Contract clause
Open source software clause: what a developer promises about code it did not write
An open source software clause sets out what a developer may include in a deliverable from publicly licensed code, what approval is needed first, and what it must disclose at handover. Its main job is keeping out licences whose terms would oblige the client to publish its own source code or grant rights it never intended to give.
Almost every modern application is mostly open source components glued together with custom code. The clause does not stop that, it makes sure the client knows which licences arrived with the software and that none of them carries an obligation the client cannot live with.
Nuwan Madhusanka · Co-founder
4 min read · Published
Sample clause
a software development agreement between Brolga Code Works, a fictional Brisbane development studio, and Pellucid Pathology, a laboratory group commissioning a patient results portal it will host itself and later license to other clinics
11. Open Source Software 11.1 Open Source Software means software made available under a licence approved by the Open Source Initiative or any other licence that permits use, modification and redistribution of source code. 11.2 Brolga Code Works may include Open Source Software in the Deliverables only if its licence is listed as a Permitted Licence in Schedule 4, or Pellucid Pathology has approved the component in writing. 11.3 Brolga Code Works must not include any component under a licence that would require Pellucid Pathology to disclose or license its own source code, or to allow reverse engineering, as a condition of distributing or hosting the Deliverables. 11.4 With each Deliverable, Brolga Code Works must provide a list of every Open Source Software component, its version and its licence. 11.5 Brolga Code Works warrants that it has complied with the notice and attribution terms of each licence listed under clause 11.4.
Sample wording, not legal advice.
Variants
Disclosure only
A small internal tool the client will never distribute, where the client wants visibility rather than control.
The Developer may use Open Source Software in the Deliverables at its discretion. With the final Deliverable the Developer must provide a list of every Open Source Software component included, its version and the licence under which it is used, together with copies of any notices those licences require. The Developer is not otherwise restricted in its choice of Open Source Software under this Agreement.
Approval needed for each component
A client with a security or procurement team that reviews every third party dependency before it enters a codebase.
The Supplier must not include any Open Source Software in a Deliverable without the Customer's prior written approval of that specific component and version. A request for approval must identify the component, its licence, its purpose and any known security vulnerabilities. The Customer must respond within five Business Days. A component approved once may be updated to a later version under the same licence without further approval.
Banned licence list
A product company that will distribute or host the software commercially and cannot accept reciprocal licence terms.
The Developer must not include in any Deliverable software licensed under the GNU General Public License, the GNU Affero General Public License, or any other licence that requires, as a condition of use, modification, hosting or distribution, that source code be disclosed or licensed to third parties. If a prohibited component is found, the Developer must replace it at its own cost within twenty Business Days of notice.
What to negotiate
Distribution against hosting
The GPL family triggers source disclosure when software is conveyed to others, so a client hosting its own portal may be relaxed about it. The Affero GPL reaches users interacting over a network, which catches hosted services. Clients that might one day ship the software to customers usually ban both, while clients certain they will only host sometimes accept GPL components with approval.
Who pays to replace a bad component
A prohibited licence found after delivery means rewriting part of the product. Clients want the developer to replace it at its own cost and indemnify any claim. Developers accept replacement for components they added, and ask to exclude components the client specified or approved in writing, since the client chose those with knowledge of the licence.
Security, not only licensing
A licence list says nothing about whether a component has known vulnerabilities or is still maintained. Clients increasingly ask for the version of each component and a commitment that no component carries an unpatched critical vulnerability at delivery. Developers agree to the delivery snapshot but resist an ongoing obligation outside a support agreement.
The risk of leaving it out
Without the clause the client inherits whatever licences the developer happened to use, and learns about them during due diligence, a security audit or a claim from a copyright holder. A reciprocal licence buried in a distributed product can require the client to publish source code or stop distributing, and the development contract offers no promise to rely on.
The licence families in plain terms
Open source licences fall into three broad groups. Permissive licences such as MIT, BSD and Apache 2.0 allow almost any use provided the copyright notice and licence text travel with the code, and Apache 2.0 adds an express patent licence. Weak copyleft licences such as the Mozilla Public License 2.0 and the LGPL require changes to the licensed files or library to be shared, but not the larger work built around them. Strong copyleft licences, the GPL versions 2 and 3, require the source of the whole combined work to be made available when it is distributed, and the Affero GPL extends that to users who interact with modified software over a network.
Why a schedule works better than a list in the clause
Licence names change and new ones are approved, so hard coding a list into the operative clause dates quickly. Putting permitted and prohibited licences in a schedule, identified by their SPDX identifiers, lets the parties update the list by a short signed variation. The software bill of materials delivered at handover can use the same identifiers, which makes checking it against the schedule a mechanical task rather than a legal one.
Where it sits in a generated document
In a development or master services agreement the open source clause belongs under intellectual property, after the clause dealing with the developer's background material. A generated agreement numbers each part, so asking for a permitted licence schedule and a component list at handover produces both as numbered provisions. The document states licence obligations as plain content from the description and prints no sources, so licence names and versions need checking before signing.
Documents that carry this clause
Software development agreement with sprints and an acceptance testCustom software goes wrong in the space between delivered and accepted, where one side thinks a sprint is finished and the other is still writing a list. This agreement fixes a ten business day acceptance window against criteria written before the sprint started, and assigns the intellectual property sprint by sprint as each invoice is paid.
Master services agreementA data consultancy and an insurer sign this once and then buy work under it for three years. It is the rare contract whose whole purpose is to make the next twenty contracts short.
IP assignment agreement template with a schedule and moral rightsAn IP assignment transfers ownership of work that already exists, which is why the schedule matters more than the wording around it. This one moves six named works from a departing contract developer to the startup that paid for them, licenses back her own library, and lists what gets handed over in the ten days after signing.Questions people ask
Is using open source code in client work a breach of an IP assignment?
Not if the contract allows it. A developer cannot assign code it does not own, so an assignment clause promising full ownership of everything delivered is inaccurate the moment an open source library is included. The open source clause resolves the conflict by carving licensed components out of the assignment and listing them.
Does the GPL apply to software a company only hosts?
The GPL's source obligations are triggered by conveying the software to others, so purely internal or hosted use generally does not trigger them. The GNU Affero General Public License is different: its section 13 requires modified versions to offer source to users interacting with it over a network, which is why hosted products commonly ban it.
What is a software bill of materials?
A list of every component inside a piece of software, with its version, supplier and licence. It is the practical form of the disclosure an open source clause requires. Using standard SPDX licence identifiers in the list lets a client compare it against the permitted licence schedule without reading each licence.
Who is responsible for complying with attribution notices?
Whoever distributes the software carries the notice obligations, which is often the client. The clause should require the developer to include the required notices in the deliverable and warrant that it has done so, so the client is not left compiling attribution files from a dependency tree after launch.
Can a client approve a banned licence for one component?
Yes, if the clause allows written approval. A client might accept a GPL tool used only in the build pipeline, where it never ships with the product. The approval should name the component, the version and the use, so a later change in how it is used falls outside the consent.
Does an open source clause need a warranty?
A disclosure obligation without a warranty tells the client what was used but gives no remedy if the list was wrong. Most clauses add a warranty that the list is complete and the licences were complied with, paired with a replacement obligation, and some clients add an indemnity for third party claims.
Put the clause in a finished document
The button opens the document generator with a starting description already filled in. Change it to match your own agreement before you run it.
Create a document with OneCraftRelated clauses
- Feedback clause: who may use the suggestions a customer makesA feedback clause lets a supplier use the ideas a customer suggests without owing anything. Sample SaaS wording, licence and assignment variants, carve outs.
- Trademark licence clause: using a brand without owning itA trademark licence clause lets another business use a name or logo under the owner's quality control. Sample wording, co marketing and approval variants.
- Background IP clauseA background IP clause separates what each party brought from what was built for the project. Sample software wording, the schedule and the licence back.
- Warranty clause: promising a standard and backing itA warranty clause promises a fact is true or that work meets a standard. Australian sample wording for a ninety day defects warranty, variants and remedies.
For everything the document generator can do, see the document maker.
Step by step in the builder: Create a document with AI, then Document builder components.
Written and checked by the OneCraft team. Last checked .