2009-09-09 - License details with John Lewis

Implementation of Jasig License Policy

The agenda for this meeting was to walk through specific examples of of incubating projects to understand concretely what the incubation committee needs to do. 

The following sections are based on a walk through of the legal checklist in our incubation JIRA.

All code properly licensed

Project needs a plain-text copy of the license into a file named "LICENSE" in the root directory of the software distribution. This applies to both source and binary distributions of any kind. Use the following link for the contents of this file: http://www.apache.org/licenses/LICENSE-2.0.txt

In the same directory as the "LICENSE" file (the root of every distribution), place a plain-text file named "NOTICE". This file must also be included in every source and binary distribution of the project. See Jasig license policy implementation for text. The rest of the NOTICE file should contain all required third-party notices.

Third-party Notices

If we are making a binary distribution available then third party notices must be provided for all dependencies.   For example the Resource Server is distributed as both war and jar files: http://developer.jasig.org/repo/content/repositories/m2/org/jasig/resourceserver/.  The jar file contains only Jasig material so third party components are not included and the third party notice is not needed.  However the war file contains fluid components, famfamfam components, jquery as well as several jar files.  In this case the 3rd party notices need to include all these components.  In each case a person needs to find the notices and license for each of the third party components.  The best way to find these dependencies is to look in the binary distribution (war).

How to collect third party notices

Visit the site of the component and determine the license applicable.  If it is a license considered Category A by the Apache license, then it is in conformance with the new Jasig license.  If it is anything else we'll need to confer with Jasig board on how to proceed.  See information on Apache site about third party licensing for information on the categories.

It is not usually the case but sometimes we could also have copy of 3rd party source code - if those notices must also be included.  Javascript libraries are examples of included third party source.

All the third party dependencies should be listed on a confluence page associated with the project (not with incubation) so it can be kept up to date in the future.

No non-licensed or license-incompatible dependencies in the code base

Requirements are the same as the above.  This is just an opportunity to list incompatible dependencies.

Software license grant complete

An SGLA not needed unless contribution coming from previous legal entity. For example, Bedework was previously licensed by another entity. An SGLA is required from the previously owning entity.

Contributor Agreements

ALL code contributed to Jasig must be covered by a contributor agreement.  Each individual contributor must sign an individual  contributor license agreement (ICLA) once.  If the contributor has authored the contribution as part of their employment then we need to try to get a corporate  contributor license agreement.  The minimum requirement is an ICLA on file. 

Since John will be involved in submitting a CCLA for Unicon, he will include language that covers previous contributions.  That language can be used by other institutions for the same purpose.

Code contributed to Jasig

Every source file (including all code and documentation, excluding the LICENSE and NOTICE files) that is a direct part of the project should include a short license header at the beginning of the file, commented out using the appropriate comment markers for the type of file. The text is on the Jasig Licensing page.  

As the license header is added to all source Copyright notices are moved to the Notice file.  If already in the notices file then copyright is removed.  This action does not take away copyright but rather helps retain the copyright notices from disappearing when the binary is built.

Change of java packages

There is no legal requirement to change the java packaging to org.jasig but there is a strong recommendation from the incubation group to make this change.

Trademark

The check for trademark  conflicts is separate from the licensing check and must also be performed.  See previous notes on how to complete a trademark check.