Apache 2.0: What licensing-related steps do I have to make when using software via package manager?

Question

I'm trying to develop an application which uses a 3rd party framework under Apache 2.0 License. Obviously, I would like to comply with the license and give attribution to the authors via LICENSE/NOTICE files, but im not sure how to do it (edit: and whether it's required at all).

Apache 2.0 License states that a copy of it must be provided every time the work (be it source code or binaries) is distributed. I guess it applies when my dependencies are handled by the package manager (NuGet in this case, it's a .NET Core app), but there's no logical place to put the LICENSE file, since there's no actual project in my directory tree. And since there's no logical place to put it, I wanted to ask how it's usually done in similar cases? Do I just throw a bunch of LICENSE files (one per external library) into my directory tree and that's it?

Note: I've read that NOTICE file is a place where I could state which 3rd party libraries are used in the project, but from what I understand it's not mandatory, that's why I focused my question on the license text (i.e. LICENSE file) specifically.

Edit: After giving it some more thought, I came to the conclusion that listing a package in the package manager's listing file is not equivalent to shipping it with the project. That makes it even less clear for me in terms of including the license text / not including anything at all.

Answer 1

If you're shipping the dependencies, then you must fulfil their license terms, such as including the license notices with your software. How to do this properly depends on the context of your software. E.g. the license notices might be included in documentation files like Python does, or a software with a GUI might show them in an info panel like most web browsers do. In case you are using the Apache-2.0 license yourself, the NOTICE file is the logical place for third party notices.

As a rule of thumb, you should reference third party component licenses wherever you assert your own copyright (because you are not the sole copyright holder for the resulting software).

If you are merely declaring dependencies in a configuration file but are not actually distributing the dependencies (e.g. if you are merely distributing source code), then I don't think that their licenses would be relevant.

The tricky case in between is what happens in the case of dynamic linking, where the dependencies are distributed by the package manager according to your configuration and are only combined with your software at runtime. This can be argued either way, but the safest option is to assume that the mechanism of distribution (using a package manger) is less relevant than the outcome (causing dependencies to be distributed and loaded for your program).