I'm working on a piece of open source software that's distributed as a binary in a Docker container. Thus, most of the users of the software not only do not interact with the source, they do not even interact with the binary. They simply run the container as a process and interact with it via HTTP calls. It's a text-protocol web service that the user runs on-premises.
My codebase, which is licensed under Apache 2, pulls in the source code of many libraries at build time. Those libraries each pull in the source code of many other libraries such that at build time there are literally more than 100 copyright notices on the disk of the person building the software (me).
My questions are the following:
- Do I need to distribute those copyright notices with the built software?
If I do, the only convinient interface for a user to view them would be to include in the HTTP text-protocol a command
GET /licenses or similar that would return the contents of 100+ licenses and copyright notices (which would incur a performance hit to the software if it were invoked).
- For the purposes of distributing the licenses can I draw a distinction between libraries that I depend on directly and libraries that I depend on indirectly?