Skip to main content

SQ12103

Detected presence of statically linked dependencies distributed with weak copyleft licenses.

priorityCI/CD statusseverityeffortSAFE levelSAFE assessment
passmediumhighNonelicenses: warning
Reason: weak copyleft linked components

About the issue​

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Weak copyleft licenses in particular impose requirements that the user must be able to replace or update the code they apply to. In practical terms, that means the object and library files that statically link to weak copyleft code must be made available publicly. For commercial applications, this is typically undesirable. Therefore, statically linking to weak copyleft code is commonly avoided or even prohibited by the organization policy. Instead of linking statically to weak copyleft licensed code, it is recommended to isolate such code into modules that the publisher-developed, first-party code can dynamically link to without the aforementioned obligations.

How to resolve the issue​

  • Confirm that the software package statically links to a weak copyleft dependency.
  • Investigate if the software publisher provides this dependency under a non-copyleft license.
  • Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.
  • Alternatively, repackage the code so that it dynamically links to a weak copyleft dependency.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes. Analysis results are used to calculate incidence statistics for issues (policy violations) that Spectra Assure can detect in software packages.

The data in this section is refreshed monthly.

Total amount of packages analyzed

  • RubyGems: 183K
  • Nuget: 644K
  • PyPi: 628K
  • NPM: 3.72M
Statistics are not collected for the SQ12103 policy at this time, or not applicable to this type of issue.