8

We want to publish a project that does use some components under BSD-3-Clause license according to below:

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

And currently we plan to place the below BSD-License in the file C:/program files/our-app/redist/licenses/BSD-3-Clause.txt

BSD-3-Clause.txt file:

########################################################################
Things under the following license may be included in this product:

Copyright (c) 2011, Andre Somers
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
    * Redistributions of source code must retain the above copyright
      notice, this list of conditions and the following disclaimer.
    * Redistributions in binary form must reproduce the above copyright
      notice, this list of conditions and the following disclaimer in the
      documentation and/or other materials provided with the distribution.
    * Neither the name of the Rathenau Instituut, Andre Somers nor the
      names of its contributors may be used to endorse or promote products
      derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL ANDRE SOMERS BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR #######; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

########################################################################
Software under the following license may be included in this product:
   SQLCipher

Copyright (c) 2008-2012 Zetetic LLC
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright
  notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright
  notice, this list of conditions and the following disclaimer in the
  documentation and/or other materials provided with the distribution.
* Neither the name of the ZETETIC LLC nor the
  names of its contributors may be used to endorse or promote products
  derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY ZETETIC LLC ''AS IS'' AND ANY
EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL ZETETIC LLC BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

But is that really the right approach and place for the license ?


Note that for security reasons:

  • Only one of the licenses includes name of what we use (SQLCipher).
  • That's because adding that name is not considered a security leak in our-app's case.
  • But in the first license, we don't even mention "Software" and write "Things" instead.

We wanted to write "Content(s)" instead of "Things", but god knows what's the meaning that different jurisdictions may give to "Content(s)", hence "Things" is fine.

2
  • 2
    What kind of software are you publishing? Does it have a GUI? Does it have a manual?
    – amon
    Nov 8, 2018 at 14:06
  • It does not have any documentation and we hope that redist directory does count as materials provided with the distribution @amon
    – Top-Master
    Nov 10, 2018 at 7:22

1 Answer 1

11

You are required to attribute the authors of any libraries you use, regardless of whether this is explicitly required by the libraries' licenses. The BSD license only mentions a suggested place for this attribution. In general, wherever you assert your copyright of the software, you should also mention that you include software from other copyright holders. Claiming that you hold sole copyright when you do not would be a kind of copyright infringement.

In a GUI software, such attributions would usually be in a “Help → About” menu item. E.g. Google Chrome shows:

Google Chrome
Copyright 2018 Google Inc. All rights reserved.

Google Chrome is made possible by the Chromium open source project (link) and other open source software (link).

The second link goes to a page that lists all included libraries and shows their licenses.

The BSD license requires that binary distributions must show the license “in the documentation and/or other materials provided with the distribution.” The intent here is clearly that any attribution within the source code is insufficient because that would be compiled away and is inaccessible to users. Instead, the license requires you to put the attribution somewhere a user can easily see, e.g. any documentation. In my opinion, the documentation can be part of the application's user interface itself and doesn't have to be a separate document.

You suggest placing attributions into a subdirectory of an installation. In a most literal interpretation, this might satisfy the BSD license. Yet clearly this fails the intention of providing user-visible attribution, since most users would not think to scour the installation directory for legal notices. I think this solution would be fine if and only if you provide documentation that points users to those files, e.g. as part of a copyright notice within the application.

8
  • 1
    @Top-Master yes the link should go to a local document. In the Chrome example that was a chrome:// link that doesn't need internet connectivity. You can use whatever format you want, but I would recommend HTML, PDF, or plain text. Windows users might have difficulty opening a .md file.
    – amon
    Nov 11, 2018 at 8:49
  • 2
    @Top-Master Most open source licenses do not require acceptance for normal use, only for distribution or modification. So showing the licenses during installation is fine but not required. I'd be more doubtful about showing the licenses and copyright notices only during installation. I think this might be fine if the installer points the user to a local directory where they can find the licenses later, and if your application doesn't show your own copyright notices either. But if you show your own, also show third party notices in the same place.
    – amon
    Nov 11, 2018 at 11:12
  • 1
    > You are required to attribute the authors of any libraries you use, regardless of whether this is explicitly required by the libraries' licenses Says who?
    – Kaz
    Sep 21, 2022 at 5:00
  • 1
    @Kaz I wouldn't phrase it like that today. But moral rights are a thing, at least in Germany where OP and I are from. Moral rights are a part of copyright, and include the right to be recognized as the author for your work. If I ship binaries that include various libraries, I'd better acknowledge those libraries.
    – amon
    Sep 21, 2022 at 16:06
  • 3
    @amon If people don't say in their licenses that the want to be attributed in compiled programs and documentation materials, you better not do it. It could be something they specifically don't want. Outside of open source, in the world of commercial, proprietary components, it's common not to attribute a component vendor or even be prohibited from doing that.
    – Kaz
    Sep 21, 2022 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.