I've developed a python project that depends on several open-source packages (e.g., numpy, and pandas). I want to distribute the project to end-users while ensuring the installation process is easy and does not affect the user's standard environment.

The overall idea is as follows: The users will install the conda environment management system by themselves (if they don't already have it, as many indeed might). Afterward, they would run my installation script, which creates and initializes the environment (by installing the required packages) and then installs my project inside that environment (normally using pip).

Now my questions are:

[1] Will using such an installation script mean that I'm distributing the prerequisites?

As a result, would I need to include all the licensing, copyright, and notice information from all direct and indirect dependencies (according to their licenses) at an appropriate place in my project?

Note that it's completely fine by me in principle, but it becomes quite involved in practice. Nevertheless, I would like to ensure everything is according to the law, but I also do not want to do something unnecessary.

[2] Would it be different if the users were given the installation instructions in the documentation and would therefore prepare the environment by themselves and install my package by themselves?

I understand that if I bundled all the software together, then I would certainly be distributing it. However, I'm not sure whether using such an installation script would be considered as bundling the software together.

Thank you!

  • 1
    When the scripts finish installing the third-party packages, are the license requirements met at that point (e.g. required notices are installed too)?
    – Brandin
    Dec 9, 2022 at 15:03
  • 1
    The 3rd-party packages are partially installed using conda and partially by pip. Now, taking a look at the files in the corresponding subdirectories under "~/anaconda2/envs/<env>/..." it seems that all the relevant information is there (e.g., there are LICENSE files, NOTICE files).
    – relation
    Dec 9, 2022 at 15:22
  • @relation could I trouble you either to accept the posted answer by clicking on the "tick" outline next to it, or indicate in a comment below it that you have not had your question fully answered, and what remains in need of answer? Many thanks!
    – MadHatter
    Dec 20, 2022 at 11:31

1 Answer 1


You are fine going forward with the script. The script -executed by a user "U"- contains instructions to download and install certain software "SW" from a server "S" (which is not under your control) on a user device "UD" under the control of U.

The person/organisation providing the code on server S is responsible for compliance with all the license requirements related to distribution of the SW, for example providing 'copyright', 'license' and 'notice' files as well as source code.

You are neither distributing the SW nor receiving it nor running the script, so you are out of the game. You are just providing a description in form of a script how to prepare the UD (=install the dependencies) in order to be able to run your python project. And there is no difference between providing the script and providing the same information in a document.

(Even though there is no legal requirement on you) to ensure that the users are able to execute all their rights under OSS licenses, it is good practice to create the script in a way, which will download the entire package with all files (i.e. 'copyright', 'license' and 'notice' files as well as source code where required), and not just the few files that are needed to run your code.

  • Suppose server S is github.com. I don't think github is responsible for the compliance of the repositories they host. The person making the repository available is the responsible party. For the rest, I agree with your answer. Dec 16, 2022 at 10:31
  • @BartvanIngenSchenau Thx for your note. I updated the wording to be more specific. Dec 16, 2022 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.