Third-Party Notices Without the Spreadsheet

Most open source licences ask for one thing in return: keep the copyright line and the licence text with the code. For dependencies, package tools and app stores help with that. For code that was copied into your own files, nothing does, so the credit usually gets lost on the way and the notices file never hears about it.

Remixware finds those copies and writes the missing entries. The loop has three steps: check, write the notices, check again, with a stop in between when an entry needs something only you can find.

The notices loop: remixware check fails with five copies missing attribution, remixware notice adds five entries and asks for two copyright lines it couldn’t find, and once those entries are finished the next check passes.

Step 1: Find What’s Missing

remixware check . --index deps.rmx --fail-on attribution-missing

--fail-on attribution-missing makes this check fail on missing attribution only, so findings that a notice can’t fix don’t get in the way of the loop. Every copy whose licence asks for attribution, and whose source isn’t credited in your notice files, is listed as attribution-missing:

ATTRIBUTION MISSING  internal/csvio/split.go:2-45
                     example.com/fastcsv, fastcsv.go:2-45 (MIT), copied as is, 100% match
                     Keep its copyright line and the MIT licence text with your copy, for example
                     in a third-party notices file.

Remixware reads the usual notice files in your project’s top folder: NOTICE, THIRD_PARTY_NOTICES.md, CREDITS and similar, and the files in a licenses/ folder. A source counts as credited when a notice has its full component name, its repository address, its package URL or one of its copyright lines, as a whole word, so github.com/acme/tool-extras doesn’t credit github.com/acme/tool. A licence text on its own doesn’t count, since many components share the same one.

Step 2: Write the Entries

remixware notice . --index deps.rmx --out THIRD_PARTY_NOTICES.md

Each entry names the component, its licence, where it came from and which of your files use it, followed by its copyright lines and the full licence text:

## example.com/fastcsv

- Source: example.com/fastcsv
- Licence: MIT
- Home: https://example.com/fastcsv
- Used in: `internal/csvio/split.go` lines 2-45

```text
MIT License

Copyright (c) 2021 Mira Okafor

Permission is hereby granted, free of charge, to any person obtaining a copy
...
```

The licence text comes from the component’s own licence files when the index has them, and from the standard texts built into Remixware for MIT, BSD, ISC, zlib, Boost, Apache 2.0 and MPL 2.0 for any other licence the copy is under. If a copyright line or a licence text can’t be found, the entry says what to copy in, and notice lists what’s left to finish by hand:

finish by hand: example.net/mplcache: copyright line not known, copy it from the source
finish by hand: leftpadx 1.0.4: copyright line not known, copy it from the source

In the sample shop, neither leftpadx nor mplcache has a copyright line anywhere, so both entries wait for one. For leftpadx you’d write in its authors’ line. mplcache’s files carry only the MPL notice, so its entry says that instead.

Step 3: Check Again

The next check finds the new entries and moves those findings to attributed. An entry that still says what to copy in doesn’t count yet, and the finding says so: “Its entry in the notices isn’t finished: fill in what it says to copy there.” Once both entries are finished, the check passes. A copy that also needs a person’s look, like the shop’s MPL 2.0 cache, then moves to review instead of attributed: its notice is in place, and the rest is a judgement call. Running notice again adds nothing, because entries the file already has are skipped. Without --out, notice prints the entries instead, if you keep your notices somewhere else.

The whole loop on the sample shop, as recorded, is in notice-loop.txt.

What a Notice Can’t Fix

Notices only help where the licence’s terms are attribution. A GPL function in an MIT product is still a conflict after it’s credited, and code with no licence still has no permission behind it. notice skips those and says why, and they stay in the report until the code changes. That’s why the loop above checks with --fail-on attribution-missing: a plain check on the sample shop still fails on its two conflicts and its copy with no licence.