License Compatibility Analysis

Document Version: 1.1.0 Last Updated: 2026-01-20 StellaOps License: BUSL-1.1

This document analyzes the compatibility of third-party licenses with StellaOps’ BUSL-1.1 license and Additional Use Grant.

1. BUSL-1.1 Overview

The Business Source License 1.1 (BUSL-1.1) is a source-available license that:

1. Allows non-production use, modification, and redistribution of the Licensed Work
2. Allows limited production use only as granted in the Additional Use Grant
3. Requires preservation of the license text and attribution notices
4. Provides a Change License (Apache-2.0) that becomes effective on the Change Date
5. Restricts SaaS/hosted service use beyond the Additional Use Grant

Key Compatibility Principle

Permissive-licensed code (MIT, BSD, Apache) can be incorporated into BUSL-1.1 projects without changing the overall license. Strong copyleft or service-restriction licenses (GPL/AGPL/SSPL) impose obligations that conflict with BUSL-1.1 distribution terms or Additional Use Grant restrictions.

2. License Compatibility Matrix

2.1 Fully Compatible (Inbound)

These licenses are fully compatible with BUSL-1.1. Code under these licenses can be incorporated into StellaOps.

2.2 Compatible with Conditions

2.3 Incompatible

These licenses are NOT compatible with keeping StellaOps under BUSL-1.1:

3. Distribution Models

3.1 Source Distribution (BUSL-1.1 Compliant)

When distributing StellaOps source code:

StellaOps (BUSL-1.1)
+-- StellaOps code (BUSL-1.1)
+-- MIT/BSD deps (retain notices)
+-- Apache-2.0 deps (retain NOTICE files)
+-- MPL/LGPL deps (retain file/library boundaries)

Requirements:

• Include full BUSL-1.1 license text with Additional Use Grant
• Preserve all third-party copyright and attribution notices
• Preserve NOTICE files from Apache-2.0 dependencies
• Mark modified files with prominent change notices

3.2 Binary Distribution (BUSL-1.1 Compliant)

When distributing StellaOps binaries (containers, packages):

StellaOps Binary
+-- LICENSE (BUSL-1.1)
+-- NOTICE.md (all attributions)
+-- third-party-licenses/ (full license texts)
+-- Source link (optional, transparency only)

Requirements:

• Include BUSL-1.1 license with Additional Use Grant
• Include NOTICE file with all attributions
• Include license texts for vendored code

3.3 Network Service (No Copyleft Clause)

BUSL-1.1 restricts SaaS/hosted service use beyond the Additional Use Grant. Operating StellaOps as a service is permitted only within the grant limits or under a commercial license; see LICENSE for details.

3.4 Aggregation (Not Derivation)

The following are considered aggregation, not derivation:

Rationale: These components communicate via network protocols, APIs, or standard interfaces and are not linked into StellaOps binaries.

3.5 Plugin Distribution (Community Plugin Grant)

The Community Plugin Grant Addendum (LICENSE-ADDENDUM-COMMUNITY-PLUGIN-GRANT.md) provides additional terms for plugin development and distribution.

When distributing StellaOps Plugins:

Plugin Distribution
+-- Plugin code (your license)
+-- Attribution to StellaOps
+-- If derivative work:
    +-- LICENSE (BUSL-1.1)
    +-- LICENSE-ADDENDUM-COMMUNITY-PLUGIN-GRANT.md
    +-- NOTICE.md

Requirements by Plugin Type:

Not Allowed Without Commercial License:

• Redistributing plugins as part of a competing managed service offering
• White-labeling StellaOps functionality through plugins
• Embedding plugins in multi-tenant SaaS offerings to third parties

See Also:

• docs/legal/PLUGIN_DEVELOPER_FAQ.md - Detailed plugin licensing FAQ
• docs/legal/SAAS_MSP_GUIDANCE.md - SaaS and MSP hosting scenarios

4. Specific Dependency Analysis

4.1 BouncyCastle Cryptography (MIT)

4.2 Npgsql/PostgreSQL (PostgreSQL License)

4.3 Polly (BSD-3-Clause)

4.4 RxJS (Apache-2.0)

4.5 CryptoPro CSP (Commercial)

Analysis: StellaOps provides only the integration code (BUSL-1.1). CryptoPro CSP binaries are never distributed by StellaOps.

StellaOps Ships:
+-- PKCS#11 interface code (BUSL-1.1)
+-- Configuration documentation
+-- Integration tests (mock only)

Customer Provides:
+-- CryptoPro CSP license
+-- CryptoPro CSP binaries
+-- Hardware tokens (optional)

4.6 AlexMAS.GostCryptography (MIT)

Analysis: The fork is MIT-licensed and compatible with BUSL-1.1. The combined work remains BUSL-1.1 with MIT attribution preserved.

4.7 axe-core/Playwright (@axe-core/playwright - MPL-2.0)

Analysis: MPL-2.0 is file-level copyleft. Since this is a dev dependency used only for accessibility testing (not distributed in production), there are no special requirements for end-user distribution.

5. Outbound Licensing

5.1 StellaOps Core

All StellaOps-authored code is licensed under BUSL-1.1:

SPDX-License-Identifier: BUSL-1.1
Copyright (C) 2026 stella-ops.org

5.2 Documentation

Documentation is licensed under:

• Code examples: BUSL-1.1 (same as source)
• Prose content: CC-BY-4.0 (where specified)
• API specifications: BUSL-1.1

5.3 Configuration Samples

Sample configuration files (etc/*.yaml.sample) are:

• Licensed under: BUSL-1.1
• Derived configurations by users: User’s choice (no copyleft propagation)

6. Compliance Checklist

6.1 For StellaOps Maintainers

• [ ] All new dependencies checked against allowlist
• [ ] NOTICE.md updated for new MIT/Apache-2.0/BSD dependencies
• [ ] third-party-licenses/ includes texts for vendored code
• [ ] No GPL/AGPL or incompatible licenses introduced
• [ ] LICENSE and NOTICE shipped with source and binary distributions

6.2 For StellaOps Operators (Self-Hosted)

• [ ] LICENSE and NOTICE preserved in deployment
• [ ] Commercial components (CryptoPro, HSM) separately licensed
• [ ] Attribution notices accessible to end users (docs or packaged file)

6.3 For Contributors

• [ ] New code contributed under BUSL-1.1
• [ ] No proprietary code introduced
• [ ] Third-party code properly attributed
• [ ] License headers in new files

7. FAQ

Q: Can I use StellaOps commercially?

A: Yes, within the Additional Use Grant limits or under a commercial license. SaaS/hosted third-party use requires a commercial license.

Q: Can I modify StellaOps for internal use?

A: Yes. Non-production use is permitted, and production use is allowed within the Additional Use Grant or with a commercial license.

Q: Does using StellaOps make my data BUSL-licensed?

A: No. BUSL-1.1 applies to software, not data processed by the software. Your SBOMs, vulnerability data, and configurations remain yours.

Q: Can I integrate StellaOps with proprietary systems?

A: Yes, via API/network interfaces. This is aggregation, not derivation. Your proprietary systems retain their licenses.

Q: Do I need to disclose my CryptoPro CSP license?

A: CryptoPro CSP is customer-provided. StellaOps only ships integration code. Your CSP license is between you and CryptoPro.

8. References

• Apache License 2.0
• Apache 2.0 FAQ
• SPDX License List
• REUSE Best Practices
• BUSL-1.1 License Text

9. Related Documents

• LICENSE-ADDENDUM-COMMUNITY-PLUGIN-GRANT.md - Community Plugin Grant Addendum
• docs/legal/PLUGIN_DEVELOPER_FAQ.md - Plugin developer FAQ
• docs/legal/SAAS_MSP_GUIDANCE.md - SaaS and MSP guidance
• docs/legal/ENFORCEMENT_TELEMETRY_POLICY.md - Audit and compliance policy

Document maintained by: Legal + Security Guild Last review: 2026-01-25