4

Every time I try to read or learn about licensing, it ends in a massive headache for me. Hence, I'm asking here, hoping to finally get some peace of mind about this.

Say I have a little program I'm working on. I put it on GitHub and license it under MIT. That is, I create a LICENSE with the legal text and put it in the project root. Now the coding begins.

  • Working with mp3s is complicated --> com.mpatric.mp3agic (MIT)
  • Java's layout managers are unusable --> com.miglayout.miglayout-swing (BSD 3-clause (or GPL))
  • Swing looks bad --> com.formdev.flatlaf (Apache 2.0)

As stated before, my code is on GitHub and I'd like to relase the program as a pre-built package there.

Now what?

Can I (or a maven plugin) just make a file, say THIRD_PARTY, put the artifacts and their licenses there, add the file on GitHub, package it with the program, and everything is fine?
Or do I have to make sure that I use a license for my program that works (i.e. that is "compatible") with all of my dependencies? If so, what would that license be?

Thank you in advance.

EDIT

To clarify, I only use the project as dependencies, i.e. in my pom.xml there's a part that says

<dependencies>
 <dependency>
   <groupId>com.mpatric</groupId>
   <artifactId>mp3agic</artifactId>
   <version>x.x.x</version>
 </dependency>
 ...
</dependencies>

The question is about what to do now, how to do it might be a seperate question depending on the what. Perhaps the question is better phrased as such:

If my project (licensed under A) depends on libraries/artifacts (licensed under B, C, D etc.),
a) do the dependencies influence the choice for the license of my project
b) is distributing something like a THIRD_PARTY file containing info on which dependency uses what license along the source and binaries all I need to do here?

EDIT 2

Turns out that the maven-notice-plugin seems to be for NOTICES only which doesn't seem like something I want right now.

I then tried both the license-maven-plugin and the attribution-maven-plugin They both, in essence, generate files saying "this project (link) uses this license (link)". This is closer to what I want, but looking at other program's THIRD_PARTY files or equivalent thereof, they include the EXACT text of the project's LICENSE file. For example, the mp3agic section would read

Copyright (c) 2006-2013 Michael Patricios http://github.com/mpatric/mp3agic

and not

Copyright (c) <year> <copyright holders>,

which would be my understanding of the phrase "this permission notice shall be included". Seems like I have to download the licenses myself and put them in a directory. A minute of work for each dependency, but that's fine.

7
  • Am I right assuming that you are using the 3rd party code as dependencies to your project? Or are you actually copying from their source into your source? The examples you have mentioned are all licensed under permissive licenses (miglayout-swing is dual-licensed), so use as a dependency should be easy. Nov 4, 2021 at 8:34
  • You should follow the rules for those licenses. Those are quite permissive licenses letting you do basically whatever; as long as you provide attribution; and I think Apache 2.0 also has a rule about patents (irrelevant if you don't have any patents).
    – user253751
    Nov 4, 2021 at 10:39
  • @user253751 I believe the question is more about HOW to do it and not what to do. Is the above mentioned Maven plugin enough? How to get a list of all the dependencies and transitive dependencies with all the copyright attribution, license language etc,... (is that even required?) Which tools would be best to use? Nov 4, 2021 at 11:12
  • Edited to clarify. @Martin_in_AUT your first assumption is right, I'm not copying any code. Second assumpion is false. I can ask about the HOW again later if needed, but I'd like to know about WHAT to do first. Nov 4, 2021 at 12:16
  • I found a similar question, but I'm not sure how to apply the answer to this problem, if it can be applied Nov 4, 2021 at 12:41

1 Answer 1

3

You need to differentiate 2 cases: a) you have your code on GitHub, and b) you distribute your code (e.g. executable) including the dependencies, e.g. as pre-built packages.

In case a) you it is sufficient to list the dependencies properly. You need to declare your own license and copyright notice. I recommend (not required) to have SPDX identifiers in each of your files.

In case b) where you are also distributing 3rd party code, you need to include a license.txt file. It is common to have your own license statement at the top and below that you include the required information from the dependencies. An example can be found here. The language in the licenses of your dependencies tells you what to include. You can also split the license file, separating your own and the 3rd party licenses, but I don't recommend that. Having it in one file is easier for the recipients.

If your dependencies have their own direct or transitive dependencies, then you need to also include the information for those. For the dual-licensed code of dependencies please be clear w.r.t. which one license you are selecting out of the available options.

For big projects I have seen license.txt files with several 10s of thousands of lines. To create these you need tools. For your small project with 3 dependencies it likely is most efficient to compile it manually.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.