3

I found some similar questions here and in other places, but nothing seemed to quite fit my use case.

I am writing a JavaScript program that imports and uses another library which is licensed under MIT (but this question also holds with respect to other licenses). Since I only refer to the other library by imports, I do not have any copy of its code in my (GitHub) repository. First question: Do I still need to add the license of the used library? My guess is no, but it also does not hurt, so I will probably do it anyway.

Now, all of my source files and the distribution file of the library are packed into one single JavaScript file, which is the finished program. The script to do this is part of the GitHub repository, but the resulting file is not included in the actual git repository. Instead, it will be separately uploaded via GitHub's "release" feature. Second question: Where do I put the license notice of the external library? Is it enough to have it in the GitHub repository (which is linked to the release page and vice versa), or do I need to include a notice on the exact same webpage where the end user will download the program file?

Sadret
  • 131
  • 3

1 Answers1

4

Do I still need to add the license of the used library?

If I understand what you've written above correctly, you are distributing copies of this library, so yes, you need to include its licence; and those of any libraries that library uses.

Where do I put the license notice of the external library?

It doesn't really matter, as long as you include it both in the repository and in the distributed copies.

Edit: you need to include it in the former, because it is likely that your work is a copyright derivative of the library. Remember that the decision in Google v Oracle wasn't that APIs aren't copyrightable, but that a particular usage of them was fair use. You could try to run a similar defence, but when you can sidestep it by reproducing a few hundred characters of text, it's simpler just to do that.

As for the latter, you may be minifying your and the library's JS before distributing it, but you are still distributing the library, so you are still obliged to distribute the licence text as part of that. Most good minifiers will allow you to specify comments or other text that is not minified (see eg this answer, and those to which it links, for more details). If you don't want to go to the effort of finding a decent minifier and shipping an extra few hundred bytes of human-readable licence statement with your JS, don't use someone else's copyrighted work.

MadHatter
  • 48,547
  • 4
  • 122
  • 166
  • I think this does not answer the question. There is a difference between the source code of the program and the compiled program. The first of my questions was regarding the source code, which does not contain a copy of the library, but just a reference to it (i.e. the name). The second question was about the compiled program, which is a single non-human-readable file. So I cannot add any copyright notice "in" the distributed program, only as separate file "with" the distributed program. Especially, I cannot force the users to actually aquire the license file, 99% of them will just ignore it. – Sadret May 30 '23 at 12:02
  • 3
    "I cannot add any copyright notice "in" the distributed program" You can do this. Maybe not with your current tooling, but you could if you actually wanted to. – Philip Kendall May 30 '23 at 12:09
  • 1
    @Sadret I thought this was JavaScript. By compiled, do you mean minified? – MadHatter May 30 '23 at 12:11
  • @MadHatter Yes, basically. It is actually transpiled and minified TypeScript. Point is, it is not human readable. – Sadret May 30 '23 at 12:53
  • @PhilipKendall That is like saying you can add the license to an .exe by adding some byte block that contains the license in UTF. Sure, it is there somewhere in the program, but it is not feasible for anyone to access. – Sadret May 30 '23 at 12:56
  • @MadHatter Regarding your edit: All I do in the source code is using the libraries API, which seems to be not copyright-protected. – Sadret May 30 '23 at 13:10
  • @Sadret see above. – MadHatter May 30 '23 at 13:40
  • You don't need to become aggressive about this. I never said or implied that I do not want to include the license, I just want to know what the correct way to do so is. – Sadret May 30 '23 at 13:59
  • I wonder how including the license in the JS file can be enough, since it will not be visible to the end user. – Sadret May 30 '23 at 13:59
  • @Sadret you've been told what you need to do, and you've objected that you don't think you need to do it in one case, and you can't do it in the other. I make no judgment on what you want to do, since that's irrelevant to the question, but you haven't exactly been welcoming to the obligations laid out thus far. The users who receive the JS are by no means obliged to read the licence, so that's not your problem; you are, however, obliged to send it, and send it such a manner that they could read it if they wanted to. – MadHatter May 30 '23 at 14:03
  • So to sum it up, you say that it is enough to send the license information, even though it is expected that most users will not be able to read it or even notice it? – Sadret May 30 '23 at 14:09
  • That's just something I find very hard to believe. Intuitively, I just guessed that the license information must be accessible in a feasible way. – Sadret May 30 '23 at 14:10
  • 1
    @Sadret this is probably not a good place to have that general discussion, but consider downloading a gzip'ed tar file containing all the source for, say, gcc. Somewhere in that tarball, when it's unpacked are some licence files. I've downloaded source like that very many times over the years, but I can count on one hand the number of times I've read the licences included. The terms of the MIT license are pretty clear: you must send that text. That's all. What the user does with it, if anything, is entirely up to them. – MadHatter May 30 '23 at 14:45
  • The source is not the problem, the final distributed file is. But if it is as black-and-white as you stated, I will include the notice in the distributed JS file and be fine. – Sadret May 30 '23 at 15:10
  • @Sadret, the argument that a minified file is incomprehensible to most people is unlikely to hold up. The original source is probably just as incomprehensible to the majority of (non-programmer) people. Based on the text of the MIT license, it can even be argued that it needs to be included within an exe file if that is the whole of your distribution. – Bart van Ingen Schenau May 31 '23 at 11:58
  • Please, let's not have this discussion here. – MadHatter May 31 '23 at 12:45