At work, we're deploying a software bundle of a Java application (written by us) which has lots of external dependencies, most of them being LGPL and BSD-licensed third-party-libraries distributes as JAR archives.
Currently, we're deploying a test-client of the software which is distributed as a single java fat jar archive, created by the Maven assembly plugin, which does roughly the following:
- extract all dependencies
- rebundle them as a single jar-archive
All class files are extracted, and then bundled back into a single JAR file with our own application. I realized that also some files get overwritten, mostly LICENSE.txt-files, due to having the same name.
I'm wondering whether this is correct and complies with the LGPL license. What would be a better way to distribute the software? How would this particular package be best organized?
We did not incorporate any source code directly into our source files, nor did we touch the binary files. The source code of the libraries accompanies the whole product. (It is software that is internally used, not deployed to customers or anything, but I guess that does not matter.)
PS: I asked the same question on Stack Overflow, and I was suggested to ask it here.
Best Answer
Since you're using Maven, I recommend switching to the shade plugin to build your JAR. It can be configured to automatically handle multiple "standard" license files (see the section on resource transformers), and will warn you if your dependencies have overlapping classes.