How to Review GPL/AGPL Copyleft Contamination in a Vendor Deliverable

Sid, Ops at a 23-person UK product studio, is about to treat the OSS line as colour because Finance wants a Friday yes. Knowing how to review gpl agpl copyleft contamination in a software deliverable is a 25-minute hunt: demand a named SBOM, require prior written consent before copyleft, log AGPL network use on the customer-facing portal, ask about AI snippets, and refuse a blanket OSS indemnity carve-out.

September 2026. English law; exclusive courts of England and Wales. The packet — PSA, this SOW, and any OSS policy URL dated today — is booked for Friday. Clause 8.4: “Supplier uses open source software responsibly and will comply with applicable open source licences.” No annex. Tuesday Slack named an AGPL analytics plugin. Typical mistake: treating “open source” as free libraries. The rush is the problem.

The hidden risk is that a vibe sentence is not a licence field — and SaaS hosting does not switch AGPL off. CISA (29 July 2026) added Component License as a minimum SBOM element. Sid’s 8.4 has none of that. GNU AGPLv3 §13 was written so a modified Program must offer users interacting remotely through a computer network Corresponding Source at no charge. English copyright sits in the Copyright, Designs and Patents Act 1988.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

Which inventory counts — a named SBOM or “we use open source responsibly”?

A vibe sentence is not a component, version, SPDX identifier, or transitive tree. Circle “responsibly.” Demand a named list and a machine-readable SBOM in SPDX or CycloneDX with a Component License field. Sid’s 8.4 = no list, no SBOM — fail.

FOSSA (30 July 2026): Component License should be SPDX IDs; coverage includes transitive dependencies — “there is no minimum depth”; a new SBOM per build or release. CISA is guidance, not Sid’s statute. In practice, contract for an SBOM with each delivery. Do: write named list with licences, or fail. Don’t: treat “responsibly” as disclosure under Friday pressure.

What does copyleft need before it lands in the deliverable?

Ownership of the SOW work product does not unwind GPL or AGPL. Share-alike can attach to code he ships or hosts. Require Customer’s prior written consent before any GPL, LGPL, AGPL, MPL or SSPL component, plus a warranty of no undisclosed copyleft.

Venable (16 April 2026): advance written consent for copyleft; OSS must not force proprietary source out. Snowflake’s buyer PSA bans copyleft in a deliverable — colour, not a model clause. Bosch: undisclosed OSS is deemed unaccepted. Sid’s paper = no consent mechanic — fail. Do: add prior written consent and a no-undisclosed-copyleft warranty. Don’t: assume “we own the deliverable” closes this hunt.

Why does SaaS hosting not switch AGPL off?

GPL often hunts distribution. AGPL §13 hunts network interaction with a modified Program. A customer-facing portal is the fact pattern AGPL was written for. Hosting does not switch it off. Log: was the Program modified? Do users interact with that program over a network, or only with Sid’s app over an arm’s-length call?

fastCRW (4 July 2026): the network-source obligation fires when you modify the AGPL program, run that modified version, and users interact with that program itself. An AGPL API call does not copyleft the app. Vircon (16 June 2026) names two traps: AGPL closes the ASP loophole, and a binary handed to a customer is distribution. Do: log modify / network users / linked-versus-call. Don’t: skip because “we’re SaaS.” Undeclared AGPL plus no architecture note = walk Friday, then counsel — the solicitor you instruct on this paper.

How do you catch an AI-pasted GPL snippet the SBOM never lists?

Conventional SCA reads manifests and lockfiles. A pasted function never appears in package.json. Ask whether the vendor used coding assistants, whether snippet matching was run, and whether they warrant no third-party copyleft.

FOSSA (2 July 2026): licences including GPL and AGPL still apply if a model typed the code. OpenChain KWG (8 June 2026): GitHub has stated verbatim copying of more than 150 characters happens about 1% of the time — a control, not a clean bill. For example, Sid’s lockfile SCA would miss a pasted GPL helper. Do: scan snippets, not only lockfiles, and add an AI-tool warranty. Don’t: treat autocomplete as a clean bill.

When to refuse an OSS carve-out on the IP indemnity?

Vendors routinely exclude OSS from the IP indemnity. Then contamination is his bill — a costly rewrite, not their cheque. Circle any “except open source” carve-out. Refuse a blanket exclusion. Demand replace, modify, or procure-rights.

Venable: avoid the blanket OSS exclusion. Law Insider samples warrant no unapproved OSS and that Buyer’s product is not forced under those terms. ReviewMyContract (2026) flags silence on OSS disclosure. If the fight is which claims they indemnify, that is a different hunt — the indemnity clause review checklist. Stay on the OSS carve-out. Silent paper + OSS possibly excluded = escalate / walk. Do: reject a blanket OSS exclusion. Don’t: treat the IP heading as cover.

How do you choose disclose, ban copyleft, or walk?

Disclose only if the log is complete: SBOM with licences, no undeclared copyleft, AGPL consented with an architecture note, snippet warranty, OSS inside indemnity. Ban copyleft — prior written consent; AGPL/SSPL off unless Sid opts in. Walk if 8.4 stays a vibe sentence, the plugin stays unnamed, or OSS is carved out.

If the fight is the PSA wrapper — fees, T&M, or assignment of work product — that is a different hunt: the professional services agreement review checklist. Freeze the packet plus any exhibit — attached schedule or appendix. Success bar: a one-page log plus one sentence that would pause Friday. Sid already has three: no SBOM; no consent; undeclared AGPL. Workflow: named SBOM → copyleft consent → AGPL §13 network test → AI snippet scan → OSS inside indemnity → disclose / ban copyleft / walk. Do: escalate that package. Don’t: treat 8.4 as colour before you sign under Finance pressure. Pause if 8.4 stays a vibe sentence. Optional: upload the same PDF to document analysis for a first-pass — a machine extract of clauses before a human reads every page — and a human still opens 8.4 and must verify every High flag — a severity hit a human still opens.