Licenses don't typically allow licensees to re-license code. You can use Apache v2 code in a proprietary or AGPL product and redistribute binaries or other source code derived from it under any other license, but you can't change the license of the original code: anyone can still use it under the Apache license.
Conversely, a copyright holder may re-license code. Depending on the exact terms of the old license, this may mean that you are no longer allowed to use it under the old license (at least, not unless you got it from someone who legally obtained it back when it had the old license).
So, if the code is not relicensed, you can theoretically download a bundle that claims it's AGPLv3, select the portions that are licensed under Apache, and incorporate those into your proprietary product without providing any access to your sources, and be legally in the clear.
> Licenses don't typically allow licensees to re-license code.
This still doesn't make any sense. Permissive licenses are designed to allow code to be relicensed freely, hence the term "permissive." There may be a few catches, like having to include attribution or a copy of the old license, but if those were significant, the code wouldn't be open source.
How could that interpretation be compatible with the fact that if the author and copyright holder relicenses the code, you can ignore them if "you got it from someone who legally obtained it back when it had the old license." LGPL projects are "someone."
> So, if the code is not relicensed, you can theoretically download a bundle that claims it's AGPLv3, select the portions that are licensed under Apache, and incorporate those into your proprietary product without providing any access to your sources, and be legally in the clear.
Very theoretically. It's very unlikely that the Apache code will sit in the AGPL project forever unmixed with new, AGPL'd, code. Since the new code is not under a permissive license, it can't be relicensed to Apache.
Think about it like this. If I redistribute a BSD licensed piece of code released by the OpenBSD project, I have to include a note saying that "this product includes code from the OpenBSD project". If I allow others to redistribute my code, I still have to require those others to include this notice. I can't take the OpenBSD project's code and redistribute it under a license that says "you don't have to give any attribution".
However, as the copyright holder, the OpenBSD project can decide to relicense their code under a new license that says "no attribution is required". They can even do so selectively: they can sell you code under this license, but keep distributing the one with attribution required to others. The provenance of a copy of code becomes important in these cases, since different copies may have different license terms attached.
The MySQL project was doing exactly this before the Oracle acquisition, this is not a theoretical idea. You could get the code for free under the terms of the GPLv2 (or 3?), or you could buy a commercial license from them that allowed you to redistribute the binary with any modifications without sharing source code.
2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
Is sublicensing something different from relicensing?
Conversely, a copyright holder may re-license code. Depending on the exact terms of the old license, this may mean that you are no longer allowed to use it under the old license (at least, not unless you got it from someone who legally obtained it back when it had the old license).
So, if the code is not relicensed, you can theoretically download a bundle that claims it's AGPLv3, select the portions that are licensed under Apache, and incorporate those into your proprietary product without providing any access to your sources, and be legally in the clear.