search

jcmturner / gokrb5

Pure Go Kerberos library for clients and services
Apache License 2.0
723 stars 245 forks source link

Missing copyright notice as required by Apache 2.0 license #461

Closed robcowart closed 2 years ago

robcowart commented 2 years ago

For the Apache 2.0 license to be applicable it is necessary to include a copyright notice and license claim. This requirement is established here...

"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).

Can you please add a NOTICE file which includes the copyright notice (including your details as copyright owner) and license claim from the Appendix of the Apache 2.0 License? This will make the use of the license valid and help to get applications using this module through legal review.

Your help here would be much appreciated.

jcmturner commented 2 years ago

My understanding is that NOTICE files are only required for projects in the Apache Software Foundation.

See:

https://github.com/github/choosealicense.com/issues/701

https://opensource.stackexchange.com/questions/7872/how-to-properly-assemble-notice-file-for-new-software-under-apache-license-2-0

robcowart commented 2 years ago

That isn't the plain reading of the Apache 2.0 license. I am not sure if any of the commenters on those posts are lawyers, but the legal department of a few of our customers state otherwise, including one which has a whole team that do nothing but open source compliance. Even GitHub says you need a copyright notice for the Apache 2.0 license (see "conditions" below), and I am sure their legal team reviewed that before they took such a stance.

image

If you think about it, it makes sense. Only the copyright holder has the legal right to license the code. Without a copyright notice there is ambiguity as to who actually has the rights to assign a license, and thus whether the assignment of Apache 2.0 is even valid. Regardless of the license, it is always a good idea to include a copyright notice, as it eliminates this ambiguity.

In the end there is no downside for a copyright notice to be included, but it does eliminate potential issues for those wishing to use the project.

jcmturner commented 2 years ago

For reference I found a good guide here: https://www.linkedin.com/pulse/how-apply-apache-20-license-your-open-source-software-vladim%C3%ADr-gorej?trk=pulse-article_more-articles_related-content-card

robcowart commented 2 years ago

Thanks @jcmturner . That linked article is a good one to save.