How to use maven to generate 3rd party dependency license documentation

Question

I am working on an open source project that will ship as a binary. I want to include an "About" page in the program that includes information about all 3rd party libraries and licenses used by my project.

This question discusses about best practices:

What is the best practice for arranging third-party library licenses "paperwork"?

Other questions discuss about how to update source files with license notice. Neither of these addresses my question.

I want to use the dependency information in Maven to generate the LICENSE-3RD-PARTY.txt described in the above linked question. Specifically, I want it to create a single text file that includes:

• Library name
• URL
• LICENSE name
• License URL
• Full License Text

The above should be included in this file for all dependencies and transitive dependencies in the pom.xml. An HTML output or json/xml parsable version of this would be acceptable as well.

The command 'mvn project-info-reports:dependencies' produces something similar to what I'm asking for but it's got way too data to actually include in a binary and show to an end user on an about page.

Good examples of what I'm trying to achieve are the chrome://credits/ page in Chrome or the 'about:license' page in Firefox. Though I'm more hoping for a text-only version the simple html of these examples would also work.

It seems like this would be a common requirement, but I've had no luck searching for how to achieve this with maven.

Answer 1

This plugin is what I was looking for:

https://github.com/jinnovations/attribution-maven-plugin

It creates a parsable xml file that can be used from within an application to show an about/contributions page.

It also handles pom config settings that can mark the license used by dependencies that don't declare their own license in their own pom, as Jules answer suggests many are missing, but enough are present to make this a worthwhile approach.

Answer 2

My unscientific survey with small sample size (10) suggests that only around 60% of projects in maven central have licenses defined in their POM file. While most of the big name projects do, a lot of the smaller specialised ones don't. So unless you're only using popular projects, it is unlikely that automation here will work. It might reduce your work, but honestly I suspect searching your project's jar files for files named Copying, License or similar is likely to be more effective.