On 09/01/18 16:57, Stian Soiland-Reyes wrote:
On Tue, 9 Jan 2018 16:13:59 +0000, Andy Seaborne <[email protected]> wrote:
I'm not seeing that the LICENSE and NOTICE files in the jars reflect the
NOTICE in the source tree. If source is used to make the jars, they
should have the L&N passed on. (not for dependencies)
Did any JARs lack LICENSE or NOTICE? They should generally have the
autogenerated ones from maven-remote-resources-plugin /
apache-jar-resource-bundle as is true for JARs in pretty much every
Maven-based incubator release.
I poked at a couple and they were autogenerated.
I don't know the dependency flow from module L&N to artifact works.
It is true that LICENSE/NOTICE overrides must be present in those
modules that correspond to the affected files, which in this project is
only in taverna-server-usagerecord:
https://github.com/apache/incubator-taverna-server/tree/master/taverna-server-usagerecord/src/main/resources/META-INF
Good.
(Perhaps a suggestion is for the central NOTICE to refer to
"taverna-server-usagerecord" rather than just package name)
Another example from Taverna Language (needing to modify LICENSE
for taverna-scufl2-wfdesc):
https://github.com/apache/incubator-taverna-language/blob/master/taverna-scufl2-wfdesc/src/main/resources/META-INF/LICENSE#L208
The central NOTICE mentions the historic Manchester copyright, which is
not in the generated META-INF/NOTICE files.
We agreed earlier that the "Portions of this software were originally
based on... - Copyright 2010-2014 University of Manchester" bit is
more of a courtesy and not something legally required by the software
grant.
Yes.
While not necessary, when such a large part is granted, it is useful in
License. There can't be that many large ones - it can't go over 100%!
(code donation didn't have any NOTICE; and in UK copyright is owned even
when not stated explicitly
https://github.com/apache/incubator-taverna-server/tree/apache-import-20150223
)
Thus the "Manchester" bit is not -- for ASF at least -- required to be
in NOTICE of individual JARs (as is true for all earlier releases) and
the maven-generated one should be fine for most modules (as was also
true for the other Taverna releases)
However, someone else ripping out code would indeed legally have to
propagate the NOTICE in anything they redistribute, but that
would be their task. This is similar to if someone else
redistributing a single of our .java file which copyright header
says they have to respect the corresponding NOTICE.
