How to credit MIT NuGet dependencies in specific C# project?

Question

the question has been asked many times, but as far as I can tell, answers always depend on the concrete situation.

I intend to release an open-source project written in C# on GitLab soon, and I am afraid of unintentionally breaking 3rd party dependency licensing requirements.

The project uses the following NuGet packages:

MaterialDesignThemes & MaterialDesignColors by James Willock licensed under MIT
PDFsharp-MigraDoc by empira Software GmbH licensed under MIT
DocumentFormat.OpenXml by Microsoft licensed under MIT

I have not modified any code of the aforementioned NuGet packages.

Is it correct to assume that I need to include an MIT-license file for each package, or can I simply include one, as all are unmodified copies of the MIT license?

In any case, next to my own LICENSE file, I would include a NOTICE file containing the information about the packages from the formatted paragraph above. As I will also include binary releases every now and again I would also need to include my own LICENSE file, all MIT-licenses as well as the NOTICE file.

Would that be the correct way to comply with the MIT license? Am I missing something? I would love to hear your feedback on my poor deduction skills, I just want to be extra careful not to improperly comply to any of the above licenses.

Thanks in advance!

Answer 1

As long as you just publish your source code that references the MIT-covered libraries, you don't have to do anything: the MIT license only imposes requirements when you copy covered code in whole or in part.

However, if you offer binaries of your software they would include the MIT-covered code. Then, including the notice files as you suggested is a very good approach. Notes:

• Just include a separate copy of the MIT license for every dependency. The license is not overly long, and there are subtle variants between MIT licenses that would be tedious to check. Also, you must keep the copyright notice from each library's license intact. But in principle, deduplicating the license text is OK.

• Using a NOTICE file can be a very good approach, especially if you are using the Apache-2 license which requires downstream users of your software to respect the contents of this file. But in general, it would be more reasonable to include the licenses of any third party software that you include in your license file itself, though clearly separated. This makes it easier to keep track of all applicable licenses.

• Your License and Notice files should be offered together with any binary downloads, e.g. in the same ZIP archive. If your software has some kind of user interface, it can also show the licenses or directions to the full license terms. E.g. the --version output of some programs often contains copyright/license information. Desktop GUIs often have an entry in the help menu, web apps often a link in the footer, and apps often a screen in the settings.

Your general approach to dealing with upstream licenses seems fairly robust, so you don't seem at risk of unintentionally breaking license conditions. Enjoy the open source ecosystem!f