Legal requirements for an Single Executable App (SEA)

[awjreynolds]

For an application to be distributed using SEA my assumption is that any binary supplied will come with the following files:

1. Application LICENSE (includes Application (npm) THIRD PARTY LICENSES)
2. NodeJS LICENSE (which includes 3rd Party Licenses) https://github.com/nodejs/node/blob/main/LICENSE

There is no requirement to provide NodeJS source code download?

Will the SEA builder generate the set of documents required for legal compliance? I can see this being something not a lot of people are across.

[ovflowd]

A SEA doesn't come with npm, or with Node.js, so there's no need to have Node.js or npm licenses. Also, a SEA binary doesn't come with Node.js's sources or anything from Node.js.

Your binary is pretty much just your JavaScript code in compiled WASM. (Correct me if I'm wrong, @RaisinTen)

[awjreynolds]

Sorry. Should have been clearer. A Node.JS app will consist of the (free/commercial) Application license and which should also include the licenses of all the packages used to build the application sourced from npmjs.org (e.g. lodash, react, etc). I usually separate these into two files.

So to legally distribute an SEA app I will need to provide the Application license, Application 3rd Party licenses, and the NodeJS license (which includes all of its 3rd Party Licenses).

If I tell node to generate an executable it should give me a binary, the NODEJS_LICENSE, and a LICENSE placeholder file although ideally it would be good for the blob generation process to auto generate a 3RD PARTY LICENSE file.

[ovflowd]

I see. Now I got what you meant. Sorry for the confusion!

Yup, I see the reasoning here; we could add a CLI option to generate the LICENSE files for you. But theoretically I'd say it's up to you to add the LICENSES (We could at least add some guidelines)

[awjreynolds]

I think if the SEA generation also outputs the NodeJS LICENCE file then I think you've done all you can. You could simply print a warning on the command prompt that SEAs are required to be distributed with the NodeJS LICENCE and typically the application's license including application third party package licenses. One way or another you are covered then.

Hope this all makes sense if rather a dry subject!

[RaisinTen]

An SEA is basically the Node.js binary + the blob contents (which contains your bundled source code along with some extra bytes). So since the Node.js binary is used as the base binary, legally at least, you might want to distribute the Node.js license too with your SEA.

Will the SEA builder generate the set of documents required for legal compliance?

Could you clarify which tool you are referring to when you say "SEA builder" because we don't have a single tool as a complete solutions for SEAs yet (although there's an open issue for it - #49)?

If you're referring to the SEA blob generator - node --experimental-sea-config, it doesn't look like generating this document falls within the scope of this tool because all it does is generate the blob that can be injected into the Node.js binary for building the SEA.

And if you're referring to postject, the tool is supposed to be able to inject an arbitrary file into a specified section of any binary. Since SEA is just one use case of that tool, I don't think parsing license files falls into the scope of this tool either.