2

I'm currently working on a new MIT licensed project (with Creative Commons License for documentation).

The project uses a combination of Java and Kotlin and is built with Gradle.

All files have ben annotated with tags such as:

SPDX-FileCopyrightText: 2022 Anthony Accioly
SPDX-License-Identifier: CC-BY-SA-4.0

Or

SPDX-FileCopyrightText: 2022 Anthony Accioly
SPDX-License-Identifier: MIT

I've used FSF reuse tool to download the proper licenses to a LICENSES folder and verify compliance.

My project has a lot of direct and indirect Gradle dependencies under several different "permissive" Open Source Licenses (none of the dependencies is licensed under GPL).

I'll be distributing the source code on GitHub, and I also intend to use GitHub actions to assemble fat jars and publish binary releases (which will include binaries of most dependencies).

From Handling licenses of dependencies I assume that I don't need to do anything else with the source code, as I'm not copying or modifying any of the underlying libraries.

But the final jar will actually bundle dependencies, i.e., I believe that I'm ultimately "distributing" dependencies with my build.

My question is: Do I need to do anything else in order to comply with license and usage terms of dependencies? And if so, can I automate it somehow? For instance, would something like a SPDX Document with license information and copyright notices for each "package" be sufficient?

1 Answer 1

3

When you distribute binaries, or a JAR with all the dependencies, you will need to do more. You will need to compile a file "3rd_party_licenses.txt" which lists all the direct and transitive dependencies, and which also includes the respective license name, the copyright attribution (sometimes called 'notices'), and for some licenses also the entire license language.

I have compiled files like this with more than 100,000 lines of text (for a big project). You can see examples of files like this when you type "about:license" in Firefox or "chrome://credits/" in Google Chrome.

2
  • 1
    This is what I was afraid of (think hundreds of dependencies). Any recommended tools to curate and generate a 3rd_party_licenses.txt or equivalent from the project dependencies or a SPDX SBOM? Jun 16 at 10:15
  • 1
    We use expensive commercial tools, and this is not the place to promote these. But you might want to look at FOSSology or more generally at the OpenChain Project and their GitHub repository, which I can whole-heartedly recommend. Jun 17 at 6:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.