On 1/25/16, 6:19 PM, "Todd Lipcon" <t...@apache.org> wrote:
>Hey folks, > >I'm working on tidying up the source for Apache Kudu (incubating) in order >to prepare for our first ASF release, and ran into a couple bits of >confusion: > >1) In the case that we've borrowed code from another Apache 2.0 licensed >project, the licensing howto[1] says that there is no need to modify >LICENSE unless it transitively has dependencies with such a requirement. >Is >this true even if the original dependency carries a copyright? For >example, >we bundle Twitter's Bootstrap library and currently have attribution in >our >LICENSE file[2] indicating the copyright (even though it's also at the top >of the relevant files). Not necessary? We can just entirely ignore such >dependencies in LICENSE and NOTICE so long as the original header's >maintained? In this email [4], Sebb recommends mentioning non-ASF Apache-licensed bundled dependencies in LICENSE. So that's what I've been doing with LICENSEs for release I manage. I'm not a fan of including text of the licenses, I prefer the "pointer" text as mentioned in [1]. IOW: "This product bundles SuperWidget 1.2.3, which is available under a "3-clause BSD" license. For details, see deps/superwidget/." > >2) In other cases we've bundled MIT or BSD-licensed source. The license >says that redistributions must retain the text of the license. Is it >sufficient that that text be only in the source code, or should we also >duplicate it into LICENSE.txt as we've done for code derived from >AsyncHBase? [3] Again, I prefer "pointer text" vs copying entire licenses, but AIUI, MIT and BSD bundled dependencies must be mentioned in LICENSE. > >3) We have many thirdparty dependencies which are not "bundled" in the >source release. Instead, our build process has a script which downloads >them from the internet, unpacks, and compiles them. So, despite not being >part of the artifact itself, they are required components for the build >(and in most cases become static-linked into the binary). We currently >list >all of these dependencies and their licenses in LICENSE.txt. Is this >necessary, or should we move these into a separate file? AIUI, only bundled dependencies should be mentioned in LICENSE, so non-bundled dependencies should not be mentioned in LICENSE. In releases I manage, I put mention of those non-bundled dependencies in the README. The reason I prefer pointers is that I like keeping this file short so folks can read it more easily/quickly. The text of these licenses are easy to find elsewhere. In my simple mental model, the LICENSE is the list of suppliers. The ASF is one supplier, every other supplier in the package is mentioned. NOTICE is legal stuff required by that list of suppliers. README is for other stuff like the list of other external dependencies (e.g. "batteries not included", or "tools required to assemble this furniture") HTH, -Alex > >[1] http://www.apache.org/dev/licensing-howto >[2] >https://git1-us-west.apache.org/repos/asf?p=incubator-kudu.git;a=blob;f=LI >CENSE.txt;h=347de4f88b5e6240f6e560b2b1208364d6042c55;hb=HEAD#l424 >[3] >https://git1-us-west.apache.org/repos/asf?p=incubator-kudu.git;a=blob;f=LI >CENSE.txt;h=347de4f88b5e6240f6e560b2b1208364d6042c55;hb=HEAD#l553 [4] http://s.apache.org/qDa
