Generate a third-party notices file by taking your dependency inventory, collecting each component's license text, copyright lines and any NOTICE content, grouping identical texts, failing the build on gaps, and shipping the result with your product. Run it in CI at release time so the file always matches the artifact.
Why a generated file beats a hand edited one
Most permissive licenses require you to keep the notice when you redistribute. Apache 2.0 goes further: you must pass along a copy of the license, keep attribution notices, and carry the content of any NOTICE file. A hand edited file drifts from the real dependency set within weeks. A generated one is rebuilt from the same lockfile that built your release.
Pipeline steps
- Resolve the full dependency set from the lockfile, including transitive packages.
- For each package, fetch the license text and copyright notice from the package contents, not from a web page that may change.
- Collect NOTICE files for Apache 2.0 components.
- Group packages that share identical license text so the file stays readable.
- Fail the job when a package has no license text, an unknown license, or an unresolved expression.
- Publish the file next to the release artifact and store it with the build.
| Input | Source | Failure to catch |
|---|---|---|
| Package list | Lockfile | Missing transitive packages |
| License text | Package tarball | Text absent or edited |
| NOTICE content | Package tarball | Apache component without NOTICE capture |
| Expression | Package metadata | Unparsed AND or WITH |
What the file is not
It is not a security artifact and it does not replace your SBOM. It answers a legal question: what must a recipient be told? Your SBOM answers: what is in this software? Generate both from the same inventory so they agree. The REUSE specification is useful for your own code, since it asks for a license identifier and copyright line in each file plus a licenses directory with one text per license used.
Where it goes
For a web app, a page linked from the footer or about screen. For a mobile app, a screen in settings. For a binary download, a file in the archive. A fonts or assets section belongs here too, since those carry their own terms.
Try it yourself
Click through it at your own pace, or open it full screen.
Browse the inventory and imagine each row becoming one entry in a notices file.
Safeguard generates SBOMs from your dependencies, which gives you the inventory to build notices from. Try a free scan.
Quick check
Is a notices file the same as an SBOM?
No. The notices file carries legal text for recipients. The SBOM describes components for security and compliance use.
How often should it be regenerated?
At every release build, from the same lockfile as the release.
Sources
- Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
- REUSE Specification 3.3: https://reuse.software/spec-3.3/
Last reviewed: 19 October 2026.
