Let's assume within my project which is GPLv3 based I'm using a single library called a-lib.jar. That jar itself is licensed using Apache v2 license, so I should be fine with the GPL as long as I respect the Apache v2 terms (basicly inclueding the license file).
Now when I look into the a-lib.jar that I'm using I see that it is using many other dependencies (packaged within a-lib.jar):
- b-lib.jar
- c-lib.jar
- d-lib.jar
All of them are licensed on open source licenses, but the licenses may differ. E.g.:
- b-lib.jar is licensed under MIT
- c-lib.jar is licensed under Apache v2
- d-lib.jar is licensed under some "custom made" open source license
The resulting file that I would like to release would look like this then:
myproject.jar
|--a-lib.jar
|--b-lib.jar
|--c-lib.jar
|--d-lib.jar
My question is: in order to avoid legal issues, do I have to comply with all the terms of the dependencies of the library that my project depends on? E.g. do I have to place some NOTICE file somewhere, saying that I'm using b-lib.jar and that it is under MIT? Then again: you can play that game forever: b-lib.jar may also include other 3rd-party licenses and so on and on.
Do I have to check EVERY SINGLE component and comply with it's terms, even if MY software is not useing it but instead a lib that I'm using is useing it? Or am I fine if I just take care of my projects dependencies and don't have to care about 3rd party dependencies? (Basic idea behind that would be that the creator of the a-lib.jar which released it under apache v2 is responsible for it's content).
Besides of that: is the situation of the example above any different if the 3rd party dependencies are not child-jars within the a-lib.jar but instead a-lib would be delivered as a maven project with dependencies to b-lib, c-lib and d-lib and those 3rd party dependencies would be packaged directly into my project *.jar file? So the resulting file would be:
myproject.jar
|--a-lib.jar
|--b-lib.jar
|--c-lib.jar
|--d-lib.jar