Stephen That looks much better to me but no promises that others might disagree
Only issue I still see is that in the two LICENSE files with other licenses the BSD style licenses section says "he Apache TinkerPop project bundles the following components under the Apache 2.0 License:" which is just a simple copy paste error Rob On 03/04/2015 18:39, "Stephen Mallette" <[email protected]> wrote: >Thanks for the link David - I'd seen that before actually. It never fully >made sense to me until I had the feedback from Rob and Matt. I also >finally found a pattern from an Apache project that seems to match what >Rob/Matt have been trying to tell me so I've used that for a model in what >I have now. So....i have separate source and binary license/notice now. >My source license/notice are as described in my last email and i have two >sets of binary notice/license one set for gremlin-console and one set for >gremlin-server. > >https://github.com/apache/incubator-tinkerpop/blob/master/LICENSE >https://github.com/apache/incubator-tinkerpop/blob/master/NOTICE >https://github.com/apache/incubator-tinkerpop/blob/master/gremlin-console/ >src/main/LICENSE >https://github.com/apache/incubator-tinkerpop/blob/master/gremlin-console/ >src/main/NOTICE >https://github.com/apache/incubator-tinkerpop/blob/master/gremlin-server/s >rc/main/LICENSE >https://github.com/apache/incubator-tinkerpop/blob/master/gremlin-server/s >rc/main/NOTICE > >Anyway, I feel pretty good about these now that I have rectified all of >the >comments from Rob/Matt, tied that back to the link you sent and verified >it >all against a top-level Apache project. Hopefully, everyone will find what >I have as satisfactory. > > > >On Thu, Apr 2, 2015 at 10:54 PM, David Nalley <[email protected]> wrote: > >> Take a look at this document; it has a how to, and is considered the >> canonical document: >> http://www.apache.org/dev/licensing-howto.html >> >> --David >> >> On Thu, Apr 2, 2015 at 12:32 PM, Stephen Mallette <[email protected]> >> wrote: >> > oh - i misread your post a bit (and i've misunderstood the notion of >> source >> > and binary LICENSE/NOTICE, since Matt introduced the concept - sorry >> about >> > that). let me try to rephrase: >> > >> > for our "source" LICENSE/NOTICE (lives at the root of the source tree >>- >> > i.e. where they are now) we will have: >> > >> > 1. The Apache License in LICENSE >> > 2. This in NOTICE: >> > >> > --------------------------------------------------------- >> > Apache Tinkerpop depends on components with separate copyright notices >> > and license terms. >> > >> > Your use of the source code for the these subcomponents is subject to >>the >> > terms and conditions oftheir respective licenses. >> > >> > See the LICENSE file for a list of subcomponents and dependencies and >> > their respective licenses. >> > --------------------------------------------------------- >> > >> > That's all we need for source NOTICE/LICENSE because "Tinkerpop source >> code >> > *does not* actively bundles other source code under other licenses" >> > >> > for the "binaries" NOTICE/LICENSE - i assume that refers to our "zip >> > distribution". if so, i will add LICENSE/NOTICE to gremlin-server and >> > gremlin-console (as only those two modules assemble zips) and these >>would >> > contain the dependencies more in the format of what i have now in the >> > "source" LICENSE/NOTICE. >> > >> > If all that makes sense, then these would be the items to get >> > more consensus on: >> > >> > 1. For the binary NOTICE can we drop the Netty NOTICE? I guess that is >> not >> > a rule for the NOTICE files of all non-ASF projects? isn't it safer to >> just >> > include such things since IANAL? By that same token, i assume that we >> must >> > include copies of NOTICE from all ASF projects. >> > 2. For the binary LICENSE, there is some conflicting opinion between >>Rob >> > and Matt that could use resolution. Do I need to have multiple >>copies of >> > BSD licenses (i assume MIT is ok) in the LICENSE file just because of >> > copyright differences? >> > 3. For the binary LICENSE, I can remove direct list of Apache licensed >> > dependencies because "there is no need to list dependencies which are >> under >> > the Apache License, it is reasonable to assume that if the component >> > isn't explicitly >> > called out that the main Apache License applies to it." - correct? >> > >> > Thanks, >> > >> > Stephen >> > >> > >> > >> > >> > >> > On Thu, Apr 2, 2015 at 11:54 AM, Rob Vesse <[email protected]> >>wrote: >> > >> >> Well the work you done is still relevant for the LICENSE and NOTICE >>for >> >> your binary distribution though may require some trimming down >> >> >> >> To reiterate you should have separate LICENSE and NOTICE for your >> binaries >> >> because those will include different things to your pure source code >> >> release. >> >> >> >> Rob >> >> >> >> On 02/04/2015 16:22, "Stephen Mallette" <[email protected]> wrote: >> >> >> >> >This statement: >> >> > >> >> >> Unless Tinkerpop source code actively bundles other source code >>under >> >> >other licenses then you should basically have nothing except the >>basic >> >> >Apache License in LICENSE and the basic copyright notice in NOTICE >> >> > >> >> >It seems to cut everything short for me. We don't bundle source >>code >> that >> >> >I can think of. As such, all we need is: >> >> > >> >> >1. The Apache License in LICENSE >> >> >2. This in NOTICE: >> >> > >> >> >--------------------------------------------------------- >> >> >Apache Tinkerpop depends on components with separate copyright >>notices >> >> >and license terms. >> >> > >> >> >Your use of the source code for the these subcomponents is subject >>to >> the >> >> >terms and conditions oftheir respective licenses. >> >> > >> >> >See the LICENSE file for a list of subcomponents and dependencies >>and >> >> >their respective licenses. >> >> >--------------------------------------------------------- >> >> > >> >> >Is that agreeable? Or are there conflicting opinions? >> >> > >> >> >If agreeable, i'm happy with that even though I did a lot of work >>that >> is >> >> >up for the chopping block. Of course, that wasn't completely wasted >> >> >effort >> >> >- found two LGPL licensed products in our stuff that were being >>pulled >> in >> >> >from other dependencies. >> >> > >> >> > >> >> > >> >> > >> >> >On Thu, Apr 2, 2015 at 11:06 AM, Rob Vesse <[email protected]> >> wrote: >> >> > >> >> >> Stephen >> >> >> >> >> >> My thoughts on this - and please bear in mind you are going to >> receive >> >> >> lots of conflicting opinions and advice any time this gets >>discussed >> - >> >> >>are >> >> >> as follows. Also please remember that IANAL. >> >> >> >> >> >> NOTICE looks way too busy, it is for required notices only. You >> should >> >> >> not need to list out the Copyright statements for everything you >> depend >> >> >>on >> >> >> since most ALv2 compatible licenses don't contain attribution >>clauses >> >> >>that >> >> >> would require this. Usually it is sufficient to simply have text >>of >> the >> >> >> following form in the NOTICE file >> >> >> >> >> >> "Apache Tinkerpop depends on components with separate copyright >> notices >> >> >> and license terms. >> >> >> >> >> >> Your use of the source code for the these subcomponents is >>subject to >> >> >>the >> >> >> terms and conditions oftheir respective licenses. >> >> >> >> >> >> See the LICENSE file for a list of subcomponents and dependencies >>and >> >> >> their respective licenses." >> >> >> >> >> >> >> >> >> Secondly surely most of these things are binary dependencies only? >> >> >> >> >> >> As Matt already noted you should have a separate LICENSE and >>NOTICE >> for >> >> >> your source versus your binaries, most of what appears currently >> would >> >> >> appear to only apply to your binary and not your source. Unless >> >> >>Tinkerpop >> >> >> source code actively bundles other source code under other >>licenses >> then >> >> >> you should basically have nothing except the basic Apache License >>in >> >> >> LICENSE and the basic copyright notice in NOTICE. You are >> encouraged to >> >> >> create and maintain separate LICENSE and NOTICE for your binaries >> which >> >> >> should be placed elsewhere in the tree or named appropriately to >> >> >> distinguish them. >> >> >> >> >> >> For the LICENSE there is no need to list dependencies which are >>under >> >> >>the >> >> >> Apache License, it is reasonable to assume that if the component >> isn't >> >> >> explicitly called out that the main Apache License applies to it. >> >> >> >> >> >> You appear to have replicated the BSD license several times in the >> >> >>LICENSE >> >> >> file, I'm unclear if this is strictly necessary or not (whether >>the >> >> >> copyright notices require this) or if it is enough to just put the >> main >> >> >> license text once and list the components to which it applies >> >> >> >> >> >> Netty and NOTICE - The Netty NOTICE file is horrific and most of >> what is >> >> >> in their NOTICE file actually belongs in LICENSE in my opinion. >>If a >> >> >> project is external to the ASF do not assume that they are using >>the >> >> >> NOTICE file correctly as the ASF would. >> >> >> >> >> >> Note that I would wait to hear the other (possibly conflicting) >> opinions >> >> >> from other mentors before you do any substantial further work on >>this >> >> >> >> >> >> Rob >> >> >> >> >> >> On 02/04/2015 14:32, "Stephen Mallette" <[email protected]> >> wrote: >> >> >> >> >> >> >I've made pretty good progress with the notice/license file, but >>not >> >> >>quite >> >> >> >done. Could I ask that Matt/others take a look at what I have so >> far >> >> >>to >> >> >> >be >> >> >> >sure that I'm on the right track: >> >> >> > >> >> >> > >> https://github.com/apache/incubator-tinkerpop/blob/master/NOTICE.txt >> >> >> > >> https://github.com/apache/incubator-tinkerpop/blob/master/LICENSE.txt >> >> >> > >> >> >> >If so, I will complete with the pattern than I'm following. I >>will >> say >> >> >> >that if it is confirmed that I am doing this right, very few >>other >> >> >> >projects >> >> >> >are doing it right. that would include some very big named >> projects. >> >> >> > >> >> >> > >> >> >> > >> >> >> >On Wed, Apr 1, 2015 at 5:11 PM, Matt Franklin >> >> >><[email protected]> >> >> >> >wrote: >> >> >> > >> >> >> >> On Wed, Apr 1, 2015 at 5:01 PM Stephen Mallette >> >> >><[email protected]> >> >> >> >> wrote: >> >> >> >> >> >> >> >> > Matt, your advice was a big help in getting me going. >> Hopefully, I >> >> >> >>can >> >> >> >> get >> >> >> >> > this all pretty close to your expectations by the time I'm >> done. A >> >> >> >> couple >> >> >> >> > of follow up questions: >> >> >> >> > >> >> >> >> > 1. What do I do with dual-licensed stuff? Do i just choose >>the >> >> >> >>favorable >> >> >> >> > license and list it under that section? >> >> >> >> > >> >> >> >> >> >> >> >> Choose the appropriate license and include that one. If you >>want >> to >> >> >>be >> >> >> >> especially thorough, you can note that the lib was dual >>licensed >> >> >>next to >> >> >> >> the name in the license file e.g. >> >> >> >> >> >> >> >> com.x.y.z.foo (Dual Licensed, chose ASLv2) >> >> >> >> >> >> >> >> >> >> >> >> > 2. Does the NOTICE just need the copyright information? >>Like, >> BSD >> >> >> >>seems >> >> >> >> to >> >> >> >> > indicate that I need to preserve the copyright, but i have >>the >> >> >>entire >> >> >> >>BSD >> >> >> >> > license with copyright in LICENSE already - do i need just >>the >> >> >> >>copyright >> >> >> >> > in >> >> >> >> >> >> >> >> NOTICE? or do i satisfy things by simply including the >>entirety of >> >> >>the >> >> >> >>BSD >> >> >> >> > license in our LICENSE file? or am i just overthinking at >>this >> >> >> >>point? :) >> >> >> >> > >> >> >> >> >> >> >> >> NOTICE just needs the copyright information. LICENSE should >>have >> the >> >> >> >>full >> >> >> >> text, including the copyright. That is the best way I have >>seen >> to >> >> >>meet >> >> >> >> the license requirement >> >> >> >> >> >> >> >> >> >> >> >> > >> >> >> >> > Thanks, >> >> >> >> > >> >> >> >> > Stephen >> >> >> >> > >> >> >> >> > On Wed, Apr 1, 2015 at 1:48 PM, Matt Franklin >> >> >> >><[email protected]> >> >> >> >> > wrote: >> >> >> >> > >> >> >> >> > > On Wed, Apr 1, 2015 at 1:23 PM Stephen Mallette >> >> >> >><[email protected]> >> >> >> >> > > wrote: >> >> >> >> > > >> >> >> >> > > > Mentors, >> >> >> >> > > > >> >> >> >> > > > In preparation for release, I wanted to try to get the >> LICENSE >> >> >>and >> >> >> >> > NOTICE >> >> >> >> > > > files looking good. I read the information i could find >>on >> the >> >> >> >> Apache >> >> >> >> > > site >> >> >> >> > > > and studied the files of other Apache projects that have >> done >> >> >> >> releases >> >> >> >> > > and >> >> >> >> > > > I can only say that after all that I'm still confused. I >> just >> >> >> >>don't >> >> >> >> > see >> >> >> >> > > a >> >> >> >> > > > clear pattern for producing these files that I can >>follow. >> >> >> >> > > > >> >> >> >> > > > Could someone please provide some advice on what is >>expected >> >> >>here? >> >> >> >> > > > >> >> >> >> > > >> >> >> >> > > Unfortunately, it is more art than science on the NOTICE. >> Here >> >> >>are >> >> >> >>the >> >> >> >> > > general guidelines I follow (and look for) >> >> >> >> > > >> >> >> >> > > 1) Different NOTICE/LICENSE files for source and binary >> >> >> >>distributions. >> >> >> >> > The >> >> >> >> > > source distribution should ONLY contain entries for CODE >>that >> has >> >> >> >>been >> >> >> >> > > integrated from 3rd parties, IE if you pulled a class in >>from >> >> >>some >> >> >> >> other >> >> >> >> > > project. The binary files need to have relevant entries >>for >> ANY >> >> >> >> > dependency >> >> >> >> > > included in the distribution, in addition to the code >>entries. >> >> >> >> > > >> >> >> >> > > 2) NOTICE files should only contain entries for >>binaries/code >> >> >>where >> >> >> >>the >> >> >> >> > > license specifically asserts that a copyright statement be >> >> >>included >> >> >> >> > beyond >> >> >> >> > > the license. >> >> >> >> > > >> >> >> >> > > 3) LICENSE files should be organized such that one copy of >> >> >>identical >> >> >> >> > > license text exits and a list of libraries/classes that are >> >> >>licensed >> >> >> >> > under >> >> >> >> > > it are listed IE >> >> >> >> > > >> >> >> >> > > x,y,z dependencies are licensed under the following: >> >> >> >> > > >> >> >> >> > > <license text> >> >> >> >> > > >> >> >> >> > > 4) BSD and MIT style licenses are often modified to include >> >> >>specific >> >> >> >> text >> >> >> >> > > from the licensor. These will need to have individual >>copies. >> >> >>#3 >> >> >> >>is >> >> >> >> > only >> >> >> >> > > for IDENTICAL licenses, such as the ASL v2, EPL, CDDL, etc. >> >> >> >> > > >> >> >> >> > > >> >> >> >> > > > >> >> >> >> > > > Thanks, >> >> >> >> > > > >> >> >> >> > > > Stephen >> >> >> >> > > > >> >> >> >> > > >> >> >> >> > >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >>
