PHP Composer vendors licensing

Question

I'm using a composer as a dependency manager for my PHP project. Composer operates as a library, which uses packagist as a software repository to fetch third-party dependencies.

I'm interested, whether usage of third-party library is counted as dynamic linking or so. Third-rd party libraries are not present in source code by themselves, but are fetched during the deployment of application (much similar as usual software repository). They are required to application to work properly.

To be more certain, given I've forked AGPLv3 project (composer not used before). Can I just use composer with it or should I check that all dependencies are recursively compatible with given project license?

Answer 1

This is a hotly disputed aspect of software licensing.

One interpretation is that, if you are not -distributing- a library, you do not need a license, nor do you need to accept or comply with any terms attached to use of the library (with the caveat that you might still have to accept terms to do any meaningful testing of your program).

By this interpretation, a non-free program could dynamically fetch GPL'd code from the internet, dynamically link with it, and execute the result.

Needless to say, you're in better shape if you just comply with licenses or write your own.

• ScayTrase: Notes on distribution are interesting. The problem is on the inverse side. Could GPL'd program fetch non-GPL'd code from internet?