commons-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From sebb <>
Subject Re: [VOTE] Release Apache Commons Digester 3.2 based on RC1
Date Fri, 09 Dec 2011 16:23:14 GMT
On 9 December 2011 15:40, Simone Tripodi <> wrote:
>>> [X] -1 no, do not release it because... (please explain why)
>>> The NOTICE file mentions but the LICENSE file does
>> not include its LICENSE.
> ASM is a _transitive_ dependency brought by CGLIB and mentioning it in
> the NOTICE file is required for the uber-jar, as expressed in the ASM
> license:
> "2. Redistributions in binary form must reproduce the above copyright
>   notice, this list of conditions and the following disclaimer in the
>   documentation and/or other materials provided with the distribution."
> where "the above copyright notice" is
>  Copyright (c) 2000-2011 INRIA, France Telecom
>  All rights reserved.
> included in the NOTICE file, so I don't understand why ASM license
> should be included - IANAL (and I don't want to be) so please
> everybody explain me

There are two aspects to this.

1) Does the artifact actually included the 3rd party code?
If not, then it should not be mentioned at all.

2) If the artifact does *include* the code, then the LICENSE must be
included, and if the license says so, there must be a mention in the
NOTICE file.

Every mention in the NOTICE file should have a corresponding entry in
the LICENSE file; not every license requires a mention in the NOTICE

In this case, there need to be two sets of N&L files - one for the
shaded jar, which mention the additional included components, and
another for the rest, which are presumably ASF code only.

Looks like it would be easy enough to include specific N&L files in
the shaded jar; if not, maybe use a separate Maven module to do the
shading and hold the N&L files?

>> Ideally the LICENSE file should also state that AL 2.0 applies to CGLIB.
> isn't it more enough mention 3rd parties in the NOTICE file?

No, LICENSES are also needed.

> NOTICE.txt file contains:
>  CGLIB - licensed under the Apache License v2.0.
>  This product includes software developed by
>  Juozas Baliuka, Chris Nokleberg and Sam Berlin (
> also in this case, I don't understand LICENSE modifications.

I mean, after the AL license, one can put:


The Apache Commons Digester with-deps jar ncludes a number of subcomponents with
separate copyright notices and license terms. Your use of the source
code for the these subcomponents is subject to the terms and
conditions of the following licenses.

For the CGLIB component (
This is licensed under the AL 2.0, see above

For the ASM component (
[include the license here]

See for example:

> TIA,
> -Simo
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:
> For additional commands, e-mail:

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message