I found an interesting dilemma while working on an open-source project. My asking about possible solutions on Stack Overflow and the LinkedIn Q&A Software Development category didn’t yield any good answers, so had to do some research to find the solution.
But what was the problem?
First of all, the open-source product has two different distributions: downloadable binaries for end users and a source code repository for developers and contributors (and end users who want to peek at the source code!). The repository contains the production code, which compiles into those binaries, and — because it was written in the modern clean-code, TDD manner — a bunch of automated tests. The tests have dependencies on third-party tools. The problem is, can we include those tools in the repository? Is their license text required, no, is it even legal? What is the common practice?
It turned out not many people know the answer or understand this kind of stuff – just read the answers I got.
Before I reveal the correct answer, why do I want to check in those tools? I want to send a message that tests matter and this is how we do things here. At the same time, I want it to be very easy for the potential contributors to check out the code and run tests right away! I don’t them to worry whether they should download NUnit version 2.2.8, 2.4.7 or 2.5.2.
OK, the correct answer: based on my analysis, here, the common practice is to check in such dependencies. A copy of the license must be included if the third-party product’s license requires it. I learned along the way that the Apache license has such a requirement, while zlib and the New BSD License(a. k. a. the “three-clause BSD) do not.