How can you check if your dependencies comply to their dependencies' licenses?

Question

Like the top answer of this post says, let's say your project uses library M. M uses the MIT license and has dependencies G and A, which use GPLv2 and Apache2 respectively. As a result, M is not legally distributable since it doesn't comply to the licenses of it's dependencies since GPLv2 and Apache2 are not compatible, and so your use of M isn't legal either.

So it sounds to me that if any of your dependencies, or sub-dependencies, or sub-sub-dependencies etc. don't comply to their licenses correctly, you can be at fault.

I know there are tools that look through your dependency tree and can tell you all the licenses it finds so you can ensure you're doing your part, but is there any way to ensure that every dependency you have has done their part and are legally distributed?

Answer 1

No, you cannot get such guarantees because compliance cannot be checked automatically. It's not even possible manually because some facts might only become known in the future. At most, it can be verified e.g. whether a project has processes to ensure compliance, such as requiring contributors to sign a DCO.

However, you can trust someone else to do some level of checking. Is the dependency used directly by high-profile projects? Is the dependency packaged by the Debian project? Are the maintainers known for caring about licenses? Nothing will be entirely safe, but in most settings it would be unreasonable to trawl through the entire commit history of a project.

Checking the licenses of the entire dependency tree is already a very good step, because this also catches cases where a dependency used another dependency with a wrong license. This just can't find more tricky cases, like copying code from another project without complying with the license.