More legal stuff...on reproducing licenses and notices.... cheers,
Leo On Tue, Dec 6, 2011 at 12:18 AM, Leo Simons <[email protected]> wrote: > ZOMG so many jars! > ------------------ ... > apache-jena-2.7.0-incubator.tar.gz ... I wonder how I forgot to look at this yesterday. Like I went over for the LARQ example, for all the third party stuff (code and/or jars) that are included in a distribution, their license and notice data needs to be carried forward. For example, BSD/MIT/etc LICENSES for included jars have to go into an aggregated LICENSE file, and statements in NOTICE files for ALv2 jars need to go into the distribution NOTICE. Concretely, for this binary tarball, * commons-codec NOTICE says src/test/org/apache/commons/codec/language/DoubleMetaphoneTest.java contains test data from http://aspell.sourceforge.net/test/batch0.tab. Copyright (C) 2002 Kevin Atkinson ([email protected]). Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. ...since the jar doesn't contain that test source that seems ok and we do not carry the NOTICE forward. * httpclient says This project contains annotations derived from JCIP-ANNOTATIONS Copyright (c) 2005 Brian Goetz and Tim Peierls. See http://www.jcip.net ...so that statement needs to go in NOTICE. * icu4j seems BSD-licensed so its license should go into LICENSE * slf4j seems MIT-licensed so its license should go into LICENSE * wstx-asl contains a weird NOTICE file. I don't think anything in there needs to be carried forward since these don't look like legal statements. But, it is most likely simpler and safer just to copy the text it supplies verbatim. * depending on where the xercesImpl binary came from, the relevant NOTICE data needs to be carried forward, which probably is http://svn.apache.org/repos/asf/xerces/java/trunk/NOTICE Portions of this software were originally based on the following: - software copyright (c) 1999, IBM Corporation., http://www.ibm.com. - software copyright (c) 1999, Sun Microsystems., http://www.sun.com. - voluntary contributions made by Paul Eng on behalf of the Apache Software Foundation that were originally developed at iClick, Inc., software copyright (c) 1999. ...but you'll need to check the distro that you got the jar file from. I'm trying to remember how I handled this kind of thing before. Looks like the last time I actually release managed an apache release was in 2007, and what we did then was simply not to ship 3rd party jars at all (not the most user friendly). I guess it's easy enough to just author the distribution NOTICE and LICENSE by hand, since these dependencies don't change all that frequently, and that seems to be what is (still) common practice. Like I said, I did not check the other binary releases, but they need to be checked for this too.
