When you redistribute Apache 2.0 licensed code, include a copy of the license, mark files you changed, keep existing notices in source, and carry over the attribution text from any NOTICE file. You may add your own notices and use different terms for your own changes.
What Section 4 requires
If you redistribute the Work or Derivative Works, you must:
- Include a copy of the License with what you distribute.
- Mark modified files with prominent notices stating that you changed them.
- Keep existing notices in the source form of any Derivative Works you distribute, including copyright, patent, trademark and attribution notices that apply to your distribution.
- Carry over NOTICE file attributions if the Work includes a NOTICE file. The attribution text must appear in at least one place: a NOTICE file with your distribution, the source or documentation, or a display where third party notices normally appear.
You may add your own attribution notices and copyright statement. You may also apply different license terms to your modifications or to the Derivative Works as a whole, as long as your use and distribution otherwise comply with the License. Your additions cannot modify the License itself.
The NOTICE file trap
Teams often ship the license and forget the NOTICE text. The requirement is about attribution text, not the whole file layout. If a dependency has a NOTICE file, its attribution lines need to appear somewhere users or recipients can find, such as an "open source notices" screen in your app or a file in your download.
When a product bundles many Apache licensed components, merge the NOTICE texts into one combined third party notices file.
A release day checklist
- List every Apache 2.0 component in the build, including transitive ones.
- For each, find the LICENSE and any NOTICE file in the source or package.
- Add the license text to your notices bundle, once per distinct license text.
- Copy NOTICE attribution text into the bundle or an in-app notices view.
- If you edited any component's files, add a clear "changed" notice in those files.
- Keep the original copyright and attribution lines in files you modified.
- Verify the bundle ships with the artifact customers receive, not only in the repository.
What counts as redistribution
Providing a downloadable app, a container image or a library to others is redistribution. Running software only on your own servers is a different situation. Check your own obligations for hosted use with counsel, since the section quoted here is about redistribution.
Automating the list
Hand maintained notices files go stale. Generate them from your inventory at build time, and fail the build if a component has no license text. For more on checking license obligations, see what you need to ship for MIT attribution and Apache License 2.0 explained.
Safeguard's SBOM and dependency scanning supply the component list that notices are built from, and you can try a free scan.
Quick check
Do I need to ship a NOTICE file if the dependency has none?
No NOTICE attribution is required in that case. You still include the license copy.
Can I license my changes under different terms?
Yes, as the license allows, provided your use and distribution still comply with its conditions.
Sources
Last reviewed: 19 October 2026.
