Skip to main content

SQ12102

Detected presence of software dependencies distributed with copyleft licenses.

priorityCI/CD statusseverityeffortSAFE levelSAFE assessment
passlowhighNonelicenses: warning
Reason: copyleft licensed components

About the issue​

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Copyleft licenses in particular impose substantial restrictions on the licensee. They typically require that any derived works, and even software code that merely interacts with copyleft code, be licensed under the same license. Since copyleft licenses are commonly applied to open source code, their inclusion requires that the entire software package becomes open sourced. For commercial applications, this is typically undesirable. Therefore, the inclusion of copyleft code is commonly avoided or even prohibited by the organization policy.

How to resolve the issue​

  • Confirm that the software component references a copyleft dependency.
  • Investigate if the software publisher provides this dependency under a non-copyleft license.
  • Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.

The data in this section is refreshed monthly.

Total amount of packages analyzed

  • RubyGems: 183K
  • Nuget: 644K
  • PyPi: 628K
  • NPM: 3.72M
Statistics are not collected for the SQ12102 policy at this time, or not applicable to this type of issue.