Should you give attributions to the libraries your library uses?

Question

Let's say I use a x-library which I've found in GitHub and it uses MIT license. Sure, I could give attribution to it in my apps in the About > Licenses page. But what about the libraries that x-library uses? Is it my job to give attribution to it or is it x-library's job?

Answer 1

But what about the libraries that x-library uses? Is it my job to give attribution to it or is it x-library's job?

If you redistribute libraries with you app --whether or not they are your direct, first level deps or deps of deps at full depth-- you are responsible to ensure that you comply with each licenses, all the way. It is always your job even if and especially if the libraries you redistribute did not properly comply with the terms of the code they reuse.

Answer 2

Let's assume for the sake of simplicity that x-library only depends on libraries that are licensed under MIT as well.

The only requirement of the MIT license is:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

which is a very light way to require attribution.

You did not say which kind of programming language all of this was written in, but let's assume that this is some kind of interpreted language like Python or Javascript. Then if you use the library without changing it, you are already complying with the requirement because your copy of the software does include the copyright and permission notice of the library (even though it is not easy to access for users). Notice that if the library you rely on complies with the MIT licenses of the libraries it depends on, then you are also automatically complying with them (because the LICENSE files will already be included in the source code).

Now, in the case where there is some kind of compilation (including minification of Javascript sources), then the various licenses might disappear during this process and it is your job to put them back (all of them, not just the one of the library you are directly depending on).

Finally, it is usually advised to make the attribution more prominent than what I describe, in some kind of About page. In this case, I would advise putting every dependency of your software there, not just the direct dependencies.

What to remember: you have to comply with the licenses of all the dependencies, not just the one you are directly using.

See also: Software dependencies: A not-too-technical introduction