Distribution of a larger work containing unmodified MPLed dependencies: is informing receivers needed?

Question

I'd like to include in my closed-source program a dependency library under Mozilla Public License to be linked dynamically. The MPL dependency is basically simply imported in the source code of my program and used as is, with no modifications. I'd like to distribute the resulting "larger work" to my customers.

If I got it right, I can ship my "larger work" under proprietory license without giving the source code away. But I must inform my customers that the software they receive contains MPLed dependencies and the links to their source codes. Is that correct?

If so, how it's usually done? Is it okay to put a list of such dependencies with the URLs to their repositories to the Legal notice section of my software?

Answer 1

If I got it right, I can ship my "larger work" under proprietory license without giving the source code away. But I must inform my customers that the software they receive contains MPLed dependencies and the links to their source codes. Is that correct?

Yes, that is correct, in so far that the MPL requires you to inform your users where/how they can obtain the source code for the MPL portions of the application. Although a link is very convenient, other mechanisms like sending an email or snail-mail letter are also allowed.

If so, how it's usually done? Is it okay to put a list of such dependencies with the URLs to their repositories to the Legal notice section of my software?

The "Legal notices" section is a very common place to mention the third-party software you use and their licenses. However, just linking to their repositories might not be sufficient to meet your source code distribution requirements (in the long term).

Your obligation is to make the source code available of exactly the version you use in your software and this obligation does not end when the original project dies or stops distributing that version (or in another way makes it impossible to determine which source code is part of that version). You can start with a link to the original project, but you should have a backup plan in case someone contacts you and claims that the link you provided doesn't work anymore.