Software dependencies: A not-too-technical introduction
Programs depend on other programs, often with many deep levels of indirection.
Million of packaged FLOSS programs are available through public repositories for easy dependencies download and installation.
How dependent programs relate to and interact with each other can be more or less ...
But what about the libraries that x-library uses? Is it my job to give attribution to it or is it x-library's job?
If you redistribute libraries with you app --whether or not they are your direct, first level deps or deps of deps at full depth-- you are responsible to ensure that you comply with each licenses, all the way. It is always your job even if and ...
I wouldn't recommend uploading static binaries and header files to GitHub. A better approach might be to create a script that is executed before compilation that downloads these dependencies. Alternatively, you could use what is already installed on the machine, if that is applicable.
If you choose to upload the external libraries to GitHub, you must ...
You should practice due diligence also for transitive dependencies. Open-source licensing is frequently shoddy, inaccurate, or slightly misleading. There's no malice involved, but especially smaller libraries treat licensing as an afterthought. So it is unwise to blindly trust your immediate dependencies' authors.
You have to comply with the licenses of all ...
Firstly, and this is important, IANAL/IANYL. If you are betting a business on this idea, you had better get some proper legal advice, and not rely solely on postings by random strangers on internet fora.
That said, the interesting point here is the code signing. One of the major differences between GNU GPLv3 and GNU GPLv2 (I know your question is about ...
I'd describe software with library dependencies as like a car.
If you want to make your own car, you can do it from the ground up, or you can produce only the body and purchase, say, the engine/wheels/gears separately.
You are free to embed them into your car and it's still your car, but parts' manufacturers still have their rights to those parts (like, ...
Yes, you can release your code under the GPL.
The MIT license is compatible with the GPL: you can combine MIT-licensed code with GPL'ed code, as long as the result is licensed under the GPL. This is possible because the MIT license explicitly allows you to sublicense the code (i.e. republish with a completely different license), and only requires you to ...
Let's assume for the sake of simplicity that x-library only depends on libraries that are licensed under MIT as well.
The only requirement of the MIT license is:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
which is a very light way to require attribution.
You did not say ...
The OSL defines "Derivative Works" as
to translate, adapt, alter, transform, modify, or arrange the
Original Work, thereby creating derivative works ("Derivative
Works") based upon the Original Work;
This would on the face of it seem to permit linking by omission. A little further research confirms that in the OSL FAQ (mirror):
I would like to use the packages I required in a project for commercial use. What are my obligations regarding the licenses? Are there any, as I've not required the non-permissive licensed modules directly?
When you redistribute NPM packages (or any package) you need to consider the chain of dependencies at full depth all the way down.
I provided a ...
npm will show you any packages which depend on another package. Here's what it says for sweetalert2.
But that won't include dev-dependencies, or projects which haven't been published to GitHub. GitHub itself however also has a list of all public repositories which depend on your package.
This depends on the exact licenses. There isn't a general answer.
Scenario 1 – indirect library usage
Let's assume we have a third party library that was licensed under the GPL, an “XTPO” component using this library, and some application using the XTPO-component as a library. Then the component and the application are derived works of the GPL library. ...
There is no such license.
Instead of looking for a particular license, it might be better to look at a curated selection of free software. Debian is notable for rigorously checking the licensing of any software they package.
From a legal perspective, the problem is that an open source license is generally just an unilateral grant of rights from the author ...
You are required to comply with all the licenses that apply to the different code parts that make up your project, including the licenses on transitive dependencies (dependencies of dependencies and deeper). If there is a transitive dependency with a license that states that all source code of the entire project must be available (like the GPL license does), ...
I wrote a letter to the Eclipse Foundation. The consultant pointed me to point 5 in their FAQ. My case falls under the term "linking". He warned that he isn't a lawyer, but offered the following short answer:
The Eclipse Foundation does not consider linking with EPL content to be a derivative work and so you are not required to disclose your source code.
To license each part of your work under a specific license (GPLv3 for some components and MIT for others), one way is to place a header in each file or directory that states the license under which that part is distributed, and then refer to the full license text. For the MIT license, you can just use the entire full license text in your file because it is ...
This is probably OK, depending on the licensing status of the code that you generate.
You only hold the copyright to your annotation processor. You do not hold any copyright to the user's programs. The user's programs are merely input data to your processor. Your annotation processor uses automated techniques to transform the input, which does not produce a ...
You added this important comment:
it's frontend project. So packages are bundled and minimized then redistributed to end user.
So the answer to:
Should I credit indirect depended package in my open source credit notice too?
... is a clear YES.
Since you are redistributing your code with directs deps, and with deps of deps, and with deps of deps of ...
As long as you preserve the NOTICE file(s) when distributing your binary, what you're doing is OK per the Apache License.
For instance, this is the NOTICE file for the current Commons Lang. You would need to ensure its contents are available to the consumer.
I am not a lawyer, and this is not legal advice.
If your library has a linking dependency on a library (e.g. dynamic linking at runtime or statically linking it into your library at build time) and that dependency is licensed under the GPL, then your library must also be GPL.
However, if your project is just a collection of scripts that downloads and ...