Skip to main content
SourceTrustSign in

Help center

Guides for SourceTrust: Importing dependencies, reviewing licenses, external obligations, publishing attestation pages, billing, plain-language license explainers, and procurement-oriented explainers for common open-source licenses.

Review NOTICE duties if you distribute this package

← All articles

For Apache-2.0 code you actually distribute, preserve relevant upstream NOTICE content when supplied. A dependency listing alone does not show that the code or NOTICE travels with your product.

Read about Apache-2.0 notice requirements

If you redistribute this package with relevant upstream NOTICE content, preserve that content in a permitted delivery location. Otherwise, acknowledge after confirming that this trigger does not apply.

When this review appears

Shown for Apache-2.0 in Distributed binary, Library or SDK, and Mixed. The NOTICE duty depends on actual redistribution and relevant upstream NOTICE content.

Before you acknowledge

  1. Check whether you distribute this package, including inside a bundled SDK, and whether upstream supplies relevant NOTICE content.
  2. Where required, include the relevant notices in a distributed NOTICE file, accompanying source or documentation, or a display where third-party notices normally appear. The attestation page alone may not meet this requirement.
  3. Follow the other Apache distribution terms, including license inclusion, retained notices and notices of changed files. Acknowledge once the applicable duties are met, or after confirming no redistribution or relevant upstream NOTICE.

This checkbox appears because of the license and project context, not because SourceTrust has proved that the package is redistributed or includes NOTICE. If no relevant upstream NOTICE exists, this NOTICE trigger does not apply, although the other Apache terms still do. Review the files that actually accompany your release before acknowledging.