I relicensed many of my projects on GitHub to use the BSD license a little over a year ago. They used to be under the MIT license because I started using GitHub when I was a Node user, and most projects in that ecosystem use the MIT license.

I switched because of this clause in the BSD license:

1. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

This means I should get credit whether my code is distributed in its original source code form or if it’s included in other software in binary form. It may be a little annoying to make sure these copyright notices are included with every binary, but considering how much work work goes into these projects I think it’s fair to require a small notice when they are used. I simply want credit for my work even if it’s not in source code form.

Go and dependency licenses

The Go project also uses a BSD license so every distributed Go binary should include the Go copyright notice. Because imports get added to Go binaries you also need to include copyright notices for any dependencies that use the BSD license. I think this is where things can get really complicated. Your dependencies may include other projects that are BSD licensed, and if you’re not careful you may forget to include the appropriate copyright notices when you distribute binaries.

If you’re familiar with npm you know that each module may require a ridiculous number of dependencies. Just look at what gets installed for the request module:

   ∂ tmp: npm install request
/private/tmp
└─┬ [email protected] 
  ├── [email protected] 
  ├─┬ [email protected] 
  │ └── [email protected] 
  ├─┬ [email protected] 
  │ └─┬ [email protected] 
  │   ├── [email protected] 
  │   ├── [email protected] 
  │   ├── [email protected] 
  │   ├── [email protected] 
  │   ├── [email protected] 
  │   └── [email protected] 
  ├── [email protected] 
  ├─┬ [email protected] 
  │ └── [email protected] 
  ├── [email protected] 
  ├── [email protected] 
  ├─┬ [email protected] 
  │ └── [email protected] 
  ├─┬ [email protected] 
  │ ├─┬ [email protected] 
  │ │ ├─┬ [email protected] 
  │ │ │ └── [email protected] 
  │ │ ├── [email protected] 
  │ │ ├─┬ [email protected] 
  │ │ │ └── [email protected] 
  │ │ ├── [email protected] 
  │ │ └── [email protected] 
  │ ├─┬ [email protected] 
  │ │ └── [email protected] 
  │ ├─┬ [email protected] 
  │ │ ├── [email protected] 
  │ │ ├─┬ [email protected] 
  │ │ │ └── [email protected] 
  │ │ ├── [email protected] 
  │ │ └── [email protected] 
  │ └─┬ [email protected] 
  │   └── [email protected] 
  ├─┬ [email protected] 
  │ ├── [email protected] 
  │ ├── [email protected] 
  │ ├── [email protected] 
  │ └── [email protected] 
  ├─┬ [email protected] 
  │ ├── [email protected] 
  │ ├─┬ [email protected] 
  │ │ ├── [email protected] 
  │ │ ├── [email protected] 
  │ │ └── [email protected] 
  │ └─┬ [email protected] 
  │   ├── [email protected] 
  │   ├─┬ [email protected] 
  │   │ └── [email protected] 
  │   ├── [email protected] 
  │   ├── [email protected] 
  │   ├── [email protected] 
  │   └── [email protected] 
  ├── [email protected] 
  ├── [email protected] 
  ├── [email protected] 
  ├─┬ [email protected] 
  │ └── [email protected] 
  ├── [email protected] 
  ├── [email protected] 
  ├── [email protected] 
  ├── [email protected] 
  ├── [email protected] 
  └── [email protected]

Imagine if these were Go packages and each one was BSD licensed. That’s a lot of copyright notices to include, and I wouldn’t be surprised if you didn’t include all of them!

I noticed that some Go projects don’t list the licenses of their dependencies. That makes it really hard for people to build and distribute binaries. Getting dependencies for a project may be as easy as running go get, and building a binary is another go build after that, but distributing that binary isn’t going to be as easy if any of those external packages use the BSD license and we don’t realize it.

I propose that each repository should include a full list of licenses and copyright notices based on what is used to generate a binary. It’s not that hard to do, makes things a lot better for downstream users, and gives people the credit they want.