  Contemporary software is characterized by reuse of components that are
declared as dependencies and that are received from package
managers/registries, such as, NPM, PyPI, RubyGems, Maven Central, etc. Direct
and indirect dependency relations often form opaque dependency networks, that
sometimes lead to conflicting software licenses within these. In this paper, we
study license use and license incompatibilities between all components from
seven package registries (Cargo, Maven, NPM, NuGet, Packagist, PyPI, RubyGems)
with a closer investigation of license incompatibilities caused by the GNU
Affero General Public License (AGPL). We find that the relative amount of used
licenses vary between ecosystems (permissive licenses such as MIT and Apache
are most frequent), that the number of direct license incompatibilities ranges
from low 2.3% in Cargo to a large 20.8% in PyPI, that only a low amount of
direct license incompatibilities are caused by AGPL licenses (max. 0.04% in
PyPI), but that a whopping 6.62% of Maven packages are violating the AGPL
license of an indirect dependency. Our results suggest that it is not too
unlikely that applications that are reusing packages from PyPI or Maven are
confronted with license incompatibilities that could mean that applications
would have to be open-sourced on distribution (PyPI) or as soon as they are
publicly available as web-applications (Maven).
