There should never be new direct contributions that have Copyright notices or other conditions other than the headers ASF require.
That's because anyone with commit (i.e., push) rights must be an ASF committer and have filed an iCLA with the ASF. For ASF Projects, the request is to not add copyright notices of any kind for these contributions, and there is no need for anything in NOTICE about them. So it is not necessary to include a copyright notice, because the license notification is sufficient. So the only reason for more material in NOTICE is with regard to (1) incorporation of source code that is not contributed in that manner, (2) that is otherwise compatible with being in source code of an Apache Project, and (3) creates a legal requirement to identify the license of the code. The example of showdown.js is useful in this regard. It is third-party. The copyright notices cannot be moved and the files should be used intact. There is need to identify that origin and the copyright claims in the NOTICE file so that folks are aware of the dependency's presence and the license that is involved. The license text needs to be appended to the LICENSE file. If there are modifications to showdown.js, that makes a derivative work and generally it is kept under the original license. If the modifications are not minor and necessary for integration into Corinthia, it is desirable to contribute anything useful upstream. There might be something added to the showdown.js notice heading on the files concerning the presence of Apache contributed mods. It would be useful to check to see how minimal that can be in this particular situation wherever it arises in Corinthia. - Dennis -----Original Message----- From: Peter Kelly [mailto:[email protected]] Sent: Friday, February 13, 2015 01:25 To: [email protected] Subject: Re: Copyright notices > On 13 Feb 2015, at 3:32 pm, Dennis E. Hamilton <[email protected]> > wrote: [ ... ] > We will need to run RAT on the repository as part of diligence with regard to > third-party license notices and claims, and that should be done before > declaring every release candidate. I think this can be done on an unzip of > the source archive for a given release, since there is more time to clean up > IP on unreleased code/dependencies. One other dependency which I think should also be mentioned that I don’t think has been discussed the list or JIRA yet is showdown.js inside the Editor (inside the Editor/src/3rdparty directory). This is a Markdown implementation written in Javascript; there’s a license.txt in there which is the same as the original markdown program by John Gruber, which I think is BSD-style. [ ... ] > ABOUT NOTICE > > It has been made very clear that NOTICE is not an attribution or > acknowledgment file. It must be limited to *legally-required* notice > information. Moving your copyright notice there is perfect under the > third-party rules. Any associated licenses that are required to be included > are appended to LICENSE, and multiple uses of common licenses only needs to > appear in LICENSE once. [ ... ] Any new code that is added by myself or others still needs to be identifiable as being under the copyright ownership of the companies/individuals who wrote it (in case of any disputes) - something which in non-Apache projects can often be done by looking at the names at the top of the source files, though with the Apache approach relies on version control. But I don’t see that as a problem given how easy it is to track the history of code through VC systems. > MY COPYRIGHT AND NOTICE > > I believe all of my contributions of any substance came after the move to the > incubator, although I was made a member of the UX project before that. In > any case, I have not applied any copyright notices to files from me (except > ASF notices) and I am in complete accord with the code being licensed to the > ASF. There is no requirement to do anything in NOTICE on my behalf. Having > a CONTRIBUTORS file would be valuable though. If you write new code though, you still own the copyright on it, correct? An example would be the scripts you wrote for externals required by the windows build - you own these but have granted a license for their use to Apache, is that right? -- Dr. Peter M. Kelly [email protected] http://www.kellypmk.net/ PGP key: http://www.kellypmk.net/pgp-key <http://www.kellypmk.net/pgp-key> (fingerprint 5435 6718 59F0 DD1F BFA0 5E46 2523 BAA1 44AE 2966)
