How are SharpNav dealing with Licenses?

[Lanboost]

The sharpnav project is under the MIT license, that part I understand. But when I use Nuget I only get the .dll file for the SharpNav project.

This would be fine if the statement that no dependencies are needed (and this can be a question what a dependency is I assume)

However when I open the project the core project depend on two nuget packages

• Newtonsoft.json

• Yamldotnet

both of those are licensed under MIT, however the license files for those projects are not sent with the .dll and from my perspective unclear that you need to send with the users own binary.

So:

• Am I missunderstanding the MIT license?

• Do SharpNav assume that the end user ships all 3 MIT license files on their own with the binary? (SharpNab, NTS.json, Yamldotnet)

Reason:

• This should be clear. (imo)

• I ported the project to Net 3.5 ("ported" with 2 new dependencies, NetLegacySupport.tuple and TaskParallelLibrary) and if SharpNav want to support this in the future I think we need to clear up how the licenses should be handled. Tuple is under MIT so shouldn't be a issue however TaskParallel is microsoft and under "harder" restrictions https://msdn.microsoft.com/en-us/hh295787

Potential Fixes:

• Tell the end user where to find the req. licenses and that they need to redist them.
• Ship them with the .dll in Nuget.

[Robmaister]

Note that I'm not a lawyer and this is not legal advice.

MIT license is fairly permissive, but binary distribution doesn't have a clear-cut answer. Two contradicting links online:

https://opensource.stackexchange.com/a/4061
https://www.quora.com/Does-the-MIT-license-require-attribution-in-a-binary-only-distribution

The main contradiction is in "this software" and whether or not a binary counts as software. For SharpNav, I would appreciate the license being included in binary-only distributions, but wouldn't care if it wasn't.

As for my own dependencies (which can be stripped out relatively easily if you don't want to deal with them) I pull them from nuget, which includes licensing information as part of the package info. Since distribution has to happen through nuget for SharpNav, I don't need to bake their license information into my repo.

At the end-user application level where you're distributing everything, I've actually seen a number of things done. One of my clients required licenses for the whole chain of dependencies to be baked into our app. In another case, no licenses were redistributed.

I can distribute my own license file in nuget, but since I'm not directly distributing my dependencies, it would be up to the other package maintainers to do the same. Does that seem fair?

I'm glad that you care about licensing, too many people don't. But it's hard to be clear when licensing itself is fairly complex and can change based on case law. Everything I've discussed here applies to US copyright law. Most countries end up following the same or similar laws through various treaties and agreements, but it's not universal, unfortunately.

tl;dr include the whole dependency chain's licensing if you want to be safe

[Lanboost]

That clears up it, a bit at least :)

It is satisfactory for me, and as I now know this I know how to distribute the "dependencies" license with it.

The question for me for future users of this library is however how they will know what license dependencies SharpNav has.

As for my own dependencies (which can be stripped out relatively easily if you don't want to deal with them) I pull them from nuget, which includes licensing information as part of the package info. Since distribution has to happen through nuget for SharpNav, I don't need to bake their license information into my repo.

I understand that SharpNav don't need to include the license with the .dll as the information is clear from nuget as you say. However
https://gyazo.com/3778be8d7e7f722a1212d5d04ecdfc8a
doesn't say anything about Newton.Json and Yamldotnet. Which means that for a user who gets SharpNav from nuget nowhere is there information to find that it "depends" on those two softwares.

And as you say it is unclear if its even needed in the first place.

Just my 2cents, Im happy and got it "cleared" up so the issue can be closed as it was more of a "question" than a issue for the repo if the above is seemed irrelevant.

Thanks /Lan

[Robmaister]

it's been a while but I think I chose to not list them as dependencies as there was no way to specify an "optional" dependency. As in, if you don't touch the classes that serialize information to/from JSON or YAML the rest of SharpNav will run just fine. There are probably better ways of handling that sort of dependency.