pjfanning opened a new issue, #267: URL: https://github.com/apache/openserverless/issues/267
In the 0.9.0-incubating-RC7 source release, the copyright notices of the npm packages embedded in the pre-built JavaScript bundles (`oplugins/util/upload.js`, `oplugins/admin/usage/usage.js`) are in the top-level `NOTICE` rather than in `LICENSE`, and several of them do not match the upstream packages. ## 1. The notices are in NOTICE instead of LICENSE The top-level `LICENSE` section "BUNDLED COMPONENTS -- PRE-BUILT JAVASCRIPT" lists each package by name and version, and reproduces the MIT, ISC and BSD-3-Clause licence texts once each. It does not include the packages' copyright lines. Those licences require "the above copyright notice" to be kept with the permission notice, so the copyright lines belong with the licence texts in `LICENSE`. Instead, the copyright lines are in the top-level `NOTICE` (lines 69-162, about 90 lines: MinIO, the 24 MIT packages, the ISC and BSD-3-Clause packages, and `yaml`). The ASF licensing guide says this is the wrong place: > Under normal circumstances, there is no need to modify `NOTICE` to mention a bundled dependency [under a permissive licence]. > > Do not add anything to `NOTICE` which is not legally required. https://infra.apache.org/licensing-howto.html#permissive-deps and https://infra.apache.org/licensing-howto.html#mod-notice It also notes that the copyright notices embedded in BSD and MIT licences do not need to be duplicated in `NOTICE`. The MinIO entry in `NOTICE` is not needed either: minio-js 8.0.1 is Apache-2.0 but ships no `NOTICE` file, so there is nothing to propagate. ## 2. Copyright lines that differ from upstream Checked against each package's own `LICENSE` at the bundled version (via unpkg): | Package (version) | Top-level NOTICE says | Upstream LICENSE says | |---|---|---| | fast-xml-parser (4.5.0) | Copyright (c) 2021 Natural Intelligence | Copyright (c) 2017 Amit Kumar Gupta | | mime-db (1.52.0) | Copyright (c) 2014 Jonathan Ong | Copyright (c) 2014 Jonathan Ong; Copyright (c) 2015-2022 Douglas Christopher Wilson | | mime-types (2.1.35) | Copyright (c) 2014 Jonathan Ong | Copyright (c) 2014 Jonathan Ong; Copyright (c) 2015 Douglas Christopher Wilson | | readable-stream (3.6.2), string_decoder (1.3.0) | Copyright Joyent, Inc. and other Node contributors | Copyright Node.js contributors. All rights reserved.; Copyright Joyent, Inc. and other Node contributors. All rights reserved. | | sax (1.4.1) | Copyright (c) Isaac Z. Schlueter and Contributors | Copyright (c) 2010-2024 Isaac Z. Schlueter and Contributors; Copyright (c) 2010-2024 Mathias Bynens | | stream-chain (2.2.5) | Copyright (c) 2005-2024, Eugene Lazutkin | Copyright 2019 Eugene Lazutkin | | stream-json (1.8.0) | Copyright (c) 2005-2024, Eugene Lazutkin | Copyright (c) 2005-2018, Eugene Lazutkin | | decode-uri-component (0.2.2) | Copyright (c) Sam Verschueren | Copyright (c) 2017, Sam Verschueren | The others match, or differ only in omitted e-mail addresses. `block-stream2` 2.1.0 has no copyright line in its `LICENSE`, so "Copyright (c) James Halliday" (its `package.json` author) is a reasonable choice. ## Suggested fix 1. In the top-level `LICENSE` "PRE-BUILT JAVASCRIPT" section, put each package's upstream copyright line(s) next to its name, corrected as in the table above. The licence texts already there can stay. 2. Remove the bundled-JavaScript section (lines 69-162) from the top-level `NOTICE`, including the MinIO entry. Related: #260. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
