1

Our closed-source proprietary web application uses quite a lot of libraries with different licenses (namely Apache 2.0, MIT, BSD-like, LGPL 2.1, etc). We want to distribute binaries (ear files, specifically) together with these libraries' jars.

If I understand correctly, most of the licenses demand from the distributor to put libraries licenses into the distribution package.

This problem must come up all the time. Is there a standard/canonical way to do this? As I saw in other projects (e.g. PostgreSQL), there does not appear a standard way to specify the list of licenses. Is it sufficient to put somewhere all the licenses and the list of libraries and which library is issued under each license?

UPDATE: In the comments the link to the similar question was posted and if i get it correctly, i need to put library license file and 'NOTICE' file. Is there a standard way of doing it? For example, in PostgreSQL there's one big file for all licenses. Also what should i put in 'NOTICE' file?

1

There is no standard way to mention which licenses are used by the third-party libraries that you use. This has to do with the different requirements that licenses place on this.

For some licenses(like BSD), it is possible that the license text is only present as a comment in the source code, while other licenses (like GPL and Apache) are so lengthy that the full license text is distributed in a separate file.

A good strategy to deal with this is the following

  • For each library you use, check if there is a file containing just the license information and if there are any other files that the license requires you to include (such as a NOTICES file for the Apache license). Put these files together in a 'licenses' folder. If necessary, rename the files to make it clear what licence is contained in it.
  • Mention in your documentation which libraries you use and under which license they are distributed
  • Distribute the content of the 'licenses' folder together with your application.
  • 1. If there are several libraries under the same license with the exact text (like Apache 2.0), may i put only one copy of the license file in the distribution? Conversely, should i put every copy of BSD-like licenses in the distribution? 2. What do you exactly mean by 'documentation'? Or is it not specified how one should do it too, and it can be done in any way? 3. What should i do with 'submodules'? For example, we use Jackson library and it has various submodules (like jackson-core, jackson-databind, etc). Should i specify only Jackson project, or every of its submodules? – crew4ok Apr 3 '15 at 16:48
  • @crew4ok: 1. There is no need to have multiple copies of a license text. 2. Documentation can be anything from a readme file or about dialog to a formal manual. There are no explicit requirements there. 3. With submodules, the choice is basically yours. If you picked just a few, then I would recommend listing them individually. If you use the majority of submodules, you can just mention the library/package itself. – Bart van Ingen Schenau Apr 3 '15 at 17:14
  • 1. What about BSD licenses? If i get it correctly, every BSD license is different, i mean in copyright part. May i put a template or something? :) 2. May i put all the licenses together with the list of libraries that use it in one file? – crew4ok Apr 4 '15 at 15:50
  • @crew4ok: 1. There are 3 BSD licenses that differ in the number of clauses the contain. Those should be counted as different licenses (the same holds for the different versions of GPL in common use). 2. Yes, you can also collect the licenses in a single file. Make sure that it is clear where one license ends and the next license starts. – Bart van Ingen Schenau Apr 4 '15 at 17:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.