Rework of binary distribution licenses #888
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,6 @@ | ||
| Apache BookKeeper | ||
| Copyright 2011-2018 The Apache Software Foundation | ||
|
|
||
| This product includes software developed at | ||
| The Apache Software Foundation (http://www.apache.org/). | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,55 +1,124 @@ | ||
| Apache BookKeeper | ||
| Copyright 2011-2018 The Apache Software Foundation | ||
|
|
||
| This product includes software developed at | ||
| The Apache Software Foundation (http://www.apache.org/). | ||
|
|
||
| ------------------------------------------------------------------------------------ | ||
| - lib/io.dropwizard.metrics-metrics-core-3.1.0.jar | ||
|
Member
There was a problem hiding this comment. It is okay and enough to keep versioning in LICENSE. However I would suggest removing versioning from NOTICE file: 1) versioning is not legally required in NOTICE. 2) NOTICE as short as possible as it will affect downstream projects. this is going to cause NOTICE updates everytime we bumped version.
Contributor
Author
There was a problem hiding this comment. the versions are there to facilitate automated checking. if we remove the versions we can't ensure that what is in the notice file exists in the shipped tarball. It will need to be checked manually, so more chance of a -1 on a release candidate. Also, notices can change between version, so the rationale for having them in the LICENSE holds for the NOTICE also.
Member
There was a problem hiding this comment. I know notices can change between version. my point is most of the dependencies are having versioning references in LICENSE, which automated checking will fail the a dependency change if the versioning is not updated. automated checking does its job on license/versioning and the contributors/reviewers should check both license/notice on reviewing it. automated checking on LICENSE is enough for capturing this. The reason I would suggest removing versions from NOTICE, as the ASF polices suggest and the practices that people have, is to avoid unnecessary changes to NOTICE as possible, keep it as brief as possible, and avoid impacting downstream projects as little as possible.
Contributor
Author
There was a problem hiding this comment. People will do the bare minimum to make their builds pass. If there are no versions in the NOTICE, they won't touch the notice, and we'll end up with -1 on release candidates. This notice should have no effect on downstream projects. Downstream depend on our maven jar, not our binary tarballs, which is covered by the top level NOTICE. |
||
| - lib/io.dropwizard.metrics-metrics-graphite-3.1.0.jar | ||
| - lib/io.dropwizard.metrics-metrics-jvm-3.1.0.jar | ||
|
|
||
| Metrics | ||
| Copyright 2010-2013 Coda Hale and Yammer, Inc. | ||
|
|
||
| This product includes software developed by Coda Hale and Yammer, Inc. | ||
|
|
||
| This product includes code derived from the JSR-166 project (ThreadLocalRandom, Striped64, | ||
| LongAdder), which was released with the following comments: | ||
|
|
||
| Written by Doug Lea with assistance from members of JCP JSR-166 | ||
| Expert Group and released to the public domain, as explained at | ||
| http://creativecommons.org/publicdomain/zero/1.0/ | ||
| ------------------------------------------------------------------------------------ | ||
| - lib/io.netty-netty-3.10.1.Final.jar | ||
|
|
||
| The Netty Project | ||
| ================= | ||
|
|
||
| Please visit the Netty web site for more information: | ||
|
|
||
| * http://netty.io/ | ||
|
|
||
| Copyright 2011 The Netty Project | ||
|
|
||
| The Netty Project licenses this file to you under the Apache License, | ||
| version 2.0 (the "License"); you may not use this file except in compliance | ||
| with the License. You may obtain a copy of the License at: | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| License for the specific language governing permissions and limitations | ||
| under the License. | ||
|
|
||
| ------------------------------------------------------------------------------------ | ||
| - lib/io.netty-netty-all-4.1.12.Final.jar | ||
|
|
||
| The Netty Project | ||
| ================= | ||
|
|
||
| Please visit the Netty web site for more information: | ||
|
|
||
| * http://netty.io/ | ||
|
|
||
| Copyright 2014 The Netty Project | ||
|
|
||
| The Netty Project licenses this file to you under the Apache License, | ||
| version 2.0 (the "License"); you may not use this file except in compliance | ||
| with the License. You may obtain a copy of the License at: | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| License for the specific language governing permissions and limitations | ||
| under the License. | ||
|
|
||
| ------------------------------------------------------------------------------------ | ||
| - lib/io.prometheus-simpleclient-0.0.21.jar | ||
| - lib/io.prometheus-simpleclient_common-0.0.21.jar | ||
| - lib/io.prometheus-simpleclient_hotspot-0.0.21.jar | ||
| - lib/io.prometheus-simpleclient_servlet-0.0.21.jar | ||
|
|
||
| Prometheus instrumentation library for JVM applications | ||
| Copyright 2012-2015 The Prometheus Authors | ||
|
|
||
| This product includes software developed at | ||
| Boxever Ltd. (http://www.boxever.com/). | ||
|
|
||
| This product includes software developed at | ||
| SoundCloud Ltd. (http://soundcloud.com/). | ||
|
|
||
| This product includes software developed as part of the | ||
| Ocelli project by Netflix Inc. (https://github.com/Netflix/ocelli/). | ||
| ------------------------------------------------------------------------------------ | ||
| - lib/org.eclipse.jetty-jetty-http-9.4.5.v20170502.jar | ||
| - lib/org.eclipse.jetty-jetty-io-9.4.5.v20170502.jar | ||
| - lib/org.eclipse.jetty-jetty-security-9.4.5.v20170502.jar | ||
| - lib/org.eclipse.jetty-jetty-server-9.4.5.v20170502.jar | ||
| - lib/org.eclipse.jetty-jetty-servlet-9.4.5.v20170502.jar | ||
| - lib/org.eclipse.jetty-jetty-util-9.4.5.v20170502.jar | ||
|
|
||
| ============================================================== | ||
| Jetty Web Container | ||
| Copyright 1995-2017 Mort Bay Consulting Pty Ltd. | ||
| ============================================================== | ||
|
|
||
| The Jetty Web Container is Copyright Mort Bay Consulting Pty Ltd | ||
| unless otherwise noted. | ||
|
|
||
| Jetty is dual licensed under both | ||
|
|
||
| * The Apache 2.0 License | ||
| http://www.apache.org/licenses/LICENSE-2.0.html | ||
|
|
||
| and | ||
|
|
||
| * The Eclipse Public 1.0 License | ||
| http://www.eclipse.org/legal/epl-v10.html | ||
|
|
||
| Jetty may be distributed under either license. | ||
|
|
||
| lib/org.eclipse.jetty-jetty-util-9.4.5.v20170502.jar bundles UnixCrypt | ||
|
|
||
| The UnixCrypt.java code implements the one way cryptography used by | ||
| Unix systems for simple password protection. Copyright 1996 Aki Yoshida, | ||
| modified April 2001 by Iris Van den Broeke, Daniel Deville. | ||
| Permission to use, copy, modify and distribute UnixCrypt | ||
| for non-commercial or commercial purposes and without fee is | ||
| granted provided that the copyright notice appears in all copies. | ||
| ------------------------------------------------------------------------------------ | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,43 +1,84 @@ | ||
| Apache BookKeeper | ||
| Copyright 2011-2018 The Apache Software Foundation | ||
|
|
||
| This product includes software developed at | ||
| The Apache Software Foundation (http://www.apache.org/). | ||
|
|
||
| ------------------------------------------------------------------------------------ | ||
| - lib/io.netty-netty-all-4.1.12.Final.jar | ||
|
|
||
| The Netty Project | ||
| ================= | ||
|
|
||
| Please visit the Netty web site for more information: | ||
|
|
||
| * http://netty.io/ | ||
|
|
||
| Copyright 2014 The Netty Project | ||
|
|
||
| The Netty Project licenses this file to you under the Apache License, | ||
| version 2.0 (the "License"); you may not use this file except in compliance | ||
| with the License. You may obtain a copy of the License at: | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| License for the specific language governing permissions and limitations | ||
| under the License. | ||
|
|
||
| ------------------------------------------------------------------------------------ | ||
| - lib/io.prometheus-simpleclient-0.0.21.jar | ||
| - lib/io.prometheus-simpleclient_common-0.0.21.jar | ||
| - lib/io.prometheus-simpleclient_hotspot-0.0.21.jar | ||
| - lib/io.prometheus-simpleclient_servlet-0.0.21.jar | ||
|
|
||
| Prometheus instrumentation library for JVM applications | ||
| Copyright 2012-2015 The Prometheus Authors | ||
|
|
||
| This product includes software developed at | ||
| Boxever Ltd. (http://www.boxever.com/). | ||
|
|
||
| This product includes software developed at | ||
| SoundCloud Ltd. (http://soundcloud.com/). | ||
|
|
||
| This product includes software developed as part of the | ||
| Ocelli project by Netflix Inc. (https://github.com/Netflix/ocelli/). | ||
| ------------------------------------------------------------------------------------ | ||
| - lib/org.eclipse.jetty-jetty-http-9.4.5.v20170502.jar | ||
| - lib/org.eclipse.jetty-jetty-io-9.4.5.v20170502.jar | ||
| - lib/org.eclipse.jetty-jetty-security-9.4.5.v20170502.jar | ||
| - lib/org.eclipse.jetty-jetty-server-9.4.5.v20170502.jar | ||
| - lib/org.eclipse.jetty-jetty-servlet-9.4.5.v20170502.jar | ||
| - lib/org.eclipse.jetty-jetty-util-9.4.5.v20170502.jar | ||
|
|
||
| ============================================================== | ||
| Jetty Web Container | ||
| Copyright 1995-2017 Mort Bay Consulting Pty Ltd. | ||
| ============================================================== | ||
|
|
||
| The Jetty Web Container is Copyright Mort Bay Consulting Pty Ltd | ||
| unless otherwise noted. | ||
|
|
||
| Jetty is dual licensed under both | ||
|
|
||
| * The Apache 2.0 License | ||
| http://www.apache.org/licenses/LICENSE-2.0.html | ||
|
|
||
| and | ||
|
|
||
| * The Eclipse Public 1.0 License | ||
| http://www.eclipse.org/legal/epl-v10.html | ||
|
|
||
| Jetty may be distributed under either license. | ||
|
|
||
| lib/org.eclipse.jetty-jetty-util-9.4.5.v20170502.jar bundles UnixCrypt | ||
|
|
||
| The UnixCrypt.java code implements the one way cryptography used by | ||
| Unix systems for simple password protection. Copyright 1996 Aki Yoshida, | ||
| modified April 2001 by Iris Van den Broeke, Daniel Deville. | ||
| Permission to use, copy, modify and distribute UnixCrypt | ||
| for non-commercial or commercial purposes and without fee is | ||
| granted provided that the copyright notice appears in all copies. | ||
| ------------------------------------------------------------------------------------ |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we should not maintain the 3rdparty license. we should only attach the needed notice and license that is required into NOTICE or LICENSE file. maintaining this directory makes things complicated. we should avoid it.
The check script should parse pom files or the assemble tarballs to see what dependencies are included, and fetch their corresponding notices and verify if the NOTICE file includes all dependencies or not and if their licenses are matched and notices are attached.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've moved all the NOTICE stuff into the NOTICE, so that doesn't link anywhere.
The ASF licensing recommendations (http://www.apache.org/dev/licensing-howto.html#permissive-deps) actually say to bundle the license file, instead of putting directly in the LICENSE file unless the license is very short. I actually prefer it like this.
https://github.com/ivankelly/bookkeeper/blob/license-rework/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt is easier to read than https://github.com/apache/bookkeeper/blob/master/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt.
LICENSE-all.bin.txt would get huge if we flattened them all. I'm particularly eager to keep the CDDL out of it, that license is huge.
We should check on the final output (i.e. the assemble tarball) as that is what we distribute.
This verification is very hard to do in an automated fashion. How will a machine know that the protobuf license contains stuff that isn't relevant? How will it work out which part of the netty NOTICE needs to be pulled in and which doesn't?
It's not hard for a human, but the human will need guidelines which we should put in the wiki.
I've added a check to the script to check if the bundled license files are linked, and ensure all linked files exist.