Arches Open-Source License Compliance Guide
The guidelines below were written by Karl Fogel and James Vasile of Open Tech Strategies, commissioned by the Getty Conservation Institute for the Arches Project.
Use of Arches software is governed by version 3 of the Affero General Public License. We believe this grounds our work in a community ethic of mutual support. This is a guide that provides simple instructions for practical compliance with the AGPLv3 license. It is a checklist of things you can do to ensure compliance. This checklist is not the only way to comply, but if you are doing the usual things with Arches that most people do, these steps should get you to compliance.
This checklist is aimed at compliance when distributing Arches. It is not a general AGPL-compliance guide. If you are implementing Arches, modifying Arches, making extensions for Arches, or customizing it for customers, this is the guide for you.
First, your users need a way to obtain your source code. The easiest way to provide it is to prominently point your users at the public GitHub repositories for your Arches application and any other software that is closely intertwined with Arches. Those repositories must contain the exact same source code you are running in production. If you made modifications, make sure those changes are in those repositories. If you are providing Arches as a container image, publish the source code in a repository or archive alongside the image, identify the image tag or digest it corresponds to, and provide a link to the corresponding source code wherever users obtain or access the image.
Second, make sure you have a LICENSE file in the root of your git repository. The contents of this file should simply be the plain text version of AGPLv3. Note that if you start by copying or forking an existing repo, you might be copying a typo. Some repos have the text of the GPL instead of the Affero GPL in their LICENSE file, and this is an error that should be fixed, not repeated.
Third, specify the SPDX identifier, “AGPL-3.0-only”, as the license in any package manifest. For Arches-related code there is often a package.json file.
Fourth, check the licenses of your dependencies, combined works, and related code. Stick to dependencies with OSI-approved licenses, except for these licenses, which can never be combined with AGPLv3-only code:
- GPL-2.0-only
- AGPL-1.0
- AGPL-1.0-only
- AGPL-2.0
- AGPL-2.0-only
- LGPL-2.1-only
- CDDL-1.0
Fifth, do not remove other people’s copyright notices or license text from the codebase. We call this preserving notices, and it is an AGPL requirement.
Sixth, do not add additional conditions on access to the code or exercise of AGPLv3 rights. For example, do not require users to agree not to share the code, limit their use to noncommercial purposes, or obtain your permission before modifying or redistributing it.
Finally, if you are unsure, please reach out to the Arches Project. We cannot give legal advice (we’re not a law firm), but we’ll help you figure it out.