How to identify and ascertain applicable license for OSS java libraries?

Question

How does one identify and ascertain the applicable license for the respective OSS Java libraries (directly or via transitive dependency) included in a Java application from a Maven archive (e.g. mvnrepository.com)?

E.g. in the case of mvnrepository.com, it lists that xml-apis library (https://mvnrepository.com/artifact/xml-apis/xml-apis/1.4.01) is available under Apache 2.0, W3C License and SAX License. However, I am unable to verify from Apache, W3C or the SAX websites where it says that the specific .jar (or the library name) is covered under a certain license.

So I was wondering, in general, what's the most definitive means of establishing the applicable license for any given library.

Answer 1

whats the most definitive means of establishing the applicable license for any given library

TL;DR

You find the source code of the library, in there, there must be some kind of LICENSE or COPYING document. That is the "applicable license" for the corresponding library.

TS;DR

You'll find multiple, tons, of software written by parties 3rd to Apache, who use the ALv2. All of those uses are unrequested from the Apache Foundation and the Apache Foundation has no derived responsibility.

If you find that some software is using some license such as the "A" license, you don't go to "A" to check if that's true. Other "A"s here are e.g. MIT, zlib, etc.

Instead use the

guide to find license for software package whatever

1. Find the library in mvnrepository or wherever: http://mvnrepository.com/artifact/xml-apis/xml-apis/1.4.01.

2. Jump to the home page: http://xml.apache.org/commons/components/external/ (ask for further help if you don't find this in the page of step 1).

3. Fetch the Apache XML commons source code: https://xerces.apache.org/xml-commons/

   3.1. No luck next time? Derive it via Ohloh: https://www.openhub.net/p/xml-commons, access code locations, only if unbroken at Ohloh.

4. Keep fetching the source code: http://xerces.apache.org/mirrors.cgi.

5. Download the thing: http://apache.uvigo.es//xerces/j/source/Xerces-J-src.2.12.0.zip.

6. Uncompress, find the LICENSE (sometimes they call it COPYING!) document:

                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

   1. Definitions.

      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or

[...]

Hope that helped.