RPL-1.5 treats deployment as distribution: using it to serve other people can trigger the source duty even when you never ship a file.
On this page
What it does
The Reciprocal Public License 1.5 is the strictest reciprocal license in common SPDX use. Ordinary copyleft waits for you to hand out a copy. RPL does not. It defines deployment, and using the software to serve third parties or to run your business counts as deployment, which carries a duty to publish the source of the program and of your changes. Personal use and internal research and development are the carve-outs the license names. Read the text of the exact version you have, because this is where it parts company with everything else in your inventory.
Details
For a SaaS vendor this is the license that breaks the usual mental model. With the GPL you can reassure yourself that you never ship a binary. With RPL that sentence is not a defense, because the license reaches the act of deploying. If an RPL component sits inside a service your customers use, your changes to it are expected to be public, and that is a commercial decision rather than a packaging detail. Where the boundary of your changes sits is contested, so escalate this component early.
Pros
- Stops the SaaS loophole: you cannot take the code, run it as a service, and never share your changes.
- Makes the network trigger explicit, so a hosted product has a yes-or-no question instead of a distribution debate.
Cons
- A SaaS product that includes this code may have to offer corresponding source of the service, not only of a downloadable binary.
- Procurement and investors treat this family as high scrutiny. Expect extra review before you publish a page that lists it.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Commercial use
You may ship the code inside a paid product. The license does not restrict commercial use.
Modify
You may change the code, including keeping those changes private, unless a later obligation says otherwise.
Distribute
You may give copies to others. Distribution is what usually turns notice and source duties into real work.
Private use
Use inside your company, including internal forks, does not by itself trigger distribution duties.
Limits
Hold liable
The authors disclaim warranty. Recipients cannot hold them liable for damages arising from the software, except where law forbids that disclaimer.
Use trademark
The license is not a trademark license. Names, logos and product marks stay with their owners unless a separate grant says otherwise.
Open your product
Copyleft can reach a combined work you distribute, not only the original files. How far that reaches in your stack is a counsel question.
Network copyleft
Classic GPL has no network clause. Offering the program as a hosted service, without distributing a copy, does not by itself trigger the source offer.
Obligations
Include copyright
Keep copyright notices on distributed copies.
Include license
Give recipients a copy of the license with the program.
Disclose source
When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.
Same license
The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.
Disclose source
RPL is deployment copyleft. Using the software, not only distributing a binary, can trigger the reciprocity the license describes.
What RPL-1.5 requires when you ship
For RPL-1.5, offering the software as a hosted service can trigger the same source duty that handing someone a binary would. Confirm what you run, not only what you ship as a file. Network copyleft is written for that gap. The steps below are the shipping and hosting work, in the order a reviewer usually walks them.
You are outside the reciprocal duty while the use stays personal, or internal research and development, which are the carve-outs the license itself names.
You meet the terms on a deployment when the source of the program and of your modifications is published, under RPL, to the people the license points at.
You meet them on a shipped binary the way you would with any strong copyleft: recipients get the complete corresponding source of what you handed them.
You are on time when publication happens on the schedule the license sets, which is tied to the deployment and not to your next release. Check the wording in your own copy.
You have handled the mix when no RPL code sits inside a GPL work or a closed product. RPL is not GPL-compatible, and it does not permit a proprietary combination.
The duties named in RPL-1.5
Notice still travels with any copy. RPL-1.5 also names a source duty that can fire when you offer the software as a hosted service. These are the conditions in the text.
Include copyright
Keep copyright notices on distributed copies.
Include license
Give recipients a copy of the license with the program.
Disclose source
When you distribute a binary of a covered work, corresponding source has to be offered in the way the license describes.
Same license
The combined work you distribute has to stay under this license. You cannot close the covered work with a more restrictive grant.
Disclose source
RPL is deployment copyleft. Using the software, not only distributing a binary, can trigger the reciprocity the license describes.
Things to be aware of
- Filing RPL under 'just another GPL'. The GPL reasoning that a hosted service ships nothing does not carry over, because RPL attaches to deployment instead.
- Reading the SourceTrust checklist as the whole picture. The catalog row marks RPL as one that network use does not trigger, so a hosted project gets no network item for it.
- Keeping a private fork of an RPL component in a customer-facing service. If the deployment is covered, that fork is exactly what the license asks you to publish.
- Settling the internal-use question in a stand-up. RPL reaches further into internal deployment than the GPL does, and the wording rewards a careful read with counsel.
What the Reciprocal Public License 1.5 does not do
Search results often flatten Reciprocal Public License 1.5 into a slogan. These are the usual misreads. RPL-1.5 is a grant with conditions, not a permission to skip the paperwork below.
- the Reciprocal Public License 1.5 does not wait for you to ship a file. Offering the software over a network is enough to trigger the source duty.
- It is not the same as GPL. Treating AGPL or SSPL as "GPL for servers" without reading the extra clause is the usual miss.
How RPL-1.5 differs from nearby licenses
These licenses are often confused with RPL-1.5, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- RPL-1.5
- RPL-1.5 treats deployment as distribution: using it to serve other people can trigger the source duty even when you never ship a file.
- AGPL-3.0-only
- AGPL is GPLv3 plus section 13: if you let users reach your modified version over a network, they can ask you for its source.
- SSPL-1.0
- SSPL is MongoDB's rewrite of the AGPL. Offer the software as a service and its section 13 asks for the source of your whole service stack.
- GPL-3.0-only
- GPL-3.0 keeps the source duty on distributed binaries and adds a patent grant, an anti-lockdown rule for consumer devices, and a cure period.
Common questions about Reciprocal Public License 1.5
Answers to common questions about what Reciprocal Public License 1.5 requires, when its duties apply, and what evidence belongs with a release.
What is the Reciprocal Public License 1.5?
The Reciprocal Public License 1.5 is the strictest reciprocal license in common SPDX use. Ordinary copyleft waits for you to hand out a copy. RPL does not. It defines deployment, and using the software to serve third parties or to run your business counts as deployment, which carries a duty to publish the source of the program and of your changes. Personal use and internal research and development are the carve-outs the license names. Read the text of the exact version you have, because this is where it parts company with everything else in your inventory.
What does RPL-1.5 require when you ship a product?
You are outside the reciprocal duty while the use stays personal, or internal research and development, which are the carve-outs the license itself names. You meet the terms on a deployment when the source of the program and of your modifications is published, under RPL, to the people the license points at. You meet them on a shipped binary the way you would with any strong copyleft: recipients get the complete corresponding source of what you handed them. You are on time when publication happens on the schedule the license sets, which is tied to the deployment and not to your next release. Check the wording in your own copy. You have handled the mix when no RPL code sits inside a GPL work or a closed product. RPL is not GPL-compatible, and it does not permit a proprietary combination.
Does running RPL-1.5 as a hosted service trigger the source duty?
Yes. For RPL-1.5, offering the software as a hosted service can trigger the same source duty that distribution would. That is the point of this family.
What is corresponding source for RPL-1.5?
Corresponding source is the source a recipient needs to build and run the same binary, including scripts and interface files the license names. Hosting a repository URL can be an offer. The offer has to match what you actually shipped. SourceTrust records that a person on your team confirmed the offer. It does not publish your source and does not host a mirror.
How is RPL-1.5 different from GNU AGPL v3.0?
RPL-1.5 asks this: RPL-1.5 treats deployment as distribution: using it to serve other people can trigger the source duty even when you never ship a file. GNU AGPL v3.0 asks this: AGPL is GPLv3 plus section 13: if you let users reach your modified version over a network, they can ask you for its source. Open the GNU AGPL v3.0 page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record RPL-1.5 for a buyer?
The catalog records RPL-1.5 as copyleft, and it also records network use as something that raises no obligation for this license. In practice that means one item: a source offer on the project checklist when the distribution context is Distributed binary or Mixed. A SaaS-only project gets no checklist item at all for an RPL component, so the deployment question above is one you have to run yourself and write into the component notes.
Where do I record RPL-1.5 for a buyer?
The catalog records RPL-1.5 as copyleft, and it also records network use as something that raises no obligation for this license. In practice that means one item: a source offer on the project checklist when the distribution context is Distributed binary or Mixed.
A SaaS-only project gets no checklist item at all for an RPL component, so the deployment question above is one you have to run yourself and write into the component notes. Read /docs/reviewing-component for where those notes live.
- This guide classifies RPL as network copyleft while the catalog row classifies it as strong copyleft. The difference is deliberate, and it is why no network review item appears.
- Do not wait for a checklist item to tell you an RPL component needs a decision. Put the deployment analysis in the component notes so the next reviewer can see it.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.