As a community organization supporting open source software development, we use a set of licenses, agreements, and policies to manage our software projects and the intellectual property surrounding them. These help us to provide proper governance and sustainability to these projects.

Licensing

Jasig has adopted the licensing practices of the Apache Software Foundation. We also follow the ASF in many of its intellectual property management policies and in its community project structures.

Specifically, the default software license for all Jasig projects is the Apache License, Version 2.0. All packages released by Jasig are implicitly licensed under the Apache License, Version 2.0, unless otherwise explicitly stated. More specific information about the Apache License is available in the Apache License and Distribution FAQ.

Contributor Agreements

Jasig requires that all project contributors complete a Contributor License Agreement (CLA). This agreement clearly defines the terms under which intellectual property is being contributed and gives Jasig broader capabilities to provide proper governance over the project. This makes it possible for Jasig to properly defend the project, its contributors, and its adopters in the case of a legal dispute of some kind. It also allows Jasig to update the licensing of its projects over time as circumstances may dictate.

In all cases, contributors retain full rights to use their original contributions for any other purpose, while providing Jasig and its projects the right to distribute and extend their contributed work.

Individuals must have an BOD:Individual Contributor License Agreement (ICLA) on file with Jasig before any significant contributions will be accepted and before commit privileges will be granted on Jasig projects.

Organizations that have tasked employees to work on a Jasig project should also complete a BOD:Corporate Contributor License Agreement (CCLA) so intellectual property that may have been assigned as part of an employment agreement can still be properly contributed. Individuals still need to submit an ICLA, even when their organizations has completed a CCLA. Individuals are responsible for making sure their organization has completed a CCLA if their contributions are owned by their employer.

When an individual or corporation donates existing software or documentation to a Jasig project, they need to execute a formal BOD:Software Grant License Agreement (SGLA) with Jasig. This typically occurs as part of the Jasig Incubation process for taking on new projects.

Contributor License Agreements may be submitted to Jasig in the following way:

• Snailmail
  • Jasig Licensing
  • P.O. Box 351989
  • Westminster, CO 80035-1989
  • USA
• Fax
  • Attention: Jasig Licensing
  • +1-303-495-3812
• Email
  • Scanned signed copy in PDF form emailed to:
  • licensing@jasig.org

Historical Note: Some Jasig projects were previously managed under the New BSD License. Contributions to these projects were then accepted under the terms of that license. For historical purposes, the New BSD License is broadly interpreted as the Contributor License Agreement for those contributions, and those projects still honor all the terms of that License. New contributions to any Jasig project are now only accepted with an ICLA, CCLA, or SGLA in place first.

Frequently Asked Questions (FAQ)

Why has Jasig adopted the Apache License?

First, we strongly support the use of mainstream software licenses that have been approved by both the Free Software Foundation and the Open Source Initiative. We also feel that License Proliferation is a problem and that all Free / Open Source Software (FOSS) projects should endeavor to use the widely-adopted, well-understood license that best meets their needs.

Since Jasig projects are frequently combined with other open source projects, we wanted to select a license that is widely compatible with those projects and that is generally as permissive as possible. At the same time we wanted to move to a comprehensive license that provides appropriate protections for both contributors and adopters of open source. After reviewing all the mainstream open source licenses, it was clear that the Apache License best fits our needs.

Why not adopt a copyleft license like the GNU General Public License (GPL)?

We support the ideas behind "copyleft" and believe that free software should stay free. However, many of the communities and projects that we regularly collaborate with currently avoid copyleft protection for their projects because they perceive it as a barrier to widespread adoption. Specifically, the "viral" nature of copyleft licenses like the GNU General Public License is viewed negatively by many. In the interests of continued symbiotic relationships with these projects and to promote adoption of Jasig projects as widely as possible, we are not using copyleft licenses.

We do strongly encourage anyone who improves upon a Jasig project to contribute those changes back to the community. This is mutually beneficial since the community gets a better project and the contributor does not have to maintain a diverging codebase.

Ultimately, open source projects must succeed on their own merits – the choice of copyleft protection will not be a major factor in the fate of any project.

Why not adopt the Educational Community License (ECL)?

The Educational Community License v2 (ECL) is essentially identical to the Apache License v2. The only difference is a minor change in section 3 that narrows the conditions of any implicit patent grant. This change was requested by some institutions participating in some key projects specific to higher education. To our knowledge, it is only in use by the Sakai project and the Kuali projects.

Jasig projects have tended to be more infrastructure focused and are not exclusive to the domain of higher education. We did not want to adopt the ECL because its relative obscurity outside higher education would be a barrier to widespread adoption of Jasig projects. We also note that several other infrastructure projects in higher education, such as Fluid and Shibboleth, have also avoided the ECL and have adopted the Apache License.

Why not continue to use the New BSD License as previously used by Jasig projects?

The New BSD License is a very simple and straightforward open source license. Its simplicity is both its greatest strength and its greatest weakness. This license simply does not provide enough protection for either contributors or adopters to really understand the terms under which the software is being shared. We wanted to move to a more comprehensive license that fully defined the nature of the agreement and provided clearer protection to all the parties involved.

Why is Jasig requiring Contributor License Agreements (CLAs)?

There are two main reasons that Jasig requires Contributor License Agreements before accepting contributions to its projects.

The first reason for requiring CLAs is to provide proper legal protection to the contributors and the adopters of the projects. CLAs protect contributors by explicitly making it clear what the conditions are for properly contributing to a project, thereby avoiding any confusion or misunderstandings between the contributor, the project, and the community. CLAs protect adopters of the project by ensuring that the contributions that make up the project are legitimately and appropriate licensed all the way from the contributor to the adopter. Furthermore, CLAs give Jasig better legal standing to defend against violations of the project license, providing protection for both contributors and adopters.

The second reason for requiring CLAs is to allow Jasig to better ensure the sustainability of the project. In the future, there may be unforeseen needs to adjust the licensing of Jasig projects. Without appropriate CLAs in place for all contributions, Jasig would have to seek individual permission from all past contributors in order to make changes to the licensing of the overall project – this could prove impossible in a long-running project with hundreds of contributors. The Mozilla Relicensing effort serves as a cautionary tale as to what can happen to projects that do not have central governance with the ability to adjust project licensing.

How does this policy benefit developers?

As mentioned in some of the earlier questions this policy benefits developers in two ways:

1. The Apache License is a comprehensive license that fully defines the nature of the agreement between the developers of the software and the users of the software and thereby provides clearer protection to all the parties involved, including developers.
2. The Contributor License Agreements make it clear that everyone asserts they are legally entitled to make the developer contributions they are making, and the terms under which they are being made available to Jasig. This clarity provides better protection to the developers and their contributions.

How does this policy benefit users?

As mentioned in some of the earlier questions this policy benefits users in two ways:

1. The Apache License is a comprehensive license that fully defines the nature of the agreement between the developers of the software and the users of the software and thereby provides clearer protection to all the parties involved, including users.
2. The Contributor License Agreements make it clear that everyone asserts they are legally entitled to make the developer contributions they are making, and the terms under which they are being made available to Jasig. This clarity provides better protection to the users because there is an explicit licensing chain fully connecting the copyright holders and the end users.

Who should I contact with questions about Jasig licensing or intellectual property?

Simply send an email to licensing@jasig.org and someone from Jasig will respond to your question as soon as possible.

Implementation

To properly apply Jasig's licensing policy to a project, the following major items must be addressed:

1. The License must be properly included with the project
2. Notices must be properly maintained for the project
3. All Jasig source files must carry a proper source header
4. All third-party content must be handled properly

License

Place a plain-text copy of the license into a file named "LICENSE" in the root directory of the software distribution. This applies to both source and binary distributions of any kind. Use the following link for the contents of this file:

http://www.apache.org/licenses/LICENSE-2.0.txt

Notices

In the same directory as the "LICENSE" file (the root of every distribution), place a plain-text file named "NOTICE". This file must also be included in every source and binary distribution of the project.

The top of the NOTICE file must include the following text, suitably modified to reflect the project name and year(s) of distribution of the current and past versions of the project:

Copyright <Year>, JA-SIG, Inc. 
This project includes software developed by Jasig. 
http://www.jasig.org/ 

Licensed under the Apache License, Version 2.0 (the 
"License"); you may not use this file except in compliance 
with the License. You may obtain a copy of the License at: 

http://www.apache.org/licenses/LICENSE-2.0 

Unless required by applicable law or agreed to in writing, 
software distributed under the License is distributed on 
an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express or implied. See the License for the 
specific language governing permissions and limitations 
under the License. 

The rest of the NOTICE file should contain all required third-party notices.

The NOTICE file may also include copyright notices from contributors, if desired. Contributors should not place individual copyright notices directly into source code files.

Source Header

Every source file (including all code and documentation, excluding the LICENSE and NOTICE files) that is a direct part of the project should include a short license header at the beginning of the file, commented out using the appropriate comment markers for the type of file. This includes all files covered by an ICLA, CCLA, or SGLA. Any third-party files (such as libraries) should not be modified (see the next section).

The following text should be used in the source file header:

Licensed to Jasig under one or more contributor license 
agreements. See the NOTICE file distributed with this work 
for additional information regarding copyright ownership. 
Jasig licenses this file to you under the Apache License, 
Version 2.0 (the "License"); you may not use this file 
except in compliance with the License. You may obtain a 
copy of the License at: 

http://www.apache.org/licenses/LICENSE-2.0 

Unless required by applicable law or agreed to in writing, 
software distributed under the License is distributed on 
an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express or implied. See the License for the 
specific language governing permissions and limitations 
under the License. 

Any copyright notices in source files should either be moved to the NOTICE file or removed completely. Once properly modified, there should not be any copyright notices in any of the source files.

Third-Party Content

Third-party content (source code, binary artifacts like libraries, documentation, etc.) is anything that was not submitted directly to Jasig or that is not covered under an ICLA, CCLA, or SGLA. We can use third-party content as long as we are in compliance with the license under which we acquire it, and as long as use of the third-party content does not violate our own licensing and policies. Use of any third-party content not available under one of the licenses on ASF's "Category A" list must first be reviewed by the project steering committee since it has implications for how the derivative work can be used.

Third-party content should be handled much differently from Jasig content. Copyright and license notices inside source files should not be modified and the standard Jasig source header should not be added. Licenses for the third-party content should be included with the distribution and appropriate notices should be included in the NOTICE file. Minor modifications to third-party sources should be licensed under the same terms as the original third-party source, while major modifications to third-party sources should be handed on a case-by-cases by the project's steering committee.

Notes

It is acceptable to name the required files as "LICENSE.txt" and "NOTICE.txt", but the version without the file extensions is preferred.

Transition Process

Existing Jasig projects, like uPortal and CAS, will need to transition from their current licensing process to this new process. This must be handled carefully to make sure we don't create any future intellectual property problems. For each project, there will be two major steps to this process: 1) moving the committers to the new policy and then 2) moving the codebase to the new policy. The project steering committees will need to be responsible for ensuring this process is executed properly.

Committers

First, we have to make a transition with all the committers. Before we can change over a codebase to use the new license or issue any releases under the new license, we must first get all the current active committers to complete at least an ICLA, and optionally a CCLA. It would also be good to get institutions who have made meaningful contributions to complete a CCLA and to specifically include a grant of all previous contributions within the CCLA.

The steering committee will need to run this process and set a deadline by which active committers must complete an ICLA. Once that deadline is reached, anyone who has not completed an ICLA will have their commit privileges suspended. These privileges will be restored as soon as the ICLA is completed.

Getting organizations to complete the CCLA is encouraged, but optional. Individuals are encouraged to get their organization to complete the CCLA since it provides them with better protection for their contributions. But the ICLA is sufficient to provide Jasig and adopters with the protections we are seeking from this process.

Codebase

Once the active committers have all completed an ICLA, we can then make the transition of the codebase to the new license. There are still some important details for how this needs to be done that are different from how we would handle a new project.

All the requirements for the LICENSE and NOTICE files still apply, so those files should be set up accordingly.

Because all of the preceding contributions to Jasig projects were done under the New BSD License and there were no Contributor Agreements in place, we must continue to honor the terms of the New BSD License under which Jasig has rights to the current codebase. Fortunately, the requirements of the New BSD License and the Apache License 2.0 that we are moving to are fully mutually compatible. The Apache Software Foundation itself considers New BSD licensed projects fully compatible with the Apache License and appropriate for inclusion within Apache projects. See the ASF's Legal FAQ for more details on this, specifically the reference to the "Category A list" of licenses.

To continue to honor the terms of the New BSD License, we simply need to include its required statements in the NOTICE file included with each project. So, the NOTICE file for these projects should contain the following:

Copyright <Year>, JA-SIG, Inc. 
This project includes software developed by Jasig. 
http://www.jasig.org/ 

Licensed under the Apache License, Version 2.0 (the 
"License"); you may not use this file except in compliance 
with the License. You may obtain a copy of the License at: 

http://www.apache.org/licenses/LICENSE-2.0 

Unless required by applicable law or agreed to in writing, 
software distributed under the License is distributed on 
an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express or implied. See the License for the 
specific language governing permissions and limitations 
under the License. 


Requirements for sources originally licensed under the
New BSD License: 

Redistribution and use in source and binary forms, with or 
without modification, are permitted provided that the 
following conditions are met: 

 - Redistributions of source code must retain the above 
   copyright notice, this list of conditions and the 
   following disclaimer. 

 - Redistributions in binary form must reproduce the above 
   copyright notice, this list of conditions and the 
   following disclaimer in the documentation and/or other 
   materials provided with the distribution. 

 - Neither the name of JA-SIG, Inc. nor the names of its 
   contributors may be used to endorse or promote products 
   derived from this software without specific prior written 
   permission. 

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND 
CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, 
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH 
DAMAGE. 

Any additional notices required from third-party sources should then be added to the bottom of the NOTICE file.

The source header needs to be added to every source file in the codebase. This header should replace any existing header that may already be in the file. If there are copyright notices present in the source files, those should be moved to the NOTICE file and should be placed after the text listed above, but before the third-party notices (which should stay at the end of the file).

Once the LICENSE and NOTICE files are properly in place and all the source headers have been modified accordingly, the codebase is now ready for a first release under the new license.