Open-source licences and the obligations of the institution acquiring the software

Open-source licences fall into two main groups. Permissive licences give broad permission for the code to be incorporated into other software, including closed software, and generally require only that copyright and licence notices be preserved. Copyleft licences, on the other hand, require that when a modified version of the software is given to others, it must be given under the same licence and together with the source code. The main conditions that the leading licences place on the institution are as follows:

Most licence obligations arise from the distribution of the software. For this reason, how the institution uses the software determines which obligation arises. According to the Free Software Foundation's GPL frequently asked questions document, the GPL does not require the publication of a modified version; an institution may use the modified version purely internally. According to the same document, an institution making copies within itself is not considered distribution; giving copies to other institutions or persons, however, is distribution, and this also covers giving contractors copies for use outside the institution.

The AGPL takes on particular importance for systems that provide services to citizens over the web. An organisation that runs a modified version of a GPL-licensed program on a website is not required to publish the modified source code. If the program is AGPL-licensed, the source code of the modified version must be made available to users who interact with it over the network. Sharing software that the institution has developed itself, or has had developed, with other institutions constitutes distribution, and the licence conditions of the components it contains must be satisfied at that stage.

For the institution to be able to meet its licence obligations, it must first know which components the software is made up of. A software bill of materials (SBOM) is an inventory that shows the components making up a piece of software, their versions, their origin and their licence. This list is used to audit licence compliance, and it also allows the institution to quickly determine which of its systems are affected when a vulnerability is announced in a component.

There are two widely used open standards for SBOMs. SPDX is an open-source project run under the Linux Foundation and has become an international standard as ISO/IEC 5962:2021. CycloneDX, meanwhile, is a bill-of-materials standard developed by the OWASP Foundation and Ecma International's TC54 technical committee, published as ECMA-424. Requiring one of these two standards in the technical specification ensures that the delivered list can be read and audited with different tools.

Whether purchasing ready-made software or having software developed specifically for the institution, having the following items explicitly set out in the technical specification and the contract determines from the outset who holds which obligations:

• An up-to-date software bill of materials in SPDX or CycloneDX format is supplied with every delivered version.
• A licence inventory showing the licences of all open-source components used in the software is received, together with a declaration from the contractor that these licences are compatible with the institution's intended manner of use.
• Whether the software contains any copyleft-licensed component is stated separately, particularly whether it contains an AGPL-licensed component in systems that will be offered over a network.
• For custom development, the source code is delivered in a compilable form, together with build and installation documentation; it is specified that this delivery will be renewed with every version.
• The institution's rights to use, modify, have developed further by other contractors, and share with other public institutions, together with the duration and scope of these rights, are defined in the contract.
• The institution's right to publish software it has had developed under an open-source licence, and the licence to be used if it does so, are agreed from the outset where needed.

Software that a public institution has had developed for its own needs may also be of value to other institutions carrying out similar work. Sharing this software as open source can prevent the same work being purchased repeatedly by different institutions. The precondition for this is that the institution's rights over the software are set out in the contract in a way that allows publication. The GPL frequently asked questions document notes that, in the case of US public institutions, a contract may require the contractor to publish the software under the GNU GPL, or may provide for the copyright to be transferred to the institution.

On 8 December 2021, the European Commission adopted rules on sharing its own software under open-source licences. Under these rules, Commission departments can publish the source code of software they own more quickly and with fewer steps, and a separate Commission decision is no longer required for distribution under an open-source licence. The European Union Public Licence (EUPL), which appears on the list of acceptable licences in Türkiye's transition guide, is one of the options that can be considered for software to be shared by public institutions.