Can third-party licences limit how delivered source code is used?
Yes. Delivery of source code does not mean every open-source component, commercial SDK, font, media asset, model, and dataset can be copied, modified, or resold without limit. The project needs a component and licence inventory and must review internal use, external distribution, SaaS operation, app-store release, and sublicensing separately. The actual licence and contract determine the rights.
Third-party dependencies are normal and cannot usefully be eliminated. Modern products rely on libraries, cloud services, maps, payments, notifications, fonts, and models. Risk arises when the team does not know what it uses, licence notices are incomplete, commercial accounts belong to the wrong party, or authorization for one use is assumed to cover another.
When agreeing deliverables, handover, and ownership boundaries, also compare Who owns the data and intellectual property in a custom software project?; the linked guidance adds context that should be considered in the same decision.
Common asset categories
| Type | Typical restriction | Record | Treatment |
|---|---|---|---|
| Permissive open source | Retain copyright and licence; possible patent or NOTICE duties | Component, version, SPDX identifier, copyright, modifications | Preserve notices and follow the exact terms |
| Copyleft open source | Source obligations may depend on modification, combination, distribution, or network use | Architecture, use, version, distribution/service facts | Technical and legal review; avoid simplistic “viral” labels |
| Commercial SDK or API | Account, volume, region, endpoint, branding, resale | Contracting entity, plan, key, renewal, exit | Client procurement or explicit sublicensing |
| Fonts, images, media, data | Medium, territory, term, derivative and AI permissions | Provenance, evidence, scope, expiry | Use assets with clear commercial rights |
| AI models and weights | Acceptable use, hosting, derivatives, outputs, region, retirement | Model version, licence/terms, data path | Review for the target deployment and business |
| Pre-existing Wavesteam component | Ownership may remain with Wavesteam while the client receives agreed rights | Component, source, use, modification, sublicense | State it in the contract annex |
Licence labels alone are not conclusions
MIT, Apache-2.0, and BSD licences are generally permissive but still carry notice duties; Apache-2.0 also addresses patents and NOTICE. GPL, LGPL, and AGPL consequences depend on version, modifications, linking or combination, distribution, and network interaction. AGPLv3 contains a specific network-use source provision. Reading only a short identifier without the actual use can produce the wrong answer.
Commercial products can legally use some copyleft software when the obligations fit their architecture and delivery. If the client does not accept those obligations, replace or isolate the component during design. A qualified lawyer should review material ambiguity; a development article cannot provide the final legal determination.
Managing dependencies through delivery
Before a dependency enters the main codebase, inspect source, maintenance, licence, and known risk. Produce an SBOM or dependency inventory during the build with name, version, origin, licence identifier, direct or transitive status, purpose, and modifications. Automation finds missing and conflicting records, while people review copied source, dual licences, and custom terms.
Include frontend and backend packages, base images, database drivers, mobile SDKs, models, fonts, and relevant test tools. State whether a development dependency ships with the product. Save the corresponding licence and NOTICE text before release and reconsider the conclusion when deployment changes from app-store distribution to private installation or SaaS.
The contract separates client-supplied assets, developer-selected components, and third-party purchases. Wavesteam discloses known dependencies under the agreed process; the client confirms rights to its own data, materials, and accounts. The contracting and renewal party for commercial services is named. Replacement, remediation, fees, suspension, and liability follow the contract rather than a universal promise that one side bears everything.
Rights to custom code do not override third-party licences or pre-existing Wavesteam components. Wavesteam supplies the dependency and licence inventory and records asset boundaries in our Transparent Delivery Standard. A request to exclude specific licences should be made before technology selection and enforced in CI.
References
- The SPDX License List provides standard identifiers and authoritative licence links for machine-readable inventories.
- The GNU GPL FAQ explains GNU licence treatment of distribution and combinations.
- The full GNU AGPLv3 contains the applicable network-interaction provision.
- The Wavesteam Transparent Delivery Standard explains our public boundary between custom, pre-existing, and third-party assets.
This is a software-licensing risk overview, not legal advice. Disputed or high-value distribution should receive qualified legal review.