2

I'm currently working on a new MIT licensed project (with Creative Commons License for documentation).

The project uses a combination of Java and Kotlin and is built with Gradle.

All files have ben annotated with tags such as:

SPDX-FileCopyrightText: 2022 Anthony Accioly
SPDX-License-Identifier: CC-BY-SA-4.0

Or

SPDX-FileCopyrightText: 2022 Anthony Accioly
SPDX-License-Identifier: MIT

I've used FSF reuse tool to download the proper licenses to a LICENSES folder and verify compliance.

My project has a lot of direct and indirect Gradle dependencies under several different "permissive" Open Source Licenses (none of the dependencies is licensed under GPL).

I'll be distributing the source code on GitHub, and I also intend to use GitHub actions to assemble fat jars and publish binary releases (which will include binaries of most dependencies).

From Handling licenses of dependencies I assume that I don't need to do anything else with the source code, as I'm not copying or modifying any of the underlying libraries.

But the final jar will actually bundle dependencies, i.e., I believe that I'm ultimately "distributing" dependencies with my build.

My question is: Do I need to do anything else in order to comply with license and usage terms of dependencies? And if so, can I automate it somehow? For instance, would something like a SPDX Document with license information and copyright notices for each "package" be sufficient?

Improve this question

1 Answer 1

Reset to default
3

When you distribute binaries, or a JAR with all the dependencies, you will need to do more. You will need to compile a file "3rd_party_licenses.txt" which lists all the direct and transitive dependencies, and which also includes the respective license name, the copyright attribution (sometimes called 'notices'), and for some licenses also the entire license language.

I have compiled files like this with more than 100,000 lines of text (for a big project). You can see examples of files like this when you type "about:license" in Firefox or "chrome://credits/" in Google Chrome.

Improve this answer
5
  • 1
    This is what I was afraid of (think hundreds of dependencies). Any recommended tools to curate and generate a 3rd_party_licenses.txt or equivalent from the project dependencies or a SPDX SBOM?
    – Anthony Accioly
    Jun 16, 2022 at 10:15
  • 1
    We use expensive commercial tools, and this is not the place to promote these. But you might want to look at FOSSology or more generally at the OpenChain Project and their GitHub repository, which I can whole-heartedly recommend.
    – Martin_in_AUT
    Jun 17, 2022 at 6:58
  • @Martin_in_AUT you should also add github.com/nexB/scancode-toolkit to your list ;)
    – Philippe Ombredanne
    Jan 11 at 13:18
  • @PhilippeOmbredanne I have a long list of tools, but I am trying to avoid promotion for specific commercial products, or when an open-source tool has a commercial sibling or cousin.
    – Martin_in_AUT
    Jan 11 at 15:15
  • @Martin_in_AUT fair enough. And that's not the case for ScanCode which is FOSS and considered as the leading tool in the space. Or if you like Kotlin like the OP, use ORT that also builds on ScanCode. Most expensive tools in the space are mostly just: expensive :) Anthony: note that one difficulty with Java is that JARs and their POMs often lack proper self-attribution, e.g., they do not even contain a proper credit and license for themselves. So it requires a bit more work.
    – Philippe Ombredanne
    Jan 26 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.