The license is an important question as not all free software is free for all uses. Some of the licenses allow free use for hobby projects and education but require you to purchase the software for professional, profit-oriented use.

The most widely used licenses and their explanation (and the whole text of the license) is available on the web page of the Open Source Initiative (https://opensource.org/licenses). It lists nine different licenses, and to make the situation a bit more complex, these licenses have versions.

One of the oldest licenses is the General Public License (GPL) standing for GNU. This license contains the following sentences:

If you create software for a for-profit enterprise and the company intends to sell software, you probably cannot use any line of code that is from a GPL-licensed software. It would imply that you are required to pass on your own source code, which may not be the best sales strategy. Apache license, on the other hand, may be okay for your company. This is something that the lawyers should decide.

Even though this is the lawyers' work, there is one important point that we developers must be aware of and pay close attention to. Sometimes, the libraries contain code from other projects and their license, as advertised, may not be the real one. A library may be distributed under the Apache license but contains code that is GPL-licensed. This is obviously a violation of the GPL license, which was committed by some open source developers. Why would you care? Here comes the explanation via an imagined situation.

You develop software for an enterprise. Let's say that this company is one of the largest car manufacturers of the world, or it is one of the largest banks, pharma, whatever. The owner of the GPL software seeks remedies for the misuse of her software. Will she sue the software developer, John Doe, who has a total wealth of 200K, or your company, claiming that you did not duly check the license of the code? She certainly will not dig for gold where there is none. Suing the company you work for may not be successful, but certainly not a good process you or anyone at the company wants.

What can we as software professionals do?

We have to use libraries that are well known, used widely. We can check the source code of the library to see whether there is some copied code. Some package names may present some clue. You can Google some part of the source code to find matches. Last but not least, the company can subscribe to services that provide similar research for the libraries.