For instance, the BSD-3 Clause license states:

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

1.) Imagining that I have 10 different libraries with this license in use, which all have different Copyright headers (due to different copyright holders), how do I treat this case? Do I reproduce the full license 10 times, or is it sufficient to have it once generically and mention the copyrights separately?

2.) If I supply an sbom where there is a link to the license text (let's say in a GitHub repo, a tagged version corresponding to the version of the library which I use, or from a Maven artifact or so...), would this already comply to the BSD-3 and MIT clauses?


1 Answer 1


It is sufficent to have one copy of the license language of each license in the licenses.txt , there is no value in reproducing the same language 10 or more times. The BSD licenses are still short, but imagine you would need to reproduce the Apache 2 or GPLv3 language 100 times.

You need to, however, mention the correct license with each library's information, but "BSD-3" or an SPDX identifier would be sufficient, if you then later have "BSD-3" as the headline of the actual license language in the appendix of the file.

Some licenses demand that the 'notice.txt' file needs to be included, and some developers copy the license language into the notice.txt file (happens often in Apache 2 licensed projects). But in this case you can remove the license language from the notice.txt and deliver the license language in the licenses.txt. It just has to be included at least once.

It also needs to be noted that a link (URL or the like) to the license language is not sufficient for many licenses. The Apache 2 license for example states "You must give any other recipients of the Work or Derivative Works a copy of this License".

The SBOM has a different purpose and I recommend to keep the license language away from the SBOM in a separate file. SBOM files are (best case) for documentation, archiving, information flow along the supply chain (e.g. if you are a subcontractor delivering parts of the software) and for compliance information. The full text of all the licenses would just mess up this file.

  • The Apache license says more precisely in 4b that you must "include a readable copy of the attribution notices contained within such NOTICE file" and then gives different options of how you must do that (in a NOTICE text file, in a program-generated display, etc.). If someone accidentally included the whole Apache license text itself in the notice.txt file, then I think that's not part of the "attribution notices" that were intended, so of course in that unusual case, we can safely move the copy of the license embedded in the notice.txt file into a more appropriate place.
    – Brandin
    Commented Jan 26, 2023 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.