Find a library license markdown_to_asciidoc?

Question

Hi in my enterprise project I use as a transitive dependency io.github.swagger2markup:markup-document-builder:1.1.2 which is with Apache-2.0 License.

But the problem is one of its transitive dependencies

nl.jworks.markdown_to_asciidoc:markdown_to_asciidoc:1.1

is with unknown license.

What does it mean? Can I use it in an enterprise project? Is it with Apache 2.0 or this is its category (Markdown) and the license is unknown? And how to find the real license of that library? I was not able to find any github repo.

In the code markdown to ascii functionality is not used so I can just remove it from the classpath.

https://mvnrepository.com/artifact/io.github.swagger2markup/markup-document-builder/1.1.2

Answer 1

[…] the problem is one of its transitive dependencies

nl.jworks.markdown_to_asciidoc:markdown_to_asciidoc:1.1

is with unknown license.

What does it mean?

It means that the license is not known.

Can I use it in an enterprise project?

You can use it as long as you have a license that allows you to do, and you comply with the terms of the license. Since you don't know what the license is, I doubt that is the case.

Note that this has nothing to do with whether or not the project is an "enterprise" project.

Is it with Apache 2.0 or this is its category (Markdown) and the license is unknown?

I don't understand. First you say the license is unknown, then you ask whether the license is unknown? Yes, the license is unknown, that is the whole premise of your question in the first place!

And how to find the real license of that library?

Ask the copyright holder.

I was not able to find any github repo.

There is no requirement for a copyright holder to publish a GitHub repository.

However, you can do some detective work. On the Java platform, package names are built using a convention where you take the reverse DNS name of a domain that is under your control. So, it stands to reason that jworks.nl must be a domain which is under the control of the author (although not necessarily the copyright holder) of the package in question.

According to WHOIS data, that domain is currently still registered. However, the registry data is not very useful because the domain was obtained through a domain reseller and thus the contact information is that of the reseller.

However, there is actually a webserver running and serving a site at http://jworks.nl/. On that site, you can find a Contact form where you can find the company running the site.

Unfortunately, if you take a closer look at the site, you will notice that it seems the company went out of business in 2015. The Google Maps plugin on the contact form is broken, and there are no news and blog articles after 2015.

However, one of the last blog articles on the blog is an article introducing the very library you ask about: Converting Markdown to AsciiDoc and it contains a link to the GitHub repository: https://github.com/bodiam/markdown-to-asciidoc

And this repository contains a LICENCE file stating that the code is under the Apache License 2.0. [This is also a possible explanation why the license is unknown: the automated license scanner couldn't find the file because it expects the American English spelling.]

But we are still not done! The license file did not exist in the repository from the beginning, it was added in a later commit. So, we have to check whether the version of the code you are using was covered by that license. The version you are using is from December 4th, 2017, whereas the license file was added on May 19th, 2016 and was never changed since then. So, it is reasonable to assume that version 1.1 is covered by this license.

You cannot be sure, though, because there is no guarantee that the binary artifact you are using was, in fact, built from this code. The only way to be sure is to ask the copyright holder.

Answer 2

The mvnrepository.com search engine is not a canonical source of information, and in this case also contains dead links. The source code repository clearly indicates that this software is licensed under Apache-2.0, but issue #26 mentions that it's not currently published to Maven. Someone on that issue re-published an old version of the package as ca.szc.thirdparty.nl.jworks.markdown_to_asciidoc:markdown_to_asciidoc:1.0 instead, which also provides correct metadata.

The Apache license if of course free to use for commercial purposes, as long as you provide a copy of the license whenever you distribute this software to a third party. JAR files typically include licensing information as well when you open them as a ZIP file – if you already had a copy of the library you could have accessed its metadata directly.

If you had not found any licensing information, then you would not have any rights to redistribute the software. See also: What can I assume if a publicly published project has no license?.

As a general remark, it might not be wise to add any dependencies that were last updated in 2017. Some software is completely done at some point and will have no further reason for change. But this is fairly rare – especially markup formats are often a moving target, and might even have security issues in case of improper escaping.