Licensing | Engineering Standards

Apache 2.0, MIT, and BSD (2- or 3-clause) are allowed. For all other licences, including copyleft licences such as GPL and AGPL, ask your Navigator.

Why the allowlist

NinjaTrader sends native desktop (.NET) and mobile (Flutter) binaries to customers. Strong copyleft licences (GPL and AGPL) can require releasing the source code for proprietary code they link to. This means one transitive dependency can put shipped code at risk. AGPL is the highest risk and also applies to server-side services. The concern is distribution risk, not policy for its own sake. That is why anything outside the allowlist must be escalated.

Licence categories

Category	Examples	Rule
Permissive	MIT, BSD, Apache 2.0, ISC, 0BSD	Allowed. Prefer Apache 2.0 because it includes a patent grant.
Weak copyleft	LGPL, MPL 2.0, EPL	Escalate. These are often acceptable when unmodified and dynamically linked.
Strong copyleft	GPL, AGPL	Escalate. By default, do not use for shipped clients.
Source-available	SSPL, BSL, Elastic, Commons Clause	Not permissive. Escalate.

Font, icon, and media asset licences can affect shipped clients as often as code licences do. This includes CC-BY attribution and restricted commercial fonts. Treat them the same way.

Enforce it in CI

Licence scanning is a quality gate that fails the build when it finds a disallowed licence. Use these tools for each ecosystem: sbt-license-report (Scala/JVM), license-checker (npm), pip-licenses (Python), and nuget-license (.NET). Dart has no allowlist CLI. flutter_oss_licenses only creates attribution. Use the canonical SPDX identifiers (the -only/-or-later forms) so scans give consistent results.

# npm: fail on any licence outside the allowlist
- name: license check (node)
  run: |
    npx license-checker --production --excludePrivatePackages \
      --onlyAllow 'MIT;ISC;Apache-2.0;BSD-2-Clause;BSD-3-Clause;0BSD'

Copyleft usually comes through transitive dependencies. Block it at PR time across ecosystems with Dependency Review:

- uses: actions/dependency-review-action@v4
  with:
    # strong copyleft only; weak copyleft (LGPL/MPL) escalates, not auto-denied
    deny-licenses: GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later

Attribution

MIT, BSD, and Apache all require you to keep copyright and licence text when distributing software. Generate a THIRD-PARTY-NOTICES file in CI and include it with every distributed client:

- name: generate attribution
  run: npx generate-license-file --input package.json --output dist/THIRD-PARTY-NOTICES.txt --overwrite --ci

Our own code

NinjaTrader repositories are proprietary and all rights are reserved unless a repository is explicitly opened. Every repository has a LICENSE file. This makes inbound contributions and internal reuse clear.

References

SPDX License List, canonical identifiers.
Apache License 2.0 and the GNU licences, the copyleft obligations behind the escalation rule.
choosealicense.com, plain-language obligations.
Shares supply-chain tooling with security.