In general, when I make my code dependent on library, do I have to check its dependencies licenses or library license is the only one to be checked on my side?

Can I be assused of using MIT library that internally violates its own dependency license?

  • The only two ways you can violate the MIT license is by either (1) not including the license notification or (2) not including author information somewhere in your software. The only kind of license that would be incompatible with MIT would be a license that actively prohibited you from doing those things. Do you truly have a license that prohibits that, or do I misunderstand your problem? Or does the other library use MIT material from yet another project, but doesn't attribute it correctly? – apsillers Mar 4 at 13:08
  • Better problem description would be that I use MIT third-party library in my commercial product and I am not checking that library dependencies. What if MIT library has dependency that is MIT incompatible and therefore can not be linked to my commercial project. Am i responsible for checking MIT library dependencies? – user14431 Mar 4 at 18:08
  • There's a reason the MIT license includes the bold print notice "THE AUTHORS OR COPYRIGHT HOLDERS [SHALL NOT] BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY"... I.e. they are saying you may use the software but if someone else comes along tries to sue you for something related to the software (including some other software's license), you're on your own. – Brandin Mar 5 at 13:01

When you are distributing an application or library, then you are responsible for ensuring that the requirements of all involved licenses are fulfilled. This includes the licenses of all transitive dependencies.

As an example, if your application uses a library M that is distributed under the MIT license and which in turn uses library G that is distributed under the GPLv2 license. In that case, you must ensure that the entire application can be distributed under the terms of the GPLv2 license. This means that you cannot use library A that is distributed under the Apache 2.0 license, because that license is not compatible with the GPLv2.

In the same vein, if library M uses both library G and library A, the library M can not be legally distributed and can not be used in your application either. And as library M can not be legally distributed in this case, then derivative works, like your application, also cannot be legally distributed.

  • 1
    Just some subtlety: Distributing the library M itself (without the libraries G and A) would probably not cause any legal problems: Because the code you distribute is neither GPL- nor Apache-licensed, you can't violate one of the two licenses in this case. However, you would probably have to re-write library G and/or A to use library M legally. – Martin Rosenau Mar 7 at 14:36

Your Answer

