On Wed, Jul 6, 2011 at 8:52 AM, Dan Haywood <dkhayw...@gmail.com> wrote:
<snip> (Apologies if I've missed any changes in Apache policy - please jump in and correct me) > 1. as I understand it, notices and licenses for 3rd party products should > not go in NOTICE and LICENSE, but should go in DEPENDENCIES. This can be > generated automatically using maven-remote-resources-plugin; missing > information can go in supplemental-models.xml file. The > apache-incubator-disclaimer-resource-bundle (for > maven-remote-resources-plugin) also allows the DEPENDENCIES text to be > customized. AIUI DEPENDENCIES is fine for plain libraries [5]. Providing that the information is complete, then it's ok for other stuff but best practice is to ship every license as text, rather than by reference. (To use a public license, you need to be issued with a copy. So, it's convenient to be able to have a copy included by Apache.) > 2. The NOTICE, in particular, should not be modified at all. I know there > are many Apache projects that haven't caught up with this guidance, AIUI the Apache policy on NOTICEs remains the same [1] include only what's required and nothing more. For most projects, this means the plain NOTICE but there are some exceptional cases, for example [2] and [4]. One day hopefully this complexity will be automated... Robert [1] http://www.apache.org/legal/src-headers.html#notice [2] when a project includes source licensed as per [3] [3] a license requiring an attribution NOTICE of some kind [4] shipped an artifact licensed as per [3] without including it's NOTICE (some jars in Maven central fall into this category eg. some spring releases) [5] ie those that don't aggregate dependencies --------------------------------------------------------------------- To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
