Open source vision software licenses for commercial use

You can sell a machine that runs open source vision software. The deciding question is not whether open source allows commercial use — Apache 2.0 does, with no royalties and no obligation to open your code — but what every single dependency in the shipped image obligates you to hand over. One Apache 2.0 library costs you a license text and, when upstream has one, a NOTICE file. One GPL library linked into a product you distribute makes the whole application GPL. Below are the rules for each license family, what Apache 2.0 demands when you ship OpenCV, how linking decides GPL versus LGPL, and a worked audit of a twelve-package appliance stack. The architecture and effort side of the same decision is covered in open source machine vision software: integration tradeoffs; this page is the gate your image passes before it ships.

The decision, up front

If your stack is OpenCV plus other Apache 2.0 and BSD- or MIT-style packages, sell the product. Ship the license texts, any NOTICE files and a one-line statement of changes, and your application code stays closed. That is the entire obligation for permissive licenses, and OpenCV has carried the Apache 2.0 license since release 4.5.0; the earlier 3.x releases were 3-clause BSD, which is equally permissive.

The gate you actually pass is per dependency, not per image. The check is mechanical: enumerate everything your image contains, group it by license, and act on the copyleft entries. Everything else is bookkeeping you generate at build time.

What Apache 2.0 makes you ship

When you redistribute OpenCV binaries, the Apache 2.0 conditions attach to each component. Give every recipient a copy of the license text. If the project ships a NOTICE file, carry a readable copy of it. State the significant changes you made to the code. None of this forces disclosure of your application source — the license text and notice can sit in a documentation folder or an About panel as long as the recipient can read them.

Two further points matter to vision teams:

• The license carries an express patent grant from contributors. File a patent suit over the work and your own license under it terminates.
• OpenCV downloads the IPPICV performance binaries at build time, and the grant covering them permits commercial use, so that download is not a hidden trap inside your OpenCV build.

GPL and LGPL: linking decides

A GPL license does not forbid selling — it demands source. If your application links a GPL library and you distribute that application, the combined work must be licensed under the GPL, complete with corresponding source. The trigger is distribution: a machine running GPL code inside your plant, with nothing leaving it, owes nobody anything. Components under the AGPL reach further and impose the same duty on software users only reach over a network.

LGPL is the middle path. The library stays LGPL, your application stays closed, provided the library remains a separately replaceable shared object. Link an LGPL library statically and you must add the object files a recipient needs to relink a modified copy of the library. The build side of that choice — static versus shared libraries and the linker errors each produces — is covered in OpenCV static library link errors and the fix, and the binary-compatibility angle in computer vision library ABI integration across toolchains.

The kernel follows its own boundary. A Linux kernel is GPL-2.0, but a user-space program that calls it through the normal system-call interface is a separate work, so the kernel's license does not dictate your application's. What the image owes is the kernel's own source, satisfied by pointing recipients at the exact kernel release the image was built from.

The camera SDK and the controller license

Two proprietary layers sit beside the open source ones. Your camera's SDK is licensed by its maker, and the clause to read is redistribution: whether the SDK's runtime binaries may ship inside your product image. Where the camera exposes a standard GigE Vision or USB3 Vision interface with a GenICam layer, less of that SDK has to ship at all — one reason teams standardize the interface before the vendor, as covered in how to mix camera brands in one vision software stack. The same audit applies to any area scan cameras or board-level cameras you build in: the sensor is hardware, the driver stack is a license surface.

On the controller side, the machine-vision software license is sometimes bundled with the hardware and sometimes not, so it belongs on the same manifest. The MV-VC3301H-128G66 ships with a VM6200Pro license included; the MV-VC4712-256G10-2TH ships without a VM license key. For a controller that arrives with the vision software license already keyed:

And for one that expects the software license as its own line in the build budget:

The vision controllers range mixes both patterns, so read the license line of the exact model before you assume the software is included.

Worked example: a twelve-package stack, audited

Take an embedded inspection appliance: your Python application, a Linux image and a USB3 board camera. The audit starts by making the machine list what it carries, because the manifest, not memory, is the record. The Python standard library does the first pass for you:

from importlib.metadata import distributions

unlicensed = []                    # list[str]: packages with no license classifier
for dist in distributions():
    classifiers = dist.metadata.get_all("Classifier") or []
    if not any(c.startswith("License ::") for c in classifiers):
        unlicensed.append(dist.metadata["Name"])

print(len(unlicensed), unlicensed)

On the example stack the printout names one package: the vendor's camera SDK wrapper, whose metadata carries no classifier. That is the one item a human reads; the rest group cleanly by license:

One entry fails the product: the GPL-3.0 decoder. Two real fixes exist — ship the application under GPL-3.0 with full source, or swap the decoder for a permissively licensed equivalent. For a closed product the swap wins, and the tally becomes:

The LGPL-2.1 package stays, loaded as a shared object, so its obligation is a source offer for that library alone. The shipped image then carries three license texts, a NOTICE entry for any component that ships one, a change statement for anything you patched, the LGPL source offer, the kernel source pointer and the camera SDK agreement. Twelve packages, three license texts, zero lines of your own source surrendered.

When the usual answer is wrong

• "Open source is free for any use" holds until the GPL component you distribute asks for your source. The price of GPL is disclosure, not money.
• "Nobody will notice one small library": the enumeration above prints it on demand, and so does any customer who runs the same command on your image.
• "We only run it in-house": internal machines carry no GPL source duty, but AGPL components still impose theirs over a network, and the moment one unit ships the duty starts.
• "The media pipeline is just FFmpeg": FFmpeg builds are LGPL by default, and enabling certain encoders flips the whole build to GPL. If your appliance records video, know which build it carries.
• "The SDK came with the camera": bundled for development is not the same as redistributable inside a product. The clause that matters covers redistribution of the runtime.
• "The prebuilt OS image is the vendor's problem": you distribute the image, so its manifest is your manifest. Audit the image as shipped, with your packages layered on top.

Checklist before the image leaves

1. Enumerate with the classifier pass on the exact image that ships, not your development machine.
2. Group by license and read only the copyleft and unclassified entries.
3. Replace or isolate every GPL package you are not prepared to open-source.
4. Confirm every LGPL library loads as a shared object, or add the relink objects.
5. Generate the license folder from the manifest: texts, NOTICE files, change statements.
6. Record the kernel release and its source location for the image.
7. File the vendor agreements: camera SDK runtime, controller software license, any codec pack.
8. Keep the manifest with the build so the next dependency update re-runs the audit.

For contract-scale exposure, hand the final manifest and any GPL boundary case to legal review; the list above is the engineering pass that makes that review short. Clear the software side, then size the hardware around it: the vision system configurator walks camera, lens, light and controller as one build. If you want a second pair of eyes on the software entitlements before a release, use the contact page.