Mailing-List: contact dev-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@geronimo.apache.org
Received-SPF: pass (herse.apache.org: domain of kevan.miller@gmail.com
 designates 66.249.82.238 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:mime-version:content-transfer-encoding:message-id:content-type:to:from:subject:date:x-mailer;
        b=rbLiLk+jtOe1Yhal3leV/76Zut66BN0UixfZIr3TRyeXZ3kt2aByO7kBQHHIa71GWTwEFtjdnJaWM2StDQI1ahF3mJmoJF9IMOgZf2LgFMH72eHRduwzoSnXCBbpZxq1SP5KVrCQE3naH/O5BbVIWcd1fm3IBhyaFPitpOykGIA=
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Transfer-Encoding: 7bit
Message-Id: <99BBC3CA-3B06-45F1-9535-D7FE95C1D80E@gmail.com>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
To: Geronimo Dev <dev@geronimo.apache.org>
From: Kevan Miller <kevan.miller@gmail.com>
Subject: Geronimo 2.0 License and Notice Files
Date: Wed, 11 Jul 2007 12:24:30 -0400

I've taken a pass through a Jetty Java EE assembly to identify the  
license file and notice file requirements of the various artifacts  
that we include in our binary distribution. I still need to gather  
the information for a Tomcat / Axis2 assembly.

The results can be viewed here -- http://spreadsheets.google.com/ccc? 
key=p7Ih4BV4hgEalSc8kSRtxBQ&hl=en_US

If some people could review, that would be great.

Next steps and pseudo-random license trivia:

Many jar archives included by Geronimo do not include LICENSE or  
NOTICE files. In most cases, I've tracked down the appropriate  
LICENSE information for the resource, and included a url for the  
LICENSE file. I haven't always done this. So, some work still  
remains. Most/all of this remaining work involves Apache projects.  
So, I don't invision a big problem. In some of the cases, the work is  
not chasing down the license information, but insuring that  
appropriate LICENSE/NOTICE files are generated in the original jar  
archive (e.g. OpenEJB).

We currently include all of our LICENSE information in a single root  
LICENSE.txt file. Some Apache projects include a licenses/ directory,  
instead. This directory includes all of the non-ASL licenses for the  
project. Although it's probably a bit more work, I personally prefer  
a single file. However, this is a debatable point. If others have an  
opinion, they are welcome to voice it.

The root LICENSE.txt and NOTICE.txt files (by "root" I mean the  
license/notice file in the bottom level directory of our source and  
binary distributions) contain the license info for the entire assembly.

License/notice files in individual jar files (e.g. geronimo- 
activation-2.0-SNAPSHOT.jar) apply only to the resources contained  
within that specific jar file. In nearly all cases, this means that  
LICENSE.txt only contains the Apache License 2.0. The only exception  
which I'm aware of is geronimo-util-2.0-SNAPSHOT.jar. The LICENSE.txt  
file in this jar contains both AL2 and the Bouncy Castle license,  
since geronimo-util contains the asn1 encoding that we obtained from  
Bouncy Castle.

We don't currently have different license/notice files that are  
specific to our Jetty/Tomcat CXF/Axis distributions. Nor do we  
attempt to generate license/notice files specific to our minimal  
assemblies. So current course and speed, our root license/notice  
files will be a superset of all of our various assemblies. This seems  
fine, to me. If anyone sees a problem with this, speak now...

Once all of the data in the google spreadsheet is complete, and we've  
had a chance to review. I'll plan on generating new LICENSE.txt,  
NOTICE.txt, and DISCLAIMER.txt files for our 2.0 release. I'd guess  
this will be towards the end of the week/over the weekend. If anyone  
else is interested in grabbing a shovel and pitching in, let me know...

--kevan