I wish to make a python package I have written publicly available on github as source code. I am being advised that I should add a NOTICE detailing all the third party packages that my code depends on. This notice should include the package names, their copyright notices and their licenses. Note the dependencies here are made almost exclusively through python import statements.

The rationale for this advice appears to be the requirements in clause 4 of the Apache license and the second paragraph of the MIT license regarding distribution. The advisor believes this covers any scenario where I require these third party packages to be present for my software to run. However this seems a very odd use of the word "distribution" to me as I am not bundling their code in source or binary form with my source code. At the most I refer to the third party packages in the import statements, a python setup.py file and a requirements.txt file.

Do the MIT and Apache licenses create this burden on any publicly available code that uses them?

Am I distributing or redistributing these third party packages in a legal sense?

  • Where are you reading this in the Apache license? I just checked section 4, and it refers only to "any Derivative Works that You distribute." Also read the Apache license definition for "Derivative Work" -- the definition makes it explicit what is meant by that. Generally licenses I'm aware of don't make requirements on "dependencies" in particular, except for one part of the GPL dealing with system libraries. – Brandin Nov 23 '20 at 12:42
  • It isn't really where I am reading it, more where my advisor is reading it. As far as I understand him, he thinks I am distributing the dependency by requiring its presence for my software to function. – Epimetheus Nov 24 '20 at 13:17
  • In that case, I think you should just do as you are instructed. It's not really a licensing issue at this point, but it's a matter of you trying to smooth things over with your advisor. Even if he's wrong that it's required by the license, I don't see it as problematic for you to do it anyway. Maybe it's a bit of extra work for you to do, but not too much. – Brandin Nov 27 '20 at 10:46
  • Thanks for your reply. I can see your point, it is no real trouble to create the NOTICES file and it is good to acknowledge the package authors' work. A bigger problem is whether I am distributing these packages in a legal sense as some of them have GPL dependencies. For example numpy depends on libgfortran which is GPL (I know there is an exception but there are other similar examples). My advisor suggests I should remove such dependencies or else I cannot release my package under a permissive license. – Epimetheus Nov 27 '20 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.