Source Poisoning

Source poisoning is when a FOSS project, as provided, requires code under a non-FOSS license to perform its advertised value & purpose. This can often occur in projects which are managed as one single mixed-license repository.

This can be problematic as users may be using a project thinking it’s FOSS, without knowing they’re reliant upon non-FOSS code, and potentially using code which requires or assumes adherence to non-FOSS terms.

Source poisoning does not apply to all scenarios where FOSS code relies upon non-FOSS content. For example, there are many FOSS projects which for video game mods & re-implementations, which require original (non-FOSS) game material, and there are many projects which are built to be used with non-open APIs. The main thing to consider is the value & purpose being advertised within the scope of the project, and if that can be achieved via FOSS code alone.

Unfortunately, this kind of issue can be tricky to spot, and often needs understanding of the code & build systems. Frequently you’d have to find all non-FOSS files, remove them, then see if the project still builds and functions.