>> So, since build.xml has all the third-party components listed in the >> get-third-party-X functions (at the bottom-ish of the file) we can >> conclude: >> >> I should add to the repository: NOTICE.src, NOTICE.bin, LICENSE.src, >> LICENSE.bin >> Then, during release-src, NOTICE.src and LICENSE.src get pulled in as >> NOTICE and LICENSE >> (Similarly for release-bin). >> >> With: >> NOTICE.src + LICENSE.src containing all the packages listed in >> get-third-party-codegen and get-third-party-test >> and >> NOTICE.bin + LICENSE.bin containing all the packages listed in >> get-third-party-runtime >> >> Does that make sense? > > Makes sense to me.
Looking over https://www.apache.org/dev/licensing-howto.html, I don't think this is correct. This states "Dependencies which are not included in the distribution MUST NOT be added to LICENSE and NOTICE.". Part of the work in my tree, was moving _all_ jar's out-of-tree. So, the third_party folder is no longer shipped with the releases, but automatically generated by 'ant get-third-party'. As such, there actually exist very few items in the source release - only the code left in src/, test/ and some supporting files. A few of these sources require extra items in LICENSE.src and NOTICE.src, which are already accounted for in LICENSE and NOTICE. However, everything listed in get-third-party-codegen and get-third-party-test is not included in the source release, so by this documentation these "MUST NOT be added to LICENSE and NOTICE". For the binary release, everything in get-third-party-runtime is included inside the generated jar, so must be included in LICENSE.bin and NOTICE.bin. This means that everything in get-third-party-codegen and get-third-party-test are never listed anywhere. >> Also, for NOTICE.x, should every package [as detailed above] get >> mentioned, or should only packages whose license explicitly requires a >> notice, get put in there? > > Good question. I would think you should mention every package, required or > not. > First its just nice to give credits. Second, if some packages are missing > people > might start to think they have just missed. > > For the record, the IPMC might have different opinions. But I believe > we have very good arguments if we do it like that. Whilst I agree it would be nice to give people credit for their work, the linked documentation suggests that NOTICE is not the place for that. Perhaps a THANKS file? (Better names are open to suggestion) Ali
