Thank you, Marvin. This is very valuable, especially the way you walked through your thought process. We'll try to apply the same logic for our other bundled dependencies in our binary distribution with our next RC.
Cheers, James On Thu, Mar 27, 2014 at 8:30 PM, Marvin Humphrey <mar...@rectangular.com>wrote: > On Wed, Mar 26, 2014 at 6:06 PM, James Taylor <jamestay...@apache.org> > wrote: > > The copyright for the bits we're bundling. See the LICENSE file I > included > > at the end of my email. For example: > > > > Guava, version 12.0.1, http://code.google.com/p/guava-libraries/ > > Copyright 2008 Google Inc. > > > > Is that the correct way to include the Copyright? Or is this not > required? > > First, I had to do some recon on Guava. > > * The repo at <https://code.google.com/p/guava-libraries/source/browse/> > has a file at the top level called `COPYING` which contains the ALv2. > * Guava source releases 12.0.1 and the current 16.0.1 do not include the > file `COPYING`. Individual source files have headers as spec'd at the > end of the ALv2 (which is slightly different from the ASF's headers). > These have Google copyright notices as above. > * Guava binary releases contain no licensing info in `META-INF` -- no > `COPYING`, no `LICENSE`, no `NOTICE`. > > With that information available, I can now answer your question: > > The copyright information in the license headers of Guava source files does > not need to be propagated into the top-level licensing files for Apache > Phoenix for either source or binary redistributions. For source > redistributions, the ALv2 is satisfied by retaining such copyright notices > in > the original dependency source files. The relevant clause is 4c: > > http://www.apache.org/licenses/LICENSE-2.0.html#redistribution > > c. You must retain, in the Source form of any Derivative Works that > You > distribute, all copyright, patent, trademark, and attribution > notices > from the Source form of the Work, excluding those notices that do > not > pertain to any part of the Derivative Works; and > > Had the copyright notice been in a file called `NOTICE`, however, then it > would have been required to propagate it per clause 4d of the ALv2 > for **both** source and binary redistributions. > > d. If the Work includes a "NOTICE" text file as part of its > distribution, > then any Derivative Works that You distribute must include a > readable > copy of the attribution notices contained within such NOTICE file, > excluding those notices that do not pertain to any part of the > Derivative Works, in at least one of the following places: within a > NOTICE text file distributed as part of the Derivative Works; > within > the Source form or documentation, if provided along with the > Derivative Works; or, within a display generated by the Derivative > Works, if and wherever such third-party notices normally appear. > [...] > > But since Guava provides no NOTICE file, you don't need to worry about > that. > > > Also, how do I know if something is a "required attributions"? > > Whether there are "required attributions" which must be propagated into > LICENSE or NOTICE depends on the license of the dependency, and also > whether > the redistribution is source or binary. > > This is a complicated question, and we ultimately ought to compose and > maintain a table as suggested at <http://s.apache.org/Et4>. > > For ALv2 dependencies, see analysis of section 4 above. > > For source redistributions, the MIT, 2-clause BSD, and 3-clause BSD > licenses > are all satisfied by retaining the license text and copyright notice > embedded > in each dependency source file. > > Unfortunately, the ASF does not provide solid guidance with regards to > binary > redistributions bundling MIT, 2-clause BSD and 3-clause BSD dependencies. > My > layperson's read of the BSD licenses is that since the source files are no > longer present, the entire license would need to be propagated *somewhere* > and > that either LICENSE or NOTICE inside META-INF would do. > > http://opensource.org/licenses/BSD-3-Clause > > 2. Redistributions in binary form must reproduce the above copyright > notice, this list of conditions and the following disclaimer in the > documentation and/or other materials provided with the > distribution. > > Note that any binaries you produce as RM are your own responsibility. > IANAL, > the PMC vote only applies to the source artifacts, and only the source > release > is an act of the Foundation. > > Nevertheless, it might make sense for us to ask ASF Legal Affairs to start > maintaining non-binding best-practice guidance on how to compose licensing > documentation for binary redistributions. > > Marvin Humphrey > > --------------------------------------------------------------------- > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > >
