search

containerd / continuity

A transport-agnostic, filesystem metadata manifest system
https://containerd.io
Apache License 2.0
141 stars 67 forks source link

Please clarify copyright #112

Closed elboulangero closed 6 years ago

elboulangero commented 6 years ago

Dear containerd authors,

could you clarify the copyright for continuity, maybe like it was done in https://github.com/containerd/fifo/pull/15/files ?

Also, while grepping for the keyword 'Copyright', I found sysx/asm.s which has this mention:

// Copyright 2014 The Go Authors.  All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

However the license file of continuity is the Apache license file, so maybe something should be changed here, like adding a LICENSE.BSD file, and referring to it in sysx/asm.s. Or something similar.

Thanks

AkihiroSuda commented 6 years ago

cc @stevvooe @dmcgowan

Can we eliminate asm.s?

stevvooe commented 6 years ago

That file is distributed by the Go team, unmodified. The header is correct and accurate.

onlyjob commented 6 years ago

I think the point is that the file is distributed without license as header refers to license file, which is not the project's license.

Whether file is modified or not is irrelevant - either license allows modification.

estesp commented 6 years ago

There is no code distribution of the vendored content in most Golang-source projects. For properly understanding how vendored 3rd party licensing works, you need a tool like FOSSA which understands that dependency projects have their own code locations and licensing. Containerd has been FOSSA scanned and you can follow the link from the main containerd project to the FOSSA report to see 100s of dependent packages and their own code locations and licenses in their own projects.

There is no way for us to replicate each dependent project's license here in this project, nor will you find that in any other major Golang project (e.g. Docker, Kubernetes) as that is the nature of the "vendoring" model that is used by default in most Golang projects.

estesp commented 6 years ago

Also, I realize earlier comments were regarding temporary files waiting to be in the upstream golang.org/sys/x package; those files are no longer in our repository at all, so maybe this issue is moot now anyway?

Will close for now unless there are further developments here.

elboulangero commented 6 years ago

Dear Phil, thanks for feedback.

Also, I realize earlier comments were regarding temporary files waiting to be in the upstream golang.org/sys/x package; those files are no longer in our repository at all, so maybe this issue is moot now anyway?

Indeed, this file is gone.

The issue here is not about the vendor directory, it's about the code of continuity.

Continuity comes with a license file, so I understand that the code is licensed under Apache 2.0. That is no problem. However license and copyright are two different things, and as of today there's still no explicit mention of copyright in continuity. None of the source file have a copyright mention.

I don't have permission to re-open the issue, but I believe it should be re-opened until this is fixed.

Thanks!

mikebrow commented 6 years ago

yeah this was two issues in one :-)

The remaining issue is that the source files (all of them) are missing the boilerplate copyright and license declaration. Incidentally said boilerplate is the way the apache license, itself, says to apply the license to the source. https://github.com/containerd/continuity/blob/master/LICENSE#L180-L201

Needs to be done before release?

estesp commented 6 years ago

Totally missed we hadn't done the fileheader fixup in this subproject; done in PR #129