2

Consider an executable program whose source is licensed under the MIT and/or Apache 2.0 license and that depends (directly & indirectly) on a number of libraries written by third parties that are each licensed under MIT and/or Apache 2.0. (By "licensed under MIT and/or Apache 2.0", I mean being licensed under terms that, when expressed as an SPDX license identifier, equal "MIT", "Apache-2.0", "MIT OR Apache-2.0", or "MIT AND Apache-2.0".) This program is compiled into a single statically-linked binary containing compiled copies of each dependency (i.e., dynamic linking is not involved, except possibly for core language or OS libraries) and distributed to end-users.

The main question is this: Must the distributor of the binary provide the license and copyright information for each individual dependency alongside the binary? Specifically, assuming the source code for each dependency includes one or more license and/or notice files containing the text of the dependency's license(s) plus copyright information, is it necessary to include each & every one of these license/notice files alongside the binary — either as separate files (possibly organized in a directory tree) or in a single structured file? Are there other ways to satisfy the licenses' attribution requirements?

Improve this question
7
  • 1
    I am asking this because I believe I have discovered a number of dependency license violations in some major package ecosystems. Depending on the answers to this question, I may post a follow-up asking whether a specific package in a specific ecosystem violates licensing terms.
    – jwodder
    Sep 16 at 21:24
  • 2
    Does this answer your question? Do I need to respect licences of dependencies of dependencies?
    – Martin_in_AUT
    Sep 17 at 8:40
  • 1
    @Martin_in_AUT: That establishes that license terms of indirect dependencies need to be honored, but there the similarities end. While the answer there states that "most licenses" let you simply link to the dependencies' source code, it does not state which licenses those are or how to identify them, and the situation asked about in the question is for an interpreted language where dependencies are linked at runtime — quite unlike this question's situation of a statically-linked compiled language.
    – jwodder
    Sep 17 at 12:27
  • Does the Apache code which was included include a "NOTICE" text file in the source distribution of the Apache code? The presence of this file adds some specific requirements of how you're supposed to deliver that information. I don't think the "NOTICE" text file part is usually expressed as part of an SPDX identifier, so for this you'll probably have to go investigate how that component is actually licensed in the source code.
    – Brandin
    Sep 20 at 7:56
  • See also: opensource.stackexchange.com/questions/7920/…
    – Brandin
    Sep 20 at 7:57

1 Answer 1

Reset to default
2

Check what the exact licenses involved say. If for binary distribution it says it has to be accompanied by text stating the copyright, and/or where to get source, shipping the binary containing the library is certainly binary distribution. Most open source licenses give details of what you need to do.

But note that only whoever holds the rights has standing to do something about it, e.g. sueing the offender.

In any case, if the licenses are Apache, MIT, BSD or similar, this is most probably just an oversight or sloppyness. The courteous way forward is to send a note to the offender (copy the affected parties) stating the precise transgressions and suggest how to remedy them. Probably just adding a file stating the pieces, their versions and licence details is enough.

Improve this answer
4
  • 1
    Your second paragraph is by no means equally true everywhere. See, eg, the section on third-party rights in this talk (full disclosure: I wrote the article, but I didn't give the talk).
    – MadHatter ♦
    Sep 19 at 14:04
  • "Check what the exact licenses involved say." — I would expect a decent answer to do this itself and report the conclusions. For the MIT license in particular, does a library compiled into a binary count as a "copy or substantial portion of the Software", and does the requirement that the license be "in" the copy/portion mean, say, that the license must be embedded in the binary file itself? The license doesn't directly address this.
    – jwodder
    Sep 19 at 14:41
  • 2
    @jwodder You're right that the license (MIT) doesn't directly say 'how' it is to be included in a binary-only distribution, so basically you've got some leeway in interpreting it. One interpretation is to include it in the binary code itself, but personally I think that's an overly literal interpretation. I believe the intention is that the end-user can somehow find the required text (either in print or electronic form) if she looks for it; she shouldn't have to resort to reverse-engineering tools, the Unix 'strings' command, binary editors, etc. to find the text.
    – Brandin
    Sep 20 at 7:51
  • @MadHatter: Third-party rights are probably irrelevant to the MIT and Apache licenses, because third parties derive little or no benefit from proper attribution. At least in the US, they would lack standing to sue, regardless of whether the rights technically exist, because the US won't let you in the courtroom unless you can somehow allege that the defendant harmed you. The GPL may be different, but this question is not about the GPL.
    – Kevin
    Sep 26 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.