To generate a third party notices file, list every component that ships, fetch each one's actual license text, add any Apache NOTICE content, group everything by component, include the file in your release, and rerun the process whenever dependencies change. Automating it in CI keeps it accurate.
Step 1: Scope what ships
Start from the built artifact, not the repository. A web bundle, a container image and a mobile app each contain a different set of components. Direct and transitive dependencies both count.
Step 2: Produce the component list
Generate an SBOM or a license report from the lockfile or build output. You want name, exact version and detected license for each.
Step 3: Fetch the real texts
For each component, take the license file from the package contents. Do not use a generic text from a template. The MIT and BSD texts carry a copyright line that differs per project, and the license itself says that notice must be included.
Step 4: Add NOTICE content
For Apache 2.0 components that include a NOTICE file, copy its attribution text. The license says the attributions must be carried in a NOTICE file, in documentation, or in a display your software generates.
Step 5: Assemble
A simple layout works:
Component: example-lib 2.4.1
License: MIT
Copyright (c) the project authors
<full license text>
---
Component: other-lib 1.0.0
License: Apache-2.0
<full license text>
NOTICE:
<attribution text>
Keep one block per component. Sort by name so diffs are readable.
Step 6: Ship and regenerate
Place the file in the release artifact or surface it in an about page. Add a CI job that regenerates it and fails the build if the committed file is out of date. Dependency updates can change texts and years.
Gaps to look for
| Gap | How to catch it |
|---|---|
| Unknown license on a component | The generator should fail, not skip |
| Component with no license file in the package | Open the source repo and record where the text came from |
| Vendored code | Add it by hand, scanners may miss it |
| Dual licensed package | Record the license you chose |
A generated file is only as good as the inputs. Read a sample by hand each release.
This is a process guide and not legal advice.
Quick check
Is a list of license names enough?
No. The licenses ask for notice and license text to be included, so names alone usually fall short.
Should the file include dev tools?
Only what is in the distributed artifact. Scope from the build output.
Safeguard's SBOM and dependency scanning provides the component list for step two, and you can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
