Fwd: Rules for LICENSE and NOTICE files in Apache Releases

[Stephan Ewen]

Below is a summary of a mail exchange between me and Justin, with respect
to creating compliant LICENSE and NOTICE files

-----------------------------------------

For the LICENSE and NOTICE file, I was a bit confused with all the
regulations

Just follow the instructions here [1], your mentors should also be able to
help, ask them to review the LICENSE/NOTICE files.

, so I looked at examples and followed the likes of Cassandra and Spark,
because I think that they are similar to Flink in the way they get used.

Other projects may also have it wrong.

With respect to bundled bits, the listed dependencies are all part of what
Maven pulls

Only the bits actually included in the source or binary bundle need to be
referenced in the LICENSE and/or NOTICE.  Bits that are downloaded after
that in the build process (via maven or otherwise) do not need to be
referenced.

 - source -> Bundles almost no external bits, only a few JavaScript / CSS
pages

So only those JS bits need to be in LICENSE/NOTICE, and that depends on
there license as well.

 - bin -> Bundles the bits in NOTICE and LICENSE

So you may require different NOTICE and LICENSE files in the binary package.

To the top-level LICENSE and NOTICE files, I added everything that is
pulled my Maven

That is not required, only the bits physically bundled in the release need
to be included. Also note that Apache licensed bundled bits do not need to
be added to the LICENSE file. Again see [1].

because I think that people that include Flink via Maven can not be
expected to search for the LICENSE and NOTICE in the binary release.

I actually agree that knowing everything it depends on is useful, but it's
not actually a legal requirement to add these to LICENSE or NOTICE. You
only need to add the bits that are physically bundled.

Can you help me with the confusion there? Do we need three LICENSE files
(source, maven, bin) ?

Just two I think one for the source bundle and one in the binary bundle.

Hope that clears things up. If you have any other questions just ask me
directly or on list and I'll try and help.

Thanks,
Justin

1. http://www.apache.org/dev/licensing-howto.html

[Stephan Ewen]

I split license and notice files between source and binary licenses.

The setup is now the following

1) ./LICENSE, ./NOTICE  - Source distribution license and notice, refers to
everything where the sources / files are contained in the project

2) ./flink-dist/src/main/flink-bin/LICENSE and NOTICE - Binary distribution
license and notice, all bits bundled in the binary packages (tgz)

3) ./DEPENDENCIES - Comprehensive file with all maven dependencies, their
licenses and notices

The dependencies file is not required by Apache, but I think it makes sense
to have this.




On Tue, Aug 19, 2014 at 12:15 PM, Stephan Ewen <[hidden email]> wrote:

> Below is a summary of a mail exchange between me and Justin, with respect
> to creating compliant LICENSE and NOTICE files
>
> -----------------------------------------
>
> For the LICENSE and NOTICE file, I was a bit confused with all the
> regulations
>
> Just follow the instructions here [1], your mentors should also be able to
> help, ask them to review the LICENSE/NOTICE files.
>
> , so I looked at examples and followed the likes of Cassandra and Spark,
> because I think that they are similar to Flink in the way they get used.
>
> Other projects may also have it wrong.
>
> With respect to bundled bits, the listed dependencies are all part of what
> Maven pulls
>
> Only the bits actually included in the source or binary bundle need to be
> referenced in the LICENSE and/or NOTICE.  Bits that are downloaded after
> that in the build process (via maven or otherwise) do not need to be
> referenced.
>
>  - source -> Bundles almost no external bits, only a few JavaScript / CSS
> pages
>
> So only those JS bits need to be in LICENSE/NOTICE, and that depends on
> there license as well.
>
>  - bin -> Bundles the bits in NOTICE and LICENSE
>
> So you may require different NOTICE and LICENSE files in the binary
> package.
>
> To the top-level LICENSE and NOTICE files, I added everything that is
> pulled my Maven
>
> That is not required, only the bits physically bundled in the release need
> to be included. Also note that Apache licensed bundled bits do not need to
> be added to the LICENSE file. Again see [1].
>
> because I think that people that include Flink via Maven can not be
> expected to search for the LICENSE and NOTICE in the binary release.
>
> I actually agree that knowing everything it depends on is useful, but it's
> not actually a legal requirement to add these to LICENSE or NOTICE. You
> only need to add the bits that are physically bundled.
>
> Can you help me with the confusion there? Do we need three LICENSE files
> (source, maven, bin) ?
>
> Just two I think one for the source bundle and one in the binary bundle.
>
> Hope that clears things up. If you have any other questions just ask me
> directly or on list and I'll try and help.
>
> Thanks,
> Justin
>
> 1. http://www.apache.org/dev/licensing-howto.html
>
>

[Justin Mclean]

Hi,

> 1) ./LICENSE, ./NOTICE  - Source distribution license and notice, refers to everything where the sources / files are contained in the project
>
> 2) ./flink-dist/src/main/flink-bin/LICENSE and NOTICE - Binary distribution license and notice, all bits bundled in the binary packages (tgz)
Sounds good I'll take a look tomorrow as it's getting late in my timezone.

> 3) ./DEPENDENCIES - Comprehensive file with all maven dependencies, their licenses and notices
Not required but IMO also a good idea + it makes reviewing a lot easier as well.

Thanks for quickly looking into this and fixing it.

Justin

[Stephan Ewen]

I would prefer to not include this in the current release (which is already
being voted upon), but in the next one.



On Tue, Aug 19, 2014 at 1:07 PM, Justin Mclean <[hidden email]>
wrote:

> Hi,
>
> > 1) ./LICENSE, ./NOTICE  - Source distribution license and notice, refers
> to everything where the sources / files are contained in the project
> >
> > 2) ./flink-dist/src/main/flink-bin/LICENSE and NOTICE - Binary
> distribution license and notice, all bits bundled in the binary packages
> (tgz)
> Sounds good I'll take a look tomorrow as it's getting late in my timezone.
>
> > 3) ./DEPENDENCIES - Comprehensive file with all maven dependencies,
> their licenses and notices
> Not required but IMO also a good idea + it makes reviewing a lot easier as
> well.
>
> Thanks for quickly looking into this and fixing it.
>
> Justin

[Henry Saputra]

Hi Justin, per your comment I hope we could punt this separation for
next release?

- Henry

On Tue, Aug 19, 2014 at 4:07 AM, Justin Mclean <[hidden email]> wrote:

> Hi,
>
>> 1) ./LICENSE, ./NOTICE  - Source distribution license and notice, refers to everything where the sources / files are contained in the project
>>
>> 2) ./flink-dist/src/main/flink-bin/LICENSE and NOTICE - Binary distribution license and notice, all bits bundled in the binary packages (tgz)
> Sounds good I'll take a look tomorrow as it's getting late in my timezone.
>
>> 3) ./DEPENDENCIES - Comprehensive file with all maven dependencies, their licenses and notices
> Not required but IMO also a good idea + it makes reviewing a lot easier as well.
>
> Thanks for quickly looking into this and fixing it.
>
> Justin

[Henry Saputra]

Forward to Justin directly just in case he is not in the list =)

---------- Forwarded message ----------
From: Henry Saputra <[hidden email]>
Date: Tue, Aug 19, 2014 at 10:45 AM
Subject: Re: Rules for LICENSE and NOTICE files in Apache Releases
To: "[hidden email]" <[hidden email]>


Hi Justin, per your comment I hope we could punt this separation for
next release?

- Henry

On Tue, Aug 19, 2014 at 4:07 AM, Justin Mclean <[hidden email]> wrote:

> Hi,
>
>> 1) ./LICENSE, ./NOTICE  - Source distribution license and notice, refers to everything where the sources / files are contained in the project
>>
>> 2) ./flink-dist/src/main/flink-bin/LICENSE and NOTICE - Binary distribution license and notice, all bits bundled in the binary packages (tgz)
> Sounds good I'll take a look tomorrow as it's getting late in my timezone.
>
>> 3) ./DEPENDENCIES - Comprehensive file with all maven dependencies, their licenses and notices
> Not required but IMO also a good idea + it makes reviewing a lot easier as well.
>
> Thanks for quickly looking into this and fixing it.
>
> Justin