verify the license situation prior to each release

• Key: FOR-855
• Type: Bug
• Status: Open
• Priority: Blocker
• Assignee: Unassigned
• Reporter: David Crossley
• Component/s: Project administration
• Affects Version/s: 0.9-dev
• Fix Version/s: 0.9-dev

Description

This should be continually happening anyway, but immediately prior to each release we need to verify that our license situation is in order. This issue should not ever be closed, rather just move the "Fix for Version" on to the next release.

Here are some of the tasks:

A) Ensure that all supporting libraries have a corresponding license. Basically every jar file or other external package needs to have a *.license.txt file. Ensure that any license conditions are met, e.g. for some we must add an entry to NOTICE.txt, while for some others we must not. Remember to abide by the ASF guidelines (e.g. nothing more restrictive than the Apache License).

B) Scan the whole trunk repository to add missing ASF license headers to source files and to ensure that the ASF license headers have not been accidently added to external files. See etc/relicense.txt

C) Remove any author tags.

Comments

[David Crossley]

Here is a link to Cliff's explanatory doc:
http://apache.org/legal/src-headers.html

[David Crossley]

Status:
Part A is still to be done.
Part B is done once, need to do again just prior to release.

Because we let the release slip past the cut-off date of 1 November, we now need to fully meet the new policy. Main job is to organise the license files for supporting products and refer to them.

[Ross Gardler]

With the move to Ivy we will no longer have jar files in the lib directory, they will instead be in tools/ivy.repository/[PROJECTNAME]/jars

As a result we will no longer need to name license files *.license.txt as they can be placed within the projectname directory.

I'm not sure how this affects the related issue FOR-857

I will be performing Part A as I work our dependencies and add them to our ivy repository. I'll post any issues requiring more oversight against this issue.

[Ross Gardler]

I'm not 100% sure that the ASM license is compatible with the ASL2. It's a "simple" license, see branches/ivyBuild/tools/ivy/repository/asm/LICENSE.txt

Does anyone have any knowledge about this before I take it to legal-discuss@a.o

(note forrest 0.8 does not use it so we could always just drop it from our repo if we are unsure)

[David Crossley]

The ASM license is BSD-style which is an allowed license. See http://www.apache.org/legal/3party.html#category-a

You need to add a copy of their license to tools/ivy/repository/[PROJECTNAME]/LICENSE.txt
(which eventually needs to be declared as per FOR-857).

[David Crossley]

I have done part B a couple of times recently and processed our trunk with "Arat" and waded through the results. Nice correlation of reports.

[David Crossley]

Done for 0.8 release. Moving the issue over to next 0.9 rather than closing.

[David Crossley]

Added task "C) Remove any author tags." This has been done in the past (e.g. FOR-123) but it is a continual monitoring job.

There is one tool to list them, in the "commiiters" repository in the "tools' section.

Here is the Board recommendation:
http://www.apache.org/foundation/records/minutes/2004/board_minutes_2004_09_22.txt
and the issue has been discussed many times on various mail lists, if people want to search to learn the rationale.

[David Crossley]

Over the past few weeks i have been gradually developing a Perl script to assist with "Task A)". It intends to ensure that every jar has a matching license file, and that all licenses are referenced in our top-level LICENSE.txt file. Until we fully use Ivy, that will assist with this issue.