0

Trying to make sense on how MIT, BSD and Apache 2.0 licenses and attribution work, I've taken some real examples from GitHub. The open source software projects below are classified according to these 3 licenses.

=== MIT ===
References:
https://choosealicense.com/licenses/mit/
https://www.tawesoft.co.uk/kb/article/mit-license-faq (FAQ "How do I use the MIT License?")

Questions:

  • Is it a common practice to include a "dist" (abbr. for distribution/release) folder in the source code repository with files with the MIT license and copyright notice already embedded in them? If that's the case, I understand anyone using the software don't have to do anything else to give attribution. In fact, who is responsible to give proper attribution to the license, the licensor or the licensee? It looks like are cases in which the licensor uses a MIT license and the "dist" files already include proper attribution but that's not always the case.

  • Is it correct to name or link to the MIT license instead of copying it entirely in a source file? As seen in the below examples it's a common practice. However, in the MIT license, it's stated that "The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software." which for me means to include the whole license in each file.

  • If I'm using a source file, let's say "bootstrap.min.css" (which already includes the MIT software license embedded) for a software project with a private license it's sufficient to use the file or I have to do anything else to give attribution to the MIT license?

Semantic UI
github.com/Semantic-Org/Semantic-UI/releases
github.com/Semantic-Org/Semantic-UI/tree/master/dist
- In the release they provide the whole repository source code in a compressed file + there's no specific compressed file for getting only the distribution.
- There's a dist folder in the source code.
- An example of how they include the license embedded in the dist files:
/* * # Semantic UI - 2.4.0 * https://github.com/Semantic-Org/Semantic-UI * http://www.semantic-ui.com/ * * Copyright 2014 Contributors * Released under the MIT license * http://opensource.org/licenses/MIT * */

Bulma
github.com/jgthms/bulma/releases
github.com/jgthms/bulma/tree/master/css
- No dist folder in the source code.
- In the release they provide the whole repository source code in a compressed file + a compressed file for getting only the distribution (with a copy of the MIT license and a few more files)
- An example of how they include the license embedded in the dist files:
/*! bulma.io v0.8.2 | MIT License | github.com/jgthms/bulma */

Bootstrap
github.com/twbs/bootstrap/releases
github.com/twbs/bootstrap/tree/master/dist
- In the release they provide the whole repository source code in a compressed file + 2 additional compressed files (one oriented to the dist and another with examples)
- In the dist they don't provide a copy of the MIT license. The ñicense and copyright notice are embedded in the files.
- An example of how they include the license embedded in the dist files:
/*! * Bootstrap v4.5.0 (https://getbootstrap.com/) * Copyright 2011-2020 The Bootstrap Authors * Copyright 2011-2020 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */

UIKit
github.com/uikit/uikit/releases
github.com/uikit/uikit/tree/develop/dist
- In the release they provide the whole repository source code in a compressed file + a compressed file with the dist files but without a copy of the MIT license as a separe file in the root directory.
- An example of how they include the license embedded in the dist files:
/*! UIkit 3.4.6 | https://www.getuikit.com | (c) 2014 - 2020 YOOtheme | MIT License */

=== BSD 2-Clause "Simplified" License ===
References:
https://choosealicense.com/licenses/bsd-2-clause/

Questions:

  • People using Leaflet should give attribution to the BSD 2-Clause license editing the source files? Is it the licensor or the licensee who should comply with it?
  • In the BSD license, it's not mentioned to place the entire license as a text file in a root directory when distributing, isn't it?

Leaflet
https://github.com/Leaflet/Leaflet/releases
https://github.com/Leaflet/Leaflet/tree/master/dist
- In the release they provide the whole repository source code in a compressed file.
- In the dist directory there's no LICENSE file neither the license is embedded in each source files.

=== Apache License 2.0 ===
References:
https://choosealicense.com/licenses/apache-2.0/

Questions:

  • Hugo is a Static Site Generator (SSG). Let's imagine, I'm going to use the last release. I download the binary (object in Apache 2.0 terms) files (so I won't compile the source code myself) for my OS distribution. Then, I'm using Hugo (the hugo.exe) binary file to do several stuff (create the structure of my static site, generate my static site, run a local server, ...). Since I'm using Hugo (the binary) should I give attribution somehow (I need to comply with the Apache point "4. Redistribution" or any other)? If that's the case, where I should do that in my website?

  • Why they include a copy of the Apache License 2.0 license in each *.go file? I don't understand if the licensor should have to include or not the license and copyright notice on the source files or is the licensee who should do it.

Hugo
https://github.com/gohugoio/hugo/releases
- In the release they provide the whole repository source code in a compressed file + several binaries targeting several operating systems...
- Taking a random file from the source code, for instance https://github.com/gohugoio/hugo/blob/master/source/sourceSpec.go it already has the license embedded. It happens the same with several files. By extension, I guess every *.go file include the license at the top.

2

Before I address any of your questions (of which there are rather a lot), note that the licence does not bind the author of wholly-original code. GPLv3 s4 requires that a copy of the GPL accompany any copy of the code, but if Fiona Q. Hacker writes libfiona from scratch and unambiguously releases it under GPLv3, and yet she doesn't include a copy of the licence, that means neither that the release is invalid, nor that you have the right not to include a copy if you redistribute her code. So looking to existing projects for best-practice can be misleading. That said:

Is it a common practice to include a "dist" (abbr. for distribution/release) folder in the source code repository with files with the MIT license and copyright notice already embedded in them?

I don't know, but the licence does not require it, so you should read nothing into its presence, nor its absence.

Is it correct to name or link to the MIT license instead of copying it entirely in a source file? ... it's stated that "The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software." which for me means to include the whole license in each file.

The MIT licence does not define "substantial portion", but it's clear that the notice (ie, the licence text) must be included in each copy of the covered software, which is to say that one copy of the licence per complete copy of the codebase suffices. I see no reason to think you need to include one copy in each file that makes up the codebase; but if you want to, go for it.

If I'm using a source file for a software project with a private license it's sufficient to use the file or I have to do anything else to give attribution to the MIT license

You must preserve the existing copyright notices also.

Since I'm using Hugo (the binary) should I give attribution somehow (I need to comply with the Apache point "4. Redistribution" or any other)? If that's the case, where I should do that in my website?

Unless Hugo copies substantial portions of its own source into the output it generates, you are using, rather than re-distributing, Hugo. Therefore you have no obligations whatsoever with respect to your generated website, and you can license the content therein as you please.

Why they include a copy of the Apache License 2.0 license in each *.go file? I don't understand if the licensor should have to include or not the license and copyright notice on the source files or is the licensee who should do it.

Their work may be based on some upstream work which is also under Apache2. If so, then it is likely they are honouring their obligations under Apache2 s4a by including the licence text. It is the licensee's obligation to comply, but remember that each licensor may also be a licensee.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.