I am working on a product for a client that must be valid and fit for purpose.

It's built on a LAMP stack (PHP/Cake), so there's GPL, MIT, PHP, APACHE licenses:

"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.

My rationale that my product is valid and fit for purposes:

  • The signed UAT doc proves validity and fitness for purpose.
  • The stack is so widely used by developers, industry and end users (netcraft, gartner etc. stats), that there is a consensus that it IS fit for purpose. (ie we can disregard the fitness for purpose statement in the warranty disclaimer to an extent)

Is this a valid point? Can I make claims that my software is fit for purpose?

  • 3
    "consensus" != "warranty". Feb 6, 2013 at 13:18
  • but does warranty = fit for purpose? I understand warranty to be if it does not do what it is meant to do, then it has to be fixed/replaced or money back.
    – user127379
    Feb 6, 2013 at 13:57
  • A warranty can be for any number of things. I could guarantee that a given program will not crash for at least 3 seconds, that wouldn't make it fit for any particular purpose (unless your purpose is only to run any program for at least 3 seconds). Feb 6, 2013 at 13:58
  • 7
    You can say your product is fit for a purpose if you're willing to warrant it that way. You can even say you think a work you licensed is fit for a purpose, but the license makes that your opinion, not that of the licensor.
    – Blrfl
    Feb 6, 2013 at 14:21
  • 1
    Software Engineering is not the best choice for legal advice. Consult with a lawyer.
    – zzzzBov
    Feb 6, 2013 at 16:02

6 Answers 6


First of all, as others have said, there's a difference between software actually working versus software being sold with a legal guarantee that it works.

The disclaimer text you cite means that the original licensor you got the software from does not grant any kind of warranty. You can offer the software yourself with a warranty attached. The original authors don't offer a legal guarantee that the software works, but there's no reason why you can't make such a guarantee to your client. (Whether or not you think it's a good idea to attach a legal guarantee to something you didn't write is another matter entirely.)

Specifically, section 4 of the GPL states:

You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.

I'm not sure if a license must grant you the capability to add warranties explicitly (I'm not a lawyer, but I think the answer is no -- my intuition is that you should be able to offer guarantees on virtually whatever you want). In any case, the GPL unambiguously offers you the ability to add your own warranties while conveying the software to a client.

I'm not sure about BSD, since it requires you to preserve the disclaimer, but perhaps you can offer warranty protection notwithstanding the disclaimer in the license. In effect, you might say, "I assert a warranty that this work as a whole is fit for some purpose (even though some works this larger work is derived from do not carry such a warranty)." Always ensure, of course, that your warranty terms do not violate the licenses of any of your included works.

However, again, I'm not a lawyer, and if your client has requested a warranty of fitness of purpose, he's probably looking for some vetted legal protection. You should consult a lawyer to draft the text of such a warranty.

  • You can add warranties to a work as long as doing so doesn't violate the terms of the license and that it's clear you're the one adding the warranty, not the licensor.
    – Blrfl
    Feb 6, 2013 at 14:23
  • @Blrfl Makes sense. If I can subsume BSD-licensed code into a larger work with more stringent but compatible licensing (e.g., the GPL), I can do the same with the terms of my warranties.
    – apsillers
    Feb 6, 2013 at 14:26
  • 2
    By the way: statements such as "WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE." are void in some countries, e.g. Italy. You simply can't distribute something without warranties. Either the whole contract is considered void or you simply end-up taking legal responsabilities.
    – Bakuriu
    Feb 6, 2013 at 15:50
  • @Bakuriu: and in some countries inapplicable clauses will be interpreted "in the spirit of the contract", which can mean that warranties will be voided as much as possible within the law. This and many other details make the "consult a lawyer" part so incredibly important. Feb 6, 2013 at 16:02

This is a standard disclaimer, that's often given for software, especially free software.

It just means that the provider of the software makes no guarantees about the fitness of the software. He may very well be convinced himself that the software is good for what it does, but he doesn't want to enter the legal minefield that is guaranteeing it.

The same applies to "consensus": "The community" (however you want to define it) might agree that a given piece of software is fit for its stated purpose, but they won't give you a guarantee.

In short: unless you pay for it, you will never get anyone to guarantee you any kind of fitness. And even if you pay someone, they might not guarantee it.

  • There are paid for software that also say not fit for purpose etc., I take on the risk of using it, like Windows lol.
    – user127379
    Feb 6, 2013 at 13:56
  • 2
    @user127379: 1.) yes, this disclaimer is not limited to only free software, that's why I wrote "especially free software". 2.) be careful: "it's not fit for X" is not the same as "I don't guarantee that it's fit for X"! Feb 6, 2013 at 13:57
  • 2
    Windows is evidently so unfit for purpose that every business in the world uses it.
    – Alan B
    Feb 6, 2013 at 14:23

I think the other answers are covering various aspects of your question, but I don't believe they are directly addressing your particulars.

Yes, you may issue a warranty for the software you have created including the software with the various OSS licenses that you mentioned.

You (and your company) will be the sole bearer of the liability generated by that warranty. And that's all a warranty is - it's a liability. You're guaranteeing that you are liable if the product fails to work.

You're not asking to do this, but you may not push that liability back "up-stream" to the other software components / publishers you mention as they have expressly denied accepting that liability coverage.

Whether or not you issue a license along with the software is a related but orthogonal question. License provides terms of use. Warranty guarantees a degree of functionality or operation. I would recommend you license the product to your client in addition to providing the warranty that they require. Having a license helps scope the applicability of the warranty you provide. It also allows you to exclude non-clients from attempting to claim warranty support from you.

What means you use to determine fitness is solely your discretion. It depends upon what amount of risk your organization is willing to accept. It also depends upon the damages you may be exposed to should the product fail and your client makes a warranty claim against you. A UAT is a standard approach and can be a pretty good for identifying fitness. It's a positive verification for the expected functionality. Consensus is a little more iffy since you don't know for certain how others are using those components. Consensus is nice for generating a degree of confidence, but it is nowhere near as rigorous as defined and specific tests that validate the required functionality.

  • 1
    Yep, I've seen a company I worked with do exactly this. I don't know all the details, so I didn't feel comfortable answering the question, but I'm glad you did.
    – Radian
    Feb 11, 2013 at 18:04

I have been working on a medical software project, where we were under the same kind of regulation, we have to both verify and validate the product.

And we could do that and live up to FDA requirements.

I did not take part in the actual validation of 3rd party tools, but as far as I could understand, what we had to do was specify which purpose that 3rd party software would serve us. Then we had to validate those products ourselves, meaning that we validated that the chosen 3rd party software packages did in deed serve that purpose.

As far as I understood, this type of validation did not have to be a lengthy process. Merely some sort of half page document describing the requirements and how that software met those requirements.

This validation would be for both components build into the actual software, but also for development environments, source control systems, etc.

Note: This is based on how I understood what we had to do. I may have misunderstood issues. And the company may have also been more excessive in the validation process than was actually required (I have a feeling this was the case to some degree).

But the software was validated.

But why do you require a validated product? Are you delivering to a regulated segment, e.g. medical or finance. Or is the client ISO 9001 (or similar) certified? If so, you should study the requirements for these kinds of regulations your self to find out exactly what is needed.

  • GCP and possibly CFR Part 11. It's mostly GCP related requirements. It's basically a CRUD, with status changes whether it is complete or not. I'm trying to avoid documenting every little thing. I've documented things like running phpinfo() as a test that the LAMP stack is working and serving pages, output should show mod rewrite and mysql etc listed to pass.
    – user127379
    Feb 7, 2013 at 14:55

The GNU license's disclaimer is there so that, by default, developers are disrobed of any liability arising from running the software.

Even if you feel that programmers should be liable for bad software, the fact is that the software is free.

The disclaimer simply says that what is being distributed is the software only, not any warranty protection.

The GNU model for making money from software is to sell services, or warranty protection.

A warranty is more then just a statement of confidence that the product is fit for a purpose. There has to be some money riding on it. At the very least "money back", or more: an obligation to perform work to bring the product to a condition such that it is fit for the covered purpose, or even to cover some losses and damages.

The presence or absence of a warranty doesn't change what the product is; it just a form of insurance which changes how the risk is distributed between vendor and customer.

This business of providing obligations over free software is actually quite common. Anyone who works commercially with free software will usually patch it if the customer has a problem. If you make some hardware box which runs an embedded Linux distro on it, and it has a problem because of a bug in the kernel, C library or anywhere else, you fix it for the customers. The situation is that your box has the issue, and you promised the customers a box that is reliable, 24/7.


Your reasoning is faulty for several reasons:

  • Nothing in the license gives you the ability to alter its terms. If you accepted the license terms by using the work, you're bound by everything in it. If you no longer like the terms, you're free to stop using the software.

  • There are no provisions in the license for wide adoption of the work changing the terms.

  • Your user acceptance test has no bearing on the agreement you made with the licensor. If you warranted that your selection of the work for inclusion in your product makes it suitable for your customer's purpose, that's between you and your customer. The licensor is an uninvolved third party.

The sentence following the one you highlighted ("You are solely responsible for determining...") puts the ramifications of having used it squarely in your lap.

  • Would the downvoters care to elaborate?
    – Blrfl
    Feb 6, 2013 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.