incubator-jena-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Leo Simons <>
Subject Re: Pre-release trial run.
Date Wed, 07 Dec 2011 00:03:37 GMT
More legal stuff...on reproducing licenses and notices....



On Tue, Dec 6, 2011 at 12:18 AM, Leo Simons <> wrote:
> ZOMG so many jars!
> ------------------
> apache-jena-2.7.0-incubator.tar.gz

I wonder how I forgot to look at this yesterday. Like I went over for
the LARQ example, for all the third party stuff (code and/or jars)
that are included in a distribution, their license and notice data
needs to be carried forward. For example, BSD/MIT/etc LICENSES for
included jars have to go into an aggregated LICENSE file, and
statements in NOTICE files for ALv2 jars need to go into the
distribution NOTICE.

Concretely, for this binary tarball,
* commons-codec NOTICE says
        test data from

        Copyright (C) 2002 Kevin Atkinson ( Verbatim copying
        and distribution of this entire article is permitted in any medium,
        provided this notice is preserved.
  ...since the jar doesn't contain that test source that seems ok and
we do not carry
  the NOTICE forward.
* httpclient says
        This project contains annotations derived from JCIP-ANNOTATIONS
        Copyright (c) 2005 Brian Goetz and Tim Peierls. See that statement needs to go in NOTICE.
* icu4j seems BSD-licensed so its license should go into LICENSE
* slf4j seems MIT-licensed so its license should go into LICENSE
* wstx-asl contains a weird NOTICE file. I don't think anything in there
  needs to be carried forward since these don't look like legal
statements. But, it
  is most likely simpler and safer just to copy the text it supplies verbatim.
* depending on where the xercesImpl binary came from, the relevant NOTICE data
  needs to be carried forward, which probably is
      Portions of this software were originally based on the following:
        - software copyright (c) 1999, IBM Corporation.,
        - software copyright (c) 1999, Sun Microsystems.,
        - voluntary contributions made by Paul Eng on behalf of the
          Apache Software Foundation that were originally developed at
iClick, Inc.,
          software copyright (c) 1999.
  ...but you'll need to check the distro that you got the jar file from.

I'm trying to remember how I handled this kind of thing before. Looks
like the last time I actually release managed an apache release was in
2007, and what we did then was simply not to ship 3rd party jars at
all (not the most user friendly). I guess it's easy enough to just
author the distribution NOTICE and LICENSE by hand, since these
dependencies don't change all that frequently, and that seems to be
what is (still) common practice.

Like I said, I did not check the other binary releases, but they need
to be checked for this too.

View raw message