...
Third-party content (source code, binary artifacts like libraries, documentation, etc.) is anything that was not submitted directly to Jasig or that is not covered under an ICLA, CCLA, or SGLA. Jasig projects can use third-party content as long as the project is in compliance with the license under which the content is acquired, and as long as use of the third-party content does not violate Jasig's own licensing and policies. Use of any third-party content not available under one of the licenses on ASF's "Category A" list must first be reviewed by the project steering committee since it has implications for how the derivative work can be used. See the page on Third-Party Licenses for more details.
Third-party content should be handled much differently from Jasig content. Copyright and license notices inside source files should not be modified and the standard Jasig source header should not be added. Licenses for the third-party content should be included with the distribution and appropriate notices should be included in the NOTICE file. Minor modifications to third-party sources should be licensed under the same terms as the original third-party source, while major modifications to third-party sources should be handed on a case-by-cases by the project's steering committee.
...