BSD-3/MIT etc. - How "often" do I need to include the license text?

Question

For instance, the BSD-3 Clause license states:

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

1.) Imagining that I have 10 different libraries with this license in use, which all have different Copyright headers (due to different copyright holders), how do I treat this case? Do I reproduce the full license 10 times, or is it sufficient to have it once generically and mention the copyrights separately?

2.) If I supply an sbom where there is a link to the license text (let's say in a GitHub repo, a tagged version corresponding to the version of the library which I use, or from a Maven artifact or so...), would this already comply to the BSD-3 and MIT clauses?

Thanks

Answer 1

It is sufficent to have one copy of the license language of each license in the licenses.txt , there is no value in reproducing the same language 10 or more times. The BSD licenses are still short, but imagine you would need to reproduce the Apache 2 or GPLv3 language 100 times.

You need to, however, mention the correct license with each library's information, but "BSD-3" or an SPDX identifier would be sufficient, if you then later have "BSD-3" as the headline of the actual license language in the appendix of the file.

Some licenses demand that the 'notice.txt' file needs to be included, and some developers copy the license language into the notice.txt file (happens often in Apache 2 licensed projects). But in this case you can remove the license language from the notice.txt and deliver the license language in the licenses.txt. It just has to be included at least once.

It also needs to be noted that a link (URL or the like) to the license language is not sufficient for many licenses. The Apache 2 license for example states "You must give any other recipients of the Work or Derivative Works a copy of this License".

The SBOM has a different purpose and I recommend to keep the license language away from the SBOM in a separate file. SBOM files are (best case) for documentation, archiving, information flow along the supply chain (e.g. if you are a subcontractor delivering parts of the software) and for compliance information. The full text of all the licenses would just mess up this file.