Permissive like MIT, plus an express patent grant. The catch is the NOTICE file: it has to travel inside the binaries you ship.
On this page
What it does
Apache-2.0 is the permissive license written for companies. You get the MIT freedoms plus an express patent grant. Every contributor licenses the patents needed to use their own contribution. Two duties come with that. State in each file you changed that you changed it. Carry the contents of any upstream NOTICE file into your own distributions, which is section 4(d). A NOTICE file is a short attribution text the project ships next to its license. Kubernetes, TensorFlow, Android and Swift use this license.
Details
Apache-2.0 is the permissive license that can hold up your attestation page, and the NOTICE file is the reason. A hosted service hands out no copies, so nothing extra applies to it. Ship a desktop installer, a mobile app or a container image, and the upstream NOTICE text has to be inside that artifact. Your public page is not a substitute for it. The patent grant is why large vendors prefer this license. The patent termination clause is why Apache-2.0 code does not combine with GPL-2.0-only code.
Pros
- Express patent grant from contributors, which is why large vendors prefer it over MIT.
- Still permissive: you can ship in a closed product and keep your source private.
Cons
- The notice duty is easy to miss in a desktop, mobile, or container build. A web page is not a substitute for notices inside the artifact.
- Buyers who want an express patent grant will ask you to prefer Apache-2.0 over a short MIT-style text.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Sublicense
You may include the code under your own product terms, so long as you still meet this license's conditions.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Patent use
The license includes an express patent grant from contributors for the licensed work.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
Apache-2.0 section 6 says the grant does not let you use the names of the licensor or contributors to endorse products, except as required for NOTICE reproduction.
Obligations
Include copyright
Keep the copyright line with every copy or substantial portion you distribute.
Include license
Keep the license text with every copy or substantial portion you distribute. A web page is not a substitute for notices inside a shipped artifact.
Include notice
If a NOTICE file travelled with the work, reproduce the attribution notices from it in the form the license describes.
State changes
Mark changed files so they are not misrepresented as the original.
What Apache-2.0 requires when you ship
When a copy that includes Apache-2.0 code leaves your company, the grant is broad and the paperwork is easy to miss. Distribution here means an installer, a mobile binary, a container image, or an SDK another team embeds. Work this list against the artifact you actually hand over, not against a README. A hosted service that never gives out a copy still belongs on the record, but the notice duty does not fire until a copy exists.
You are meeting the terms for a hosted service once the license text is recorded on the component. Apache-2.0 has no network trigger, so running it for users changes nothing.
You are meeting the NOTICE duty when every upstream NOTICE file's contents appear inside the artifact you ship. A legal notices screen or a bundled file works.
You have handled a modified file when it carries a prominent note saying that you changed it. The note belongs in the file itself, next to the original copyright.
You keep the patent grant as long as you do not start patent litigation over this code against a contributor. Filing such a claim ends your patent license under section 3.
You are on solid ground combining Apache-2.0 with proprietary code and with GPL-3.0 code. GPL-2.0-only projects are the known exception, because of the patent termination clause.
The duties named in Apache-2.0
The license text itself is short. These are the named conditions. They follow the code, including files you vendor into your own repository and transitive packages in the lockfile.
Include copyright
Keep the copyright line with every copy or substantial portion you distribute.
Include license
Keep the license text with every copy or substantial portion you distribute. A web page is not a substitute for notices inside a shipped artifact.
Include notice
If a NOTICE file travelled with the work, reproduce the attribution notices from it in the form the license describes.
State changes
Mark changed files so they are not misrepresented as the original.
Things to be aware of
- Rendering the license text and dropping NOTICE. They are two separate documents, and the NOTICE contents are the part that must travel inside the binary.
- Adding marketing or your own credits into NOTICE. The file is meant to stay minimal, and anything you put there becomes a duty for everyone downstream.
- Skipping the changed-file note when you patch a vendored dependency. It is one line in the file header and it is a real condition, not a convention.
- Expecting SourceTrust to check that the NOTICE file actually shipped. It surfaces the checklist item and blocks publishing until a person confirms the step.
What the Apache License 2.0 does not do
Search results often flatten Apache License 2.0 into a slogan. These are the usual misreads. Apache-2.0 is a grant with conditions, not a permission to skip the paperwork below.
- Apache-2.0 does not drop the notice duty just because you already listed the component on a web page. The NOTICE file has to travel inside binaries you ship.
- It does not combine with GPL-2.0-only. The patent termination clause is the usual reason.
- It does not trigger on network use. A hosted service that never hands out a copy has no extra Apache duty beyond recording the text.
How Apache-2.0 differs from nearby licenses
These licenses are often confused with Apache-2.0, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- Apache-2.0
- Permissive like MIT, plus an express patent grant. The catch is the NOTICE file: it has to travel inside the binaries you ship.
- MIT
- MIT lets you ship the code inside a closed, paid product. The one condition is that the copyright line and license text travel with every copy.
- BSD-3-Clause
- Permissive like MIT, with one extra rule: you may not use the authors' names to promote your product. Notices travel with source and binaries.
- GPL-2.0-or-later
- GPL-2.0 asks for source when you hand someone a binary. Running it on your own servers triggers nothing. The trigger is shipping a copy, not merely using it.
Common questions about Apache License 2.0
Answers to common questions about what Apache License 2.0 requires, when its duties apply, and what evidence belongs with a release.
What is the Apache License 2.0?
Apache-2.0 is the permissive license written for companies. You get the MIT freedoms plus an express patent grant. Every contributor licenses the patents needed to use their own contribution. Two duties come with that. State in each file you changed that you changed it. Carry the contents of any upstream NOTICE file into your own distributions, which is section 4(d). A NOTICE file is a short attribution text the project ships next to its license. Kubernetes, TensorFlow, Android and Swift use this license.
What does Apache-2.0 require when you ship a product?
You are meeting the terms for a hosted service once the license text is recorded on the component. Apache-2.0 has no network trigger, so running it for users changes nothing. You are meeting the NOTICE duty when every upstream NOTICE file's contents appear inside the artifact you ship. A legal notices screen or a bundled file works. You have handled a modified file when it carries a prominent note saying that you changed it. The note belongs in the file itself, next to the original copyright. You keep the patent grant as long as you do not start patent litigation over this code against a contributor. Filing such a claim ends your patent license under section 3. You are on solid ground combining Apache-2.0 with proprietary code and with GPL-3.0 code. GPL-2.0-only projects are the known exception, because of the patent termination clause.
Does Apache-2.0 require me to open my own source?
It does not trigger on network use. A hosted service that never hands out a copy has no extra Apache duty beyond recording the text.
How do I attribute Apache-2.0 in a product I ship?
Attribution for Apache-2.0 means the copyright line and the license text travel with every copy a recipient actually gets. That can be an about screen, a licenses file inside the installer, or a notice in the container image. A public page helps a buyer audit the inventory. It does not replace notices inside the artifact. If you copied files into your own repository, the header on those files still has to stay.
Is a website notice enough for Apache-2.0?
No. Apache-2.0 talks about copies. A public attestation page is the honest list for procurement. The condition is met when the notices sit in the material you hand over. Put them in the installer, the about screen, or a licenses file inside the binary, then keep the same texts on the page.
Do transitive Apache-2.0 dependencies count?
Yes. The condition follows the code, not the package you chose by name. If the lockfile pulled in Apache-2.0 transitively and you distribute that tree, those notices travel too. Listing only direct dependencies is how teams miss the duty.
How is Apache-2.0 different from MIT License?
Apache-2.0 asks this: Permissive like MIT, plus an express patent grant. The catch is the NOTICE file: it has to travel inside the binaries you ship. MIT License asks this: MIT lets you ship the code inside a closed, paid product. The one condition is that the copyright line and license text travel with every copy. Open the MIT License page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record Apache-2.0 for a buyer?
Apache-2.0 is the one SPDX id that raises the Apache binary NOTICE checklist item. It appears when the project is set to ship binaries or to a mixed deployment. It is never ticked for you: someone on your team confirms that the NOTICE shipped, and publishing stays blocked until they do. Auto-fetch stores the license text on the component. The NOTICE and THIRD_PARTY_LICENSES.md files are generated from the published snapshot, so they match the page.
Where do I record Apache-2.0 for a buyer?
Apache-2.0 is the one SPDX id that raises the Apache binary NOTICE checklist item. It appears when the project is set to ship binaries or to a mixed deployment.
It is never ticked for you: someone on your team confirms that the NOTICE shipped, and publishing stays blocked until they do. Auto-fetch stores the license text on the component.
The NOTICE and THIRD_PARTY_LICENSES.md files are generated from the published snapshot, so they match the page. Read /docs/export-sbom for the export formats.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.