Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: legal-discuss@apache.org
Received-SPF: pass (athena.apache.org: local policy)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=DKIM-Signature:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Content-Transfer-Encoding:Message-Id:References:To:X-Mailer;
  b=JFXgpjYNfnWxeY30FbyBJ77eUqVag5aNu/by3wTTtBYzcgvgpGTeMTG1XlpNixJAhEqwt4PkSwFHC8VjVo+IZtjD37kwhB8nh4ywH9bvkwVfyh/bC7FWjteuSGQK2Bq7cWj3keYodZv0OWIm5DLPDzEV21rbNRhWkQ1jyIA1D4o=
  ;
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Apple Message framework v1084)
Subject: Re: transitive 3rd party dependencies Notice and Licenses
From: David Jencks <david_jencks@yahoo.com>
In-Reply-To: <4FB483FE.8080003@gmail.com>
Date: Wed, 16 May 2012 22:21:33 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <8F47E465-8B18-45E7-ACB6-CE21F8FE7544@yahoo.com>
References: <4FB483FE.8080003@gmail.com>
To: legal-discuss@apache.org


On May 16, 2012, at 9:52 PM, Emmanuel L=E9charny wrote:

> Hi guys,
>=20
> I have a question : when we use a 3rd party dependency in a project, =
we have to include a reference to the License and some other information =
in the NOTICE file, plus add the original 3rd party License into our =
LICENCE file.
>=20
> But what about transitive dependencies ?
>=20
> For instance, if we use XStream, which include XPP, and if XSTREAM =
does not include (or even if it does !) the required licnese for XPP? =
should we add it ourselves ?
>=20

Hi Emmanuel,

I'm not sure I understand what you mean by "use".  The LICENSE and =
NOTICE files refer to what's actually in the artifact, not anything that =
might be needed to use it.

Lets consider some examples:

svn checkout points are expected to have LICENSE and NOTICE files at the =
root applying to what's actually checked out from svn, not including =
anything that might be pulled into and included in built artifacts.

source artifacts (the buildable project, what is actually voted on for a =
release) need LICENSE and NOTICE files for what's actually in the file: =
typically this will be the same as the svn checkout.

"convenience" binary artifacts such as jars need LICENSE and NOTICE =
files applying to whats actually inside.  This might be compiled =
apache-licensed source from the project, and it might include stuff =
pulled in from other dependencies (such as xstream, and xpp in your =
example).  If the artifact includes stuff from elsewhere, it needs the =
additional info: if not it doesn't

something like a server assembly (e.g. a geronimo assembly, unpack and =
you get a working server) that includes a lot of third party jars needs =
the info for everything included in the LICENSE and NOTICE files.

And since I looked into this or a similar combination once.... if you =
are talking about an artifact such as xstream that appears to ignore the =
legal requirements for xpp code which is included in the xstream jar, =
and you have an artifact that includes both, I prefer to try to fix the =
xstream mistake and track down the xpp requirements and satisfy them.  =
(I'm not 100% sure it was xstream that ignored the xpp requirements)

hope this is sufficiently accurate to be useful :-)

david jencks

> Thanks !
>=20
> --=20
> Regards,
> Cordialement,
> Emmanuel L=E9charny
> www.iktek.com
>=20
>=20
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
> For additional commands, e-mail: legal-discuss-help@apache.org
>=20


---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org