copyright (C) 2010 OWNER NAME HERE
* 
* This file is licensed under the NAME LICENSE HERE. 
* A copy of this license may be found at http://example.com/license
* 
* @licend

This article was written at the request of Fingertips.