We are developing a closed-source proprietary product that uses quite a few open source projects and we have not been methodically cataloging them, along with their licenses. Now we are trying to build a deployment package and we’d like to get into compliance. What’s the easiest way to accomplish this?
Should we make one big text file with all the license information or should it be separate files for each open source project or each license? Do we have to include the actual file that came with the project? Does it have to be in the same directory as the project’s files?
I was thinking of a simpler approach but I’m not sure if it complies. What if we just identified all the different licenses (not projects) and make up one big text file with all the license verbiage for each one, and at the top say something like “Product XYZ is proprietary software which incorporates open source software that is covered by the following licenses.” (The individual open source projects would not be identified by name).
Or alternatively, the same as above, except identifying each project by name, along with their license, but all in 1 file?
Talk to a lawyer.
You can start by gathering license information for each package that you use and reading them. Many licenses (Boost license) are quite clear and permissive while others (GPLv3) are not so clear. Most of the time an attribution in your documentation will suffice. If you are distributing source, then you will likely need to distribute each license file along with either the source of each package or a reference to where it can be downloaded.
In any case, read the licenses and then talk to a lawyer.