> > There are two aspects to this. > > 1) Does the artifact actually included the 3rd party code? > If not, then it should not be mentioned at all. >
it does not include the 3rd party source code, only the binary artifact - and it has to be mentioned because, as reported in their license, > "2. Redistributions in binary form must reproduce the above copyright > notice, this list of conditions and the following disclaimer in the > documentation and/or other materials provided with the distribution." > > where "the above copyright notice" is > > Copyright (c) 2000-2011 INRIA, France Telecom > All rights reserved. what is actually missing, is the disclaimer > 2) If the artifact does *include* the code, then the LICENSE must be > included, and if the license says so, there must be a mention in the > NOTICE file. > > Every mention in the NOTICE file should have a corresponding entry in > the LICENSE file; not every license requires a mention in the NOTICE > file. > > In this case, there need to be two sets of N&L files - one for the > shaded jar, which mention the additional included components, and > another for the rest, which are presumably ASF code only. > > Looks like it would be easy enough to include specific N&L files in > the shaded jar; if not, maybe use a separate Maven module to do the > shading and hold the N&L files? > separate maven module? no thank you, that would be insane, it is a large amount of unnecessary work. 1000 times better dropping the über jar and make everybody happy instead. >>> >>> Ideally the LICENSE file should also state that AL 2.0 applies to CGLIB. >>> >> >> isn't it more enough mention 3rd parties in the NOTICE file? > > No, LICENSES are also needed. > can be easily achieved > > I mean, after the AL license, one can put: > > APACHE COMMONS DIGESTER SUBCOMPONENTS: > > The Apache Commons Digester with-deps jar ncludes a number of subcomponents > with > separate copyright notices and license terms. Your use of the source > code for the these subcomponents is subject to the terms and > conditions of the following licenses. > > For the CGLIB component (http://cglib.sourceforge.net/) > This is licensed under the AL 2.0, see above > > For the ASM component (http://asm.ow2.org/): > [include the license here] > > See for example: > > http://svn.apache.org/repos/asf/httpd/httpd/trunk/LICENSE > that would be a good compromise, I'll write to legal@ anyway because at that point I want to understand all that legal stuff -Simo http://people.apache.org/~simonetripodi/ http://simonetripodi.livejournal.com/ http://twitter.com/simonetripodi http://www.99soft.org/ --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail: dev-h...@commons.apache.org
