At work, we're deploying a software bundle of a Java application (written by us) which has lots of external dependencies, most of them being LGPL and BSD-licensed third-party-libraries distributes as JAR archives.

Currently, we're deploying a test-client of the software which is distributed as a single java fat jar archive, created by the Maven assembly plugin, which does roughly the following:

  • extract all dependencies
  • rebundle them as a single jar-archive

All class files are extracted, and then bundled back into a single JAR file with our own application. I realized that also some files get overwritten, mostly LICENSE.txt-files, due to having the same name.

I'm wondering whether this is correct and complies with the LGPL license. What would be a better way to distribute the software? How would this particular package be best organized?

We did not incorporate any source code directly into our source files, nor did we touch the binary files. The source code of the libraries accompanies the whole product. (It is software that is internally used, not deployed to customers or anything, but I guess that does not matter.)

PS: I asked the same question on Stack Overflow, and I was suggested to ask it here.

2 Answers 2


This is really a difficult matter that should be discussed with a lawyer. Anyway, overwriting the LICENSE.txt files (which effectively eliminates all but one of them) is definitely a no-go. Renaming them to Foo-LICENSE.txt, Bar-License.txt is the first step you should do immediately. Concerning the LGPL, offering instructions how to replace the lib withing the fatjar might be enough to comply with section 4e of the LGPL (ask your lawyer). If asking the lawyer is not feasible, directly asking the authors permission to do it like that might be an alternative.


Since you're using Maven, I recommend switching to the shade plugin to build your JAR. It can be configured to automatically handle multiple "standard" license files (see the section on resource transformers), and will warn you if your dependencies have overlapping classes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.