8

I wish to make a python package I have written publicly available on GitHub as source code. I am being advised that I should add a NOTICE detailing all the third-party packages that my code depends on. This notice should include the package names, their copyright notices, and their licenses. Note the dependencies here are made almost exclusively through python import statements.

The rationale for this advice appears to be the requirements in clause 4 of the Apache license and the second paragraph of the MIT license regarding distribution. The advisor believes this covers any scenario where I require these third-party packages to be present for my software to run. However, this seems a very odd use of the word "distribution" to me as I am not bundling their code in source or binary form with my source code. At the most, I refer to the third-party packages in the import statements, a python setup.py file, and a requirements.txt file.

Do the MIT and Apache licenses create this burden on any publicly available code that uses them?

Am I distributing or redistributing these third-party packages in a legal sense?

Improve this question
4
  • 1
    Where are you reading this in the Apache license? I just checked section 4, and it refers only to "any Derivative Works that You distribute." Also read the Apache license definition for "Derivative Work" -- the definition makes it explicit what is meant by that. Generally licenses I'm aware of don't make requirements on "dependencies" in particular, except for one part of the GPL dealing with system libraries.
    – Brandin
    Nov 23, 2020 at 12:42
  • It isn't really where I am reading it, more where my advisor is reading it. As far as I understand him, he thinks I am distributing the dependency by requiring its presence for my software to function.
    – Epimetheus
    Nov 24, 2020 at 13:17
  • In that case, I think you should just do as you are instructed. It's not really a licensing issue at this point, but it's a matter of you trying to smooth things over with your advisor. Even if he's wrong that it's required by the license, I don't see it as problematic for you to do it anyway. Maybe it's a bit of extra work for you to do, but not too much.
    – Brandin
    Nov 27, 2020 at 10:46
  • Thanks for your reply. I can see your point, it is no real trouble to create the NOTICES file and it is good to acknowledge the package authors' work. A bigger problem is whether I am distributing these packages in a legal sense as some of them have GPL dependencies. For example numpy depends on libgfortran which is GPL (I know there is an exception but there are other similar examples). My advisor suggests I should remove such dependencies or else I cannot release my package under a permissive license.
    – Epimetheus
    Nov 27, 2020 at 11:41

1 Answer 1

Reset to default
5

Fair disclosure: I'm not a lawyer.

If you're just requiring other (open source) libraries, you aren't redistributing them, you're merely stating what other libraries are required to run your project. The end user can install them from pip, from some other source or even re-implement them themselves (not that any reasonable user would do that, but it's a possibility).

Since you aren't redistributing the dependencies and aren't creating a derivative work you probably don't strictly need a "notices" files, although there doesn't seem to be any harm in doing so.

When in doubt, I tend to err to the side of caution, but that's just me.

EDIT:
As Daniel Widdis commented, providing this information, while not strictly required, can be very useful for your users. Your package may depend on packages with different licenses which may mean the end users need to adhere to different terms or restrictions than the ones obvious from your license file.

Improve this answer
2
  • 2
    While this is technically correct I think your answer could be improved by noting how dependent library licenses may impact usage of the OP's project. I could write an MIT-licensed project but have a GPL licensed dependency. While I haven't violated any licenses, downstream users of my "MIT" code might be surprised to find out they can't actually use it. So it's not just erring on the side of caution, it's helping downstream users avoid license issues in the future!
    – Daniel Widdis
    Dec 31, 2022 at 21:56
  • 1
    @DanielWiddis good point, thanks! I've added a paragraph about this perspective to the answer (and attributed it to you, of course).
    – Mureinik
    Jan 1 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.