daemon/sdnotify.go probably violates Apache license

[strikov-canonical]

Hi go-systemd team!

Many thanks for all the work you do!

I'm packaging go-systemd for Ubuntu (as part of the juju project).
We do license checks for all the code we package as part of our packaging pipeline.
It seems to me that one file in your repo violates requirements of the Apache-2.0 license.
Could you please help me to understand if it's true or not and (if so) fix the issue in your repo?

File in question: https://github.com/coreos/go-systemd/blob/master/daemon/sdnotify.go

File states that it is 'forked from Docker project' which is correct.
Original file from Docker project can be found here:
https://github.com/docker/docker/blob/master/pkg/systemd/sd_notify.go
In terms of Apache-2.0 license forked version of the file is called Derivative Work.

Docker project is licensed under Apache-2.0 license (as well as go-systemd project).
This license allows you to redistribute Derivative Works only if you obey the following rules:

(a) You must give any other recipients of the Work or Derivative Works a copy of this License;

While both projects are license under Apache-2.0 license, text is a bit different between the licenses.
Go-systemd license: https://github.com/coreos/go-systemd/blob/master/LICENSE
Docker license: https://github.com/docker/docker/blob/master/LICENSE
You may see that at least formatting of paragraph 4 is different. It means that you need to include Docker's license into your project (maybe put it inside daemon/ folder?)
and put a reference to it from sdnotify.go file.

(b) You must cause any modified files to carry prominent notices stating that You changed the files;

While 'forked from Docker project' looks okay in the sense of this requirement I'd recommend you to specify which exact file you've modified (link to Docker's github repo may work).

(c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices <...>

Docker's sd_notify.go file doesn't contain explicit copyright notices but they are available in Docker's LICENSE file:
https://github.com/docker/docker/blob/master/LICENSE#L179
You may find there: 'Copyright 2013-2015 Docker, Inc.'

This copyright information needs to be included into daemon/sdnotify.go.
You may add your own copyright notice (for your changes) but you shouldn't remove Docker's copyright.

(d) If the Work includes a "NOTICE" text file <...> then any Derivative Works <...> must include a readable copy of the attribution notices contained within such NOTICE file <...>

Docker project has such NOTICE file: https://github.com/docker/docker/blob/master/NOTICE
This file contains some valuable information and I'd recomment you to put it into daemon/ folder as well.
It may be linked from daemon/sd_notify.go as well as the LICENSE file.

Thanks A LOT for helping!
Oleg

[muesli]

It looks like Docker now directly depends on coreos/go-systemd/daemon? I can't find the original sources in their repository (master HEAD) anymore.

We should probably update the copyright notice. Could one of the maintainers comment on the current licensing situation? Have the original sources including their copyright been handed over from Docker to CoreOS?

[lucab]

At this point sdnotify.go has been basically rewritten, the only function in there even has a completely different signature.
I personally think we should retain the initial copyright line for its historical value, and add a relevant one covering 2015-2018. The NOTICE file covers docker/moby (the product) as a whole project, and I don't think it is relevant here anymore given the status above.

@muesli if you are looking into it, that package may also benefit from better docstring and getting rid of named return values (I think there is some unneeded variable shadowing in there).