I'm currently working on a new MIT licensed project (with Creative Commons License for documentation).
The project uses a combination of Java and Kotlin and is built with Gradle.
All files have ben annotated with tags such as:
SPDX-FileCopyrightText: 2022 Anthony Accioly SPDX-License-Identifier: CC-BY-SA-4.0
SPDX-FileCopyrightText: 2022 Anthony Accioly SPDX-License-Identifier: MIT
I've used FSF reuse tool to download the proper licenses to a
LICENSES folder and verify compliance.
My project has a lot of direct and indirect Gradle dependencies under several different "permissive" Open Source Licenses (none of the dependencies is licensed under GPL).
I'll be distributing the source code on GitHub, and I also intend to use GitHub actions to assemble fat jars and publish binary releases (which will include binaries of most dependencies).
From Handling licenses of dependencies I assume that I don't need to do anything else with the source code, as I'm not copying or modifying any of the underlying libraries.
But the final jar will actually bundle dependencies, i.e., I believe that I'm ultimately "distributing" dependencies with my build.
My question is: Do I need to do anything else in order to comply with license and usage terms of dependencies? And if so, can I automate it somehow? For instance, would something like a SPDX Document with license information and copyright notices for each "package" be sufficient?