2009-09-09 - License details with John Lewis
call: (616) 347-8000, access code: 992610#
Implementation of Jasig License Policy
The agenda for this meeting was to walk through specific examples of of incubating projects to understand concretely what the incubation committee needs to do.
All contributed code must be covered by a contributor agreement and must include Jasig license and proper headers as described below. Anything NOT covered by a contributor agreement is a third party component and must be covered by a third party notice.
Jasig is not asking or requiring any entity relinquish copyright. Copyright stays with the contributing entity.
The following sections are based on a walk through of the legal checklist in our incubation JIRA.
All code properly licensed
Project needs a plain-text copy of the license into a file named "LICENSE" in the root directory of the software distribution. This applies to both source and binary distributions of any kind. Use the following link for the contents of this file: http://www.apache.org/licenses/LICENSE-2.0.txt
In the same directory as the "LICENSE" file (the root of every distribution), place a plain-text file named "NOTICE". This file must also be included in every source and binary distribution of the project. See Jasig license policy implementation for text. The rest of the NOTICE file should contain all required third-party notices.
Third-party Notices
If we are making a binary distribution available then third party notices must be provided for all dependencies. For example the Resource Server is distributed as both war and jar files: http://developer.jasig.org/repo/content/repositories/m2/org/jasig/resourceserver/. The jar file contains only Jasig material so third party components are not included and the third party notice is not needed. However the war file contains fluid components, famfamfam components, jquery as well as several jar files. In this case the 3rd party notices need to include all these components. In each case a person needs to find the notices and license for each of the third party components. The best way to find these dependencies is to look in the binary distribution (war).
How to collect third party notices
Visit the site of the component and determine the license applicable. If it is a license considered Category A by the Apache license, then it is in conformance with the new Jasig license. If it is anything else we'll need to confer with Jasig board on how to proceed. See information on Apache site about third party licensing for information on the categories.
It is not usually the case but sometimes we could also have copy of 3rd party source code - if those notices must also be included. Javascript libraries are examples of included third party source.
All the third party dependencies should be listed on a confluence page associated with the project (not with incubation) so it can be kept up to date in the future.
No non-licensed or license-incompatible dependencies in the code base
Requirements are the same as the above. This is just an opportunity to list incompatible dependencies.
Software license grant complete
An SGLA not needed unless contribution coming from previous legal entity. For example, Bedework was previously licensed by another entity. An SGLA is required from the previously owning entity.
Contributor Agreements
ALL code contributed to Jasig must be covered by a contributor agreement. Each individual contributor must sign an individual contributor license agreement (ICLA) once. If the contributor has authored the contribution as part of their employment then we need to try to get a corporate contributor license agreement. The minimum requirement is an ICLA on file.
Since John will be involved in submitting a CCLA for Unicon, he will include language that covers previous contributions. That language can be used by other institutions for the same purpose.
Code contributed to Jasig
Every source file (including all code and documentation, excluding the LICENSE and NOTICE files) that is a direct part of the project should include a short license header at the beginning of the file, commented out using the appropriate comment markers for the type of file. The text is on the Jasig Licensing page.
As the license header is added to all source Copyright notices are moved to the Notice file. If already in the notices file then copyright is removed. This action does not take away copyright but rather helps retain the copyright notices from disappearing when the binary is built.
Change of java packages
There is no legal requirement to change the java packaging to org.jasig but there is a strong recommendation from the incubation group to make this change.
Trademark
The check for trademark conflicts is separate from the licensing check and must also be performed. See previous notes on how to complete a trademark check.