Purpose
Open-source software is not "free of rights": it is used under licenses with binding conditions. Anyone who violates a condition loses the license and then uses the work without permission — with copyright consequences. This skill inventories the components used, assesses their license obligations (in particular copyleft), checks compatibility within the license chain and determines the consequences of a license violation.
Inputs
- Product type and distribution channel (distribution of binaries, SaaS provision, embedded)
- List of the OSS components used together with licenses (if available)
- Software Bill of Materials (SBOM), if maintained
- planned combination (static/dynamic linking, modification, mere use)
- Objective (initial approval, audit, response to a warning letter)
Sub-agent architecture
Three roles interlock. An inventory agent creates or checks the license chain and the Software Bill of Materials, because without a complete component list no reliable statement is possible. A license obligations agent assigns to each component its obligations — attribution, license text, source code offer, copyleft scope — and checks compatibility among one another. A risk agent finally assesses violation situations and the legal consequences under Section 97 UrhG. Only structured findings per component are handed over; the basis is the specific license in its relevant version, not a blanket "open source" assumption.
Process
1. Copyright basis (Section 31, Section 69a, Section 69c UrhG)
Computer programs are protected under Section 69a UrhG; their reproduction, adaptation and distribution require consent under Section 69c UrhG. The OSS license is the grant of simple usage rights under Section 31 UrhG subject to conditions. If the conditions are complied with, the use is permitted; if they are violated, the justification falls away and there is an exploitation without a usage right.
2. Copyleft and GPL
Permissive licenses (MIT, BSD, Apache 2.0) essentially require attribution and inclusion of the license. Copyleftlicenses such as the GPL additionally require that derivative works be passed on upon distribution under the same license and with access to the source code (strong copyleft GPL, weaker LGPL/MPL). What is decisive is whether a "distribution" exists and whether linking/modification creates a derivative work — both determine the scope of the copyleft obligation.
3. License chain and Software Bill of Materials
The license chain must be recorded across all transitive dependencies and documented in the Software Bill of Materials (SBOM, e.g. SPDX/CycloneDX). The compatibility of the licenses with one another must be checked (e.g. Apache 2.0 is only partially compatible with GPLv2) as well as compliance with all distribution obligations (license text, copyright notices, source code offer, change notices).
4. Consequences of license infringement (§ 97 UrhG)
In the event of a license infringement , the authorization to use lapses retroactively; under § 97 UrhG, the rights holder is entitled to claims for injunctive relief and damages, supplemented by claims for destruction and recall under § 98 UrhG. In practice, a distribution stop of the product is imminent until compliance is established.
Risks
- Copyleft underestimated: linking/embedding a GPL component into a proprietary, distributed product triggers the obligation to disclose one's own source code.
- GPLobligations during distribution disregarded (no source code offer, missing license copy) — the license lapses, the use becomes unlawful.
- License infringement goes undetected without an SBOM — transitive dependencies with incompatible licenses remain hidden until a cease-and-desist letter arrives.
- Recall and distribution stop: claims for injunctive relief and recall (§ 97, § 98 UrhG) can affect products already delivered — economically serious.
- SaaS fallacy: Even without classic distribution, network copyleft licenses (AGPL) can trigger disclosure obligations.
Output format
OPEN-SOURCE-COMPLIANCE — <Produkt> — <Datum>
I. Inventar / Lizenzkette [SBOM vorhanden? ✓/❌ — Format]
II. Komponenten & Lizenzen [permissiv / Copyleft (GPL/LGPL/AGPL)]
III. Verträglichkeit [✓ / ⚠️ Konflikt: <…>]
IV. Distribution & Copyleft-Reichweite[Distribution ja/nein — abgeleitetes Werk?]
Pflichten erfüllt: [Lizenztext / Quelltext / Namensnennung]
V. Verletzungslage (§ 97 UrhG) [keine / Unterlassung / Rückruf-Risiko]
Maßnahmen / Freigabeempfehlung: <…>
Sources
- § 31 UrhG, § 69a UrhG, § 69c UrhG
- § 97 UrhG, § 98 UrhG
- License texts/standards: GPLv2/GPLv3, LGPL, AGPL, Apache 2.0, MIT; SBOM formats SPDX / CycloneDX