Mailing-List: contact dev-help@felix.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@felix.apache.org
Received-SPF: pass (nike.apache.org: domain of fmeschbe@gmail.com designates
 72.14.220.157 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject:references
         :in-reply-to:content-type:content-transfer-encoding;
        b=WtbWkkVDOfz52A3BSqObENwyEByiN5OY9MMqnn48khRHfoMG2nvi1fDEO6DDyJyb8C
         YdqckygpbF7CTCIzuqqgkAfen2iKWzoGMcoyKMijTcdJy0fq1sM77LMNX8uTyZEungl2
         hIIH3bcibQj71wHQHKv9lW4FmklBIJKaYLiDg=
Message-ID: <4AD3293B.4050904@gmail.com>
Date: Mon, 12 Oct 2009 15:03:55 +0200
From: Felix Meschberger <fmeschbe@gmail.com>
User-Agent: Thunderbird 2.0.0.23 (X11/20090817)
MIME-Version: 1.0
To: dev@felix.apache.org
Subject: Re: Proposal for a new NOTICE file
References: <4AD31A79.2070705@ungoverned.org> <4AD32520.3040805@gmail.com>
 <4AD3265F.7080601@ungoverned.org> <4AD32718.7080708@ungoverned.org>
In-Reply-To: <4AD32718.7080708@ungoverned.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

Hi,

Richard S. Hall schrieb:
> Oops, let me edit that:
> 
> If we ARE allowed to do it, then I'd rather have one file so we don't
> have to determine whether we need to distinguish between the two cases
> and have to maintain additional artifacts. For me, this has nothing to
> do with courtesy, it has to do with easing the maintenance.

Point is that the NOTICE file must not be removed by downstream
re-bundlers (unless a dependency referred to is removed).

Also there is some stuff we include (for example the icons used in the
web console) where we have to attribute to the source.

And there is other stuff, where this is not required at all. And
generally, if we don't need to attribute, we should not (this is the
simplest of all cases ;-) ).

So, if we attribute something which is not required to be attributed, it
is IMHO a question of courtesy (and I am all for attributing everything
we include, don't get me wrong).

How about this :

  * Everything we include is added to the README file
  * If something needs attribution it is also added to the NOTICE
    file

This is probably as simple as it can get

> 
> However, if we are NOT allowed to do so, then we have no choice.

My understanding is that we are probably NOT allowed ;-)

Regards
Felix

> 
> -> richard
> 
> On 10/12/09 14:51, Richard S. Hall wrote:
>> If we are not allowed to do it, then I'd rather have one file so we
>> don't have to determine whether we need to distinguish between the two
>> cases and have to maintain additional artifacts. For me, this has
>> nothing to do with courtesy, it has to do with easing the maintenance.
>>
>> However, if we are not allowed to do so, then we have no choice.
>>
>> -> richard
>>
>> On 10/12/09 14:46, Felix Meschberger wrote:
>>> Hi,
>>>
>>> Thanks for bringing this up (again). The problem I have had for some
>>> time now, is that our NOTICE files are not really consistent with the
>>> legal intent of the NOTICE files.
>>>
>>> Basically, the NOTICE files are part of the legal setup of Apache
>>> products. As such they have have a fixed predefined header:
>>>
>>>      Apache [PRODUCT_NAME]
>>>      Copyright [yyyy] The Apache Software Foundation
>>>
>>>      This product includes software developed at
>>>      The Apache Software Foundation (http://www.apache.org/).
>>>
>>> This includes everything we might pack from other Apache projects.
>>>
>>> For third party stuff included we have two options:
>>>
>>>    * attribution is required: add this to the NOTICE file
>>>    * attribution not required: do not add
>>>
>>> Point is that the NOTICE file is not the place for courtesy -- it is the
>>> place for legal requirements (and it is referred to by the LICENSE text
>>> when it comes to redistributing ASF works).
>>>
>>> Our full freedom to attribute to everything that we need, use, include
>>> etc. is the README file:
>>>
>>>    * some project description
>>>    * some documentation links
>>>    * issue tracking links
>>>    * .... more ....
>>>
>>> Using the README file we might even distinguish between souce and binary
>>> and collective releases.
>>>
>>> Therefore I propose:
>>>
>>>    * we turn your prooposed NOTICE structure into a proposed structure
>>>      for README files and be more verbose with respect to differences
>>>      of source and binary distributions.
>>>
>>>    * limit the contents of the NOTICE file to the bare legal minimum.
>>>
>>> Regards
>>> Felix
>>>
>>> [1] http://www.apache.org/legal/src-headers.html#notice
>>>
>>> Richard S. Hall schrieb:
>>>> After reviewing the latest framework and HTTP Service releases, I
>>>> realize that pretty much all of our projects both "include" and "use"
>>>> Apache developed software (if nothing else, all projects depend on
>>>> Maven
>>>> to build). It seems silly to list Apache under both "include" and
>>>> "use",
>>>> especially since the main point of the NOTICE file is for third-party
>>>> notices.
>>>>
>>>> I want to propose that we change our NOTICE file template to factor out
>>>> the Apache notice at the top and only use the remaining sections for
>>>> third-party notices; for example, here is a new NOTICE file for
>>>> framework:
>>>>
>>>>      Apache Felix Framework
>>>>      Copyright 2009 The Apache Software Foundation
>>>>
>>>>      This project was developed at the Apache Software Foundation
>>>>      (http://www.apache.org) and may have dependencies on other
>>>>      Apache projects licensed under Apache License 2.0.
>>>>
>>>>      I. Included Third-Party Software
>>>>
>>>>      This product includes software developed at
>>>>      The OSGi Alliance (http://www.osgi.org/).
>>>>      Copyright (c) OSGi Alliance (2000, 2009).
>>>>      Licensed under the Apache License 2.0.
>>>>
>>>>      II. Used Third-Party Software
>>>>
>>>>      This product uses software developed at
>>>>      The OSGi Alliance (http://www.osgi.org/).
>>>>      Copyright (c) OSGi Alliance (2000, 2009).
>>>>      Licensed under the Apache License 2.0.
>>>>
>>>>      This product uses software developed at
>>>>      The Codehaus (http://www.codehaus.org)
>>>>      Licensed under the Apache License 2.0.
>>>>
>>>>      III. Overall License Summary
>>>>      - Apache License 2.0
>>>>
>>>> To be clear, the new boilerplate would be:
>>>>
>>>>      Apache Felix AAA
>>>>      Copyright 2009 The Apache Software Foundation
>>>>
>>>>      This software was developed at the Apache Software Foundation
>>>>      (http://www.apache.org) and may have dependencies on other
>>>>      Apache software licensed under Apache License 2.0.
>>>>
>>>>      I. Included Third-Party Software
>>>>
>>>>      BBB
>>>>
>>>>      II. Used Third-Party Software
>>>>
>>>>      CCC
>>>>
>>>>      III. Overall License Summary
>>>>      - Apache License 2.0
>>>>      - DDD
>>>>
>>>> Where BBB and CCC would only reference third-party dependencies and DDD
>>>> would list their licenses.
>>>>
>>>> What do you think?
>>>>
>>>> ->  richard
>>>>
>