On Fri, Feb 11, 2011 at 11:42 PM, Emmanuel Lecharny <[email protected]> wrote: > On 2/11/11 8:29 AM, Stefan Seelmann wrote: >> >> - The shared-all jar includes all transitive dependencies (slf4j, >>>>> >>>>> antlr, etc.), but the LICENSE and NOTICE files are not correct, that >>>>> needs to be fixed. >>>> >>>> +1 >> >> Still to do. > > More specifically, for shared, here is the list of external dependencies we > use in shared : > > antlr 2.7.7 (http://www.antlr2.org/license.html) > dom4j 1.6.1 (http://dom4j.sourceforge.net/dom4j-1.6.1/license.html) > junit 4.8.2 (http://junit.sourceforge.net/cpl-v10.html) > slf4j 1.6.1 (http://www.slf4j.org/license.html) > xpp3 1.1.4c > (http://caldersphere.rubyforge.org/jrexml/files/lib/xpp3_LICENSE_txt.html) > > I have added the given licences into the > http://svn.apache.org/viewvc/directory/shared/trunk/NOTICE?view=markup file.
Thanks. I'm not sure when those notices should/must be added. It's clear, when distributing a binary distribution (e.g. ldap-api.zip) where third-party dependencies are included that the licenses and notices of those third-party dependencies have to be added. But is the attribution also required in the JARs (both, binary or source, there in META-INF/LICENSE and META-INF/NOTICE) that are distributed via maven? I see the following different cases: 1) In shared-ldap-model we use Antlr to generate Java files. So I think in the distributed shared-ldap-model-X.Y.Z.jar the Antlr attribution is required. 2) The common case that a 3rd-party libary is used/linked in main code (e.g. dom4j or slf4j). Our distributed JAR only contains our .java/.class files. The third-party jar is not redistributed. The dom4j and slf4j licenses say that attribution is required in case the software is 'used'. Does 'use' already include the case that their classes are linked? But in that case we 3) Similar like 2, but the 3rd-party is only used as test dependency (like junit). Here the code is not distributed at all. 4) 3rd-party source code is included (e.g. in apacheds/jdbm or in junit-addons). Here it is clear that attribution is required. In the default maven builld META-INF/LICENSE and META-INF/NOTICE are genarated by the maven-remote-resources-plugin and they don't include any attribution for cases #2 and #3. The trunk/NOTICE file is not packaged into the JARs. Thougths? Kind Regards, Stefan
