I split license and notice files between source and binary licenses. The setup is now the following
1) ./LICENSE, ./NOTICE - Source distribution license and notice, refers to everything where the sources / files are contained in the project 2) ./flink-dist/src/main/flink-bin/LICENSE and NOTICE - Binary distribution license and notice, all bits bundled in the binary packages (tgz) 3) ./DEPENDENCIES - Comprehensive file with all maven dependencies, their licenses and notices The dependencies file is not required by Apache, but I think it makes sense to have this. On Tue, Aug 19, 2014 at 12:15 PM, Stephan Ewen <[email protected]> wrote: > Below is a summary of a mail exchange between me and Justin, with respect > to creating compliant LICENSE and NOTICE files > > ----------------------------------------- > > For the LICENSE and NOTICE file, I was a bit confused with all the > regulations > > Just follow the instructions here [1], your mentors should also be able to > help, ask them to review the LICENSE/NOTICE files. > > , so I looked at examples and followed the likes of Cassandra and Spark, > because I think that they are similar to Flink in the way they get used. > > Other projects may also have it wrong. > > With respect to bundled bits, the listed dependencies are all part of what > Maven pulls > > Only the bits actually included in the source or binary bundle need to be > referenced in the LICENSE and/or NOTICE. Bits that are downloaded after > that in the build process (via maven or otherwise) do not need to be > referenced. > > - source -> Bundles almost no external bits, only a few JavaScript / CSS > pages > > So only those JS bits need to be in LICENSE/NOTICE, and that depends on > there license as well. > > - bin -> Bundles the bits in NOTICE and LICENSE > > So you may require different NOTICE and LICENSE files in the binary > package. > > To the top-level LICENSE and NOTICE files, I added everything that is > pulled my Maven > > That is not required, only the bits physically bundled in the release need > to be included. Also note that Apache licensed bundled bits do not need to > be added to the LICENSE file. Again see [1]. > > because I think that people that include Flink via Maven can not be > expected to search for the LICENSE and NOTICE in the binary release. > > I actually agree that knowing everything it depends on is useful, but it's > not actually a legal requirement to add these to LICENSE or NOTICE. You > only need to add the bits that are physically bundled. > > Can you help me with the confusion there? Do we need three LICENSE files > (source, maven, bin) ? > > Just two I think one for the source bundle and one in the binary bundle. > > Hope that clears things up. If you have any other questions just ask me > directly or on list and I'll try and help. > > Thanks, > Justin > > 1. http://www.apache.org/dev/licensing-howto.html > >
