-1

For permissive open source licenses, for example Apache 2.0, is it sufficient to include a readable copy of the license.txt/NOTICE/attribution file with the object code in the memory of the device? Or, is the requirement to provide a copy of the license/NOTICE/attribution in a place where a typical end user would see it? For example, a manual for the device.

So many examples I find are about forward facing software that has a UI. What about devices that don't have a user interface (or have a minimal UI).

If something has to be provided in the manual. Exactly what has to be provided? A full copy of the license? If there are 50 open source components, do I really need to provide the full text of 50 open source licenses? Would it be sufficient to provide a links to the licenses on the Internet?

4
  • "for example Apache 2.0" - To answer this question you need to consider the specific license. Some licenses give specific requirements for this. Apache license says exactly what you need to do in section 4.d. But you can't say in general what you need to do.
    – Brandin
    Nov 22, 2018 at 7:50
  • 2
    "Would it be sufficient to provide a links to the licenses on the Internet?" - It depends on the license again. But most licenses don't dictate so specifically how you deliver it, as long as you do so. A possible problem with an Internet link is that it may go down at some point or it may change addresses in the future. If that happens, then you are suddenly not in compliance with the license anymore for all the products you've already shipped. If you had just included the license text in the documentation, then you will probably not have that problem.
    – Brandin
    Nov 22, 2018 at 7:52
  • What do you mean by a minimal UI? If your product has a minimal UI, that is still a UI. So if one of the licenses requires that you place a notice in the UI, then you need to do that to comply.
    – Brandin
    Nov 22, 2018 at 7:55
  • @Brandin: a minimal UI would for example be an LCD display that doesn't have the capability to show full text and shows maybe 3 or 4 characters/digits at a time (using 7 LCD segments per character). Nov 22, 2018 at 17:42

1 Answer 1

2

The intention of distributing the (open-source) license with a product is to inform the users of the product about the rights they have with regard to the software. This intention would not be served if the license text can only be read when someone tries to reverse-engineer the software.

With that in mind, you must distribute the licenses in such a way that the end-user can take notice of them. If the device has a good enough display to comfortably read multiple paragraphs of text, then you can show the licenses from a menu within the device. If there is no suitable display, then the manual or a leaflet in the box is your only option.

If you are using 50 open-source components, then you don't have to replicate each of the licenses separately. If multiple components use the same license, you can do something like

Components A, B and C are licensed under the MIT license.
[ License text ]

Components X, Y and Z are licensed under the Apache 2.0 license.
[ License text ]

As the number of licenses in use are not really that large, it is likely that you only have to produce 3 or 4 license texts.

3
  • So this raises another question: Are there licenses that demand disclosing the open source components your software uses?
    – Andy
    Jun 21, 2022 at 13:27
  • I just checked Firefox‘ GUI, and they do not disclose the components, but simply all relevant licenses.
    – Andy
    Jun 21, 2022 at 13:35
  • 1
    @Andy, there are no licenses (to my knowledge) that require disclosing which third-party components you use. There are open-source licenses that require that copyright notices or attribution notices are reproduced in the documentation or UI. Those notices can disclose which component they are coming from. Beyond that, mentioning the used components is a gesture of goodwill. Jun 21, 2022 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.