Disclaimer: I'm not entirely sure if this is the correct stack-exchange for this matter.
We're a small to medium company in the EU (about 70 employees). We develop and sell equipment and accompanying software for a very niche market segment. We also try to be very "agile" about it, as in "phone rings, customers ask for xyz, we make xyz happen asap", regardless of whether its a one off hack.
This high velocity neglects proper open source licensing handling. For context, out of these 70 employees, only two are software engineers. So this particular topic is not on the very top of the management's priority list.
Here is the rough situation:
Customers receive a device and some software sold together as one product. The software is running on-premise.
a web app running Django and the usual assortment of CSS/JS libraries
The web app is supplied open-sourced, but that is not stated anywhere and is also not by design, rather out of convenience. The only open source related thing it does, it has an about page which states and links to the core components being used, i.e. Django, Python, Lodash and the likes. It is certainly missing to disclose some of these, especially if you'd consider transitive dependencies.
a WPF (.net/c#) desktop app
This one is closed source. It states the full license text and links to the homepage of two major components within the app itself in an about page/section. But again, probably not all used (nuget) packages. For example, it does not state the usage of log4net.
within the device, touch panels running Raspbian and a QML (Qt5) interface
This is, I guess, the tricky part. It is supplied as open source, but again, not stated anywhere. But you could just take a screwdriver and grab the SD-card from one of the raspberries inside. The whole usage of Raspbian is not stated anywhere, neither is the usage of Qt5 (LGPL in this case) and various python libraries (most notably PySide2 and Raspbian itself which is afaik GPL)
What I would like to do now (rather late than never) is basically do our due diligence in terms of fulfilling the licence requirements. I recently had a lengthy talk with a software compliance expert which essentially boiled down to "if someone really wants to mess with you", there is the
potential danger of an prohibition of sale via temporary injunction. Which could be devastating to a smaller company.
While I am aware of the basics of how I would comply with i.e. a MIT or LGPL licensed part, what's a good approach for this particular scenario, where these parts, all the software and the device itself form one product. I am assuming this is not an uncommon scenario, so there are probably some established ways or best practices' around?
Possible solutions I could think of:
- state all the parts and licenses somewhere centrally, i.e. on our homepage or a dedicated product page?
- similar idea, state all the licenses in a (pdf) manual?
- bite the bullet and list all parts and licenses where they are used? Especially on the touch screen we (as in our sales and markets folks) would very much like to avoid having some 'About' button cluttering the constrained interface space
So tl;dr, the question is how to comply with all the (licenses of) used 3rd party open source components in a manageable way, i.e. not putting hundreds of man-hours on it nor involving an expensive external advisor. That is, not how do I comply with license xyz (i can look that up, although tedious), but where would I ideally supply all that information, links, potential source code.
To make matters worse, searching this stack-exchange also indicates I would have to include every transitive dependency as well. Although it's good enough, if I understood correctly, if one of the first-order dependencies that I link to in turn links to its dependencies.
