Hi, I have read the official document[1] for several times, and actually I found it difficult to understand for me. :( I would like to elaborate it with my limited understanding, and please correct me if I am wrong.
First, according to the "GUIDING PRINCIPLE": > The LICENSE and NOTICE files must exactly represent the contents of the > distribution they reside in. > Only bits that are actually included in a distribution have any bearing on > the content of NOTICE and LICENSE. ASF only do source releases, so there should not be any binary contents inside the source release. Secondly, because Dubbo bundles Google Guava and Netty in the source release, they should be taken into consideration to for possible change of NOTICE and LICENSE when doing release. Because Google Guava and Netty both are under ALv2, according to "BUNDLING AN APACHE-2.0-LICENSED DEPENDENCY" > Assuming once again that that the bundled dependency itself contains no > bundled subcomponents under other licenses and thus the ALv2 applies > uniformly to all files, there is no need to modify LICENSE. However, for > completeness it is useful to list the products and their versions, as is done > for products under other licenses. > If the dependency supplies a NOTICE file, its contents must be analyzed and > the relevant portions bubbled up into the top-level NOTICE file. Because the bundled Google Guava and Netty both contain no bundled subcomponents under other licenses, normally we should not modify LICENSE. But for completeness we list them and their version. Because Google Guava does not supply a NOTICE file, and the source file headers have no copyright notice, there is no need to modify NOTICE for Google Guava. Because Netty does supply a NOTICE file, and it is Apache licensed, we should analyze whether we should modify NOTICE file. According to "MODIFICATIONS TO NOTICE", because Dubbo has relocated several classes from Netty, and these files contain copyright notice, we must modify NOTICE file to add Netty copyright notifications and then change the source file header to remove the copyright notice. That is my understanding of why we should add Netty's copyright notice to NOTICE file. When I was going through the files, I found there are something we still need to be improved: 1. The source file header of classes under org.apache.dubbo.common.threadlocal should be changed by removing the copyright Notice from Netty. 2. Update LICESE file: Remove the io.netty.util.concurrent.FastThreadLocal class, which is no longer bundled in Dubbo. I am planning to update them to 2.7.x branch and 2.6.x branch, and it should be available in next release. [1] http://www.apache.org/dev/licensing-howto.html On Tue, Sep 25, 2018 at 9:32 PM Willem Ning Jiang <[email protected]> wrote: > > Hi Justin, > > Just a quick question for adding the NOTICE file, if we just use netty binary > file, do we still need to add the NOTICE about the copyright of netty? > > According this[1], I don't think we need to add NOTICE information for the > binary usage of Netty. > > [1]https://softwareengineering.stackexchange.com/questions/234511/what-is-the-best-practice-for-arranging-third-party-library-licenses-paperwork > > Regards, > > Willem > > On 2018/09/08 01:34:36, Justin Mclean <[email protected]> wrote: > > Hi, > > > > >>> This product contains code derived from Google Guava project, which is > > >>> available under a "Apache License 2.0" license. > > >>> (https://github.com/google/guava <https://github.com/google/guava>). > > >>> > > >>> This product contains code derived from the Netty Project, which is > > >>> available under a "Apache License 2.0" license. > > >>> (https://github.com/netty/netty <https://github.com/netty/netty>) > > > > First off license information should not be repeated in NOTICE [1], it > > belongs in LICENSE and there no need to add URLs in NOTICE to repo unless > > it is specified in the license conditions (so called required 3rd-party > > notices). [2] > > > > The Guava project doesn’t have a NOTICE file so nothing needs to be added > > for it. > > > > The Netty project has a long (and sadly IMO malformed) NOTICE file. > > > > I would suggest you just add: > > > > "This product contains code form the Netty Project: > > > > The Netty Project > > ================= > > Please visit the Netty web site for more information: > > * http://netty.io/ > > > > Copyright 2014 The Netty Project” > > > > Normally I would not add the URL but as they have it in their NOTICE file > > we should include it. [3] > > > > Also double check if any of the code copies from Netty is from anything > > mentioned further down in Netty’s NOTICE file. If it is we would need to > > add more to the NOTICE file. > > > > Thanks, > > Justin > > > > 1. http://www.apache.org/dev/licensing-howto.html#mod-notice > > 2. https://www.apache.org/legal/resolved.html#required-third-party-notices > > 3. http://www.apache.org/dev/licensing-howto.html#alv2-dep > > > > -- Best Regards！ Huxing
