I'm using 2 libraries licensed under Apache 2.0. How do I comply if my app is proprietary software and I'm not modding the libraries?

Question

How do I comply with the apache 2.0 license in this context. Neither of these libraries have a notice file. Do I just include the apache 2.0 license to be available with my app's release (like in the folder the installation/binary is in?)? I am not modifying or redistributing the libraries (just calling functions and using classes provided), they are just going to be compiled and bundled into the application as dependencies. How would I include the copyright notices and license associated with these libraries?? From my interpretation of the license if I am going to reserve all rights to my application under copyright, as it has to be closed source--this will in turn close the source of the libraries bundled within because it'll all be compiled and shipped as a whole. Is this allowed?

Clause 4 is giving me the most trouble. 4a states that I must include the Apache 2.0 license with my derivative work (in my interpretation, because my work is based off of(uses these libraries) I must include the license with the work. how would I clarify that the Apache license applies only to the libraries? as... according to 4d "may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License." I do intend to extend no license to the users(should I include a statement in the source that it is Copyrighted, all rights reserved in source in case source is leaked somehow? for the sake of clarification?). I intended on reserving ALL rights to this application under copyright.

How do I give attribution, copyright notices and disclaimer for the libraries? Where do I put them? What is required? How do I give attribution? How to I convey their copyright notice? There is no notice file.

4c flat out confuses me.

This application is going to help a lot of people, and it's important it's closed source for security reasons. I can't use these libraries if I have to supply any source form of these libraries with my work. I intend to compile them and bundle them into the application binary as dependencies--as I stated before.

This version of the application will be a desktop application

Answer 1

You probably somewhere have a statement under which terms your application can be used (mentioning how many copies can be made, that source code will not be provided, etc.). This can be a separate document or an about-page within the application or something else.

The easiest way to comply with the Apache license requirements is to extend your "terms of use" with information along the lines of

This application uses the libraries Foo (http://foo.example.com) and Bar (http://bar.example.com). These libraries are available under the Apache 2.0 license, which can be obtained from http://www.apache.org/licenses/LICENSE-2.0.

The library Foo contains the following attribution notices:

[ content of the NOTICES file ]

Providing the links to the libraries is not required, but I always consider that an act of goodwill.
I have added a link to the text of the Apache license, rather than the license text itself, because that is also how authors using the license are instructed to do it.

Section 4 of the Apache 2.0 license indeed gives you the right to distribute your application as closed source without giving your users the right to replace the linked version of the used libraries with another version.

Clause 4c is not applicable in your case, because it deals with the distribution of source code and essentially says that you are not allowed to remove copyright or attribution notices unless the code it applies to also has been removed.

Answer 2

One way to satisfy your obligations is to have the program print in its starting screen something like:

This program is (c) 2018 Keith Cronin, all rights reserved.

It includes libfoo (c) 2008-2018 The Foo Organisation, and libbar (c) 2010-2018 The Bar Coalition and others. Both are used under the terms of the Apache2.0 licence. Click here for full details of the copyright holders and the text of the licence.

At that point Apache2's points 4a, 4b (since you're not modifying the libraries), 4c (since you're not distributing source), and 4d (since there are no such NOTICEs) are fulfilled, and that is the full extent of your redistribution obligations under this licence (note: IANAL/IANYL). Actually linking through to libfoo and libbar would be a nice gesture, but it's not required.

it's important it's closed source for security reasons

You give no more details, but I will note in passing that this almost never turns out to be true. Historically, the best security comes from exposure to many eyeballs, because some of those eyeballs are almost certain to sit in front of brains better trained in security analysis and secure protocols than yours (or mine, or just about anyone's).