> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/open-source-software-license-categories.md). # Open-source software license categories Open-source software licenses define the terms under which open-source software can be used, modified, and distributed. In Cortex Cloud Application Security, licenses are scanned as part of the SCA vulnerability scan for open-source packages. All Critical, High and Medium license miscompliance detected in open-source software packages within an organization's environment are defined as issues. This enables structured vulnerability management and focused remediation. Where applicable, manual and automated fixes are provided. Cortex Cloud Application Security offers three types of default license categories out of the box, providing comprehensive coverage for managing license compliance within your environment: * Non-Permissive Licenses (High severity) * Strong Copyleft Licenses (High severity) * Weak Copyleft Licenses (Medium severity) Within each license type, SPDX identifiers are organized and sorted based on their characteristics and attributes. SPDX Identifiers are unique codes assigned to software licenses by the Software Package Data Exchange (SPDX) project. These identifiers are used to categorize and accurately identify software packages distributed under various types of licenses, including strong copyleft, weak copyleft, and non-permissive licenses. By associating each software package with a specific SPDX Identifier, it becomes easier to track and manage license compliance across different licensing policies, ensuring that the correct license type is identified and adhered to. **Non-permissive licenses** Non Permissive licenses policies identify software packages distributed under non-permissive or restrictive licenses. These licenses restrict how you can use, modify, and distribute the software. They may limit your ability to integrate the software into certain projects or require you to purchase a commercial license for specific uses. **Non-permissive SPDX identifiers** The following list displays supported SPDX identifiers for non-permissive licenses.
Read more... * BUSL-1.1 * C-UDA-1.0 * CC-BY-NC-3.0-DE * CC-BY-NC-ND-3.0-DE * CC-BY-NC-ND-3.0-IGO * CC-BY-NC-SA-2.0-DE * CC-BY-NC-SA-2.0-FR * CC-BY-NC-SA-2.0-UK * CC-BY-NC-SA-3.0-DE * CC-BY-NC-SA-3.0-IGO * CC-BY-ND-3.0-DE * Hippocratic-2.1 * JPL-image * MS-LPL * NCGL-UK-2.0 * PolyForm-Noncommercial-1.0.0
**Strong copyleft licenses** Strong Copyleft licenses policies identify software packages distributed under strong copyleft licenses, such as the GNU General Public License (GPL). These licenses require derivative works to be distributed under the same copyleft license terms as the original work. This ensures broader access and modification rights. **Strong copyleft SDPX identifiers** The following list displays supported SPDX identifiers for strong copyleft licenses.
Read more... * AGPL-1.0 * AGPL-1.0-only * AGPL-1.0-or-later * AGPL-2.0 * AGPL-3.0 * AGPL-3.0-only * AGPL-3.0-or-later * Arphic-1999 * CERN-OHL-S-2.0 * copyleft-next-0.3.0 * copyleft-next-0.3.1 * GPL-2.0 * GPL-3.0 * Linux-man-pages-copyleft * OpenPBS-2.3
**Weak copyleft licenses** Weak Copyleft Licenses policies identify software packages distributed under weak copyleft licenses. These licenses permit combining code with other licenses, including proprietary licenses, without mandating the entire derivative work to be released under the same copyleft license. **Weak copyleft SPDX identifiers** The following list displays supported SPDX identifiers for weak copyleft licenses.
Read more... * Artistic-1.0 * Artistic-2.0 * APSL * CAL-1.0-Combined-Work-Exception * CC-BY-SA-2.0-UK * CC-BY-SA-2.1-JP * CC-BY-SA-3.0-AT * CC-BY-SA-3.0-DE * CC-BY-SA-4.0 * CDDL-1.0 * CDLA-Sharing-1.0 * CERN-OHL-W-2.0 * CPOL-1.02 * EPL-1.0 * EPL-2.0 * eCos-2.0 * EUPL-3.0 * FDK-AAC * LGPL-2.0 * LGPL-2.1 * LGPL-3.0 * MPL-1.1 * MPL-2.0 * MS-RL * OSL-3.0 * QPL-1.0-INRIA-2004 * Sendmail-8.23 * SimPL-2.0 * TAPR-OHL-1.0 * TPL-1.0
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/open-source-software-license-categories.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.