I'm a little confused about the licensing. In the LICENSE file it says that the repository is under MIT license. But in the header of some js files there is a copyright notice with apache-2.0. Does this copyright notice affect the licensing? What is the copyright notice in the file header?
-
1For each bit of copyrighted code you want to copy, you need to figure out who owns the copyright and secure an appropriate license from them that gives you the permissions you need. If a copyright holder provides multiple ways to license the same code, that shouldn't be a problem: just choose one. So that makes me wonder: who actually owns the copyright to that header file? Is it the same party the owns the copyright of the library? If there is just one copyright holder, does the information from them make it look like the library's license applies to all the files in the library?– David GraysonDec 16, 2021 at 20:56
-
Although code originating in Apache is usually licensed with the Apache license, there's no intrinsic conflict if Apache is the copyright holder and has chosen to issue this particular piece of code under an MIT license, or to allow someone else to do so.– Michael KayDec 17, 2021 at 15:04
-
Did you try to email some author of the file?– Basile StarynkevitchJan 3, 2022 at 10:30
Add a comment
|
2 Answers
A "license" simply means legal permission to do something from a rightsholder. The relevant question is: if the rightsholder sued you for exercising some right (e.g., copying or modifying their copyrighted work), could you prove to a court's satisfaction that you actually had permission to do that? The mismatch between licensing statements makes me uncomfortable saying what a court might decide about what rights had been licensed to you.
Furthermore, this mismatch makes me strongly suspects some Apache 2 files have been taken from another upstream program by this downstream developer, who has licensed their new work under MIT, possibly without satisfying their attribution/license-preservation requirements. I would certainly investigate if the Apache 2 labeled files have been taken from another project. This is generally allowed by the Apache 2 license, but requires keeping copyright notices and the Apache 2 license text, which I can't be sure has happened here. I would hold off on using this code until I identified the original author of each file, verified how they licensed the file, and ensured that my use complied with the requirements of each of those licenses.
answered Dec 15, 2021 at 17:16
-
+1. Yet from the OP's text I don't see whether such attribution is included - it often is not in the LICENSE (which is just that: the license for the overall thing), but in other documentation where credits are given, like readme or similar) Dec 15, 2021 at 21:56
-
@planetmaker Great point; I made my language a little less sure that these aren't provided, but rather it's not clear they're provided. Thanks!– apsillers ♦Dec 15, 2021 at 22:31
-
The requirement to retain and republish license text has become very difficult to satisfy where software is distributed via component libraries such as Maven and Nuget, which often distribute software binaries without their accompanying "red tape" such as license files. Dec 17, 2021 at 15:07
In an ideal world each project would have a homogeneous license for all its files, and components from other projects (and under other licenses) would be in dependencies or the like. But life is what happens while we make other plans.
In the real world we see some projects, which have files copied in from other projects, and which have other licenses. As an example I often use org.springframework.security:spring-security-crypto , it clearly seems to be an Apache 2.0 licensed library. However it includes one file which is under ISC license: BCrypt.java . This fact is not declared anywhere except within that specific file.
Situations like this are difficult to avoid for those using the software, for the development team of the library it would be easy to include the information in their LICENSE or NOTICE file. On the other hand, if the license declaration, the license language and the attribution notices are all included in that file they are likely complying with the legal requirements. Hopefully someone has checked if the different licenses are compatible.
As this is sometimes unavoidable, your question rightly focuses on how to deal with it. The answer is simple: You should respect the license and comply with its requirements. Where there is a specific license declaration in a file it overrides the license declaration of the entire project (which has been made for all files without such individual declaration).
As @apsillers has stated in his answer, if you are unclear where the code comes from, or if you are unclear about the compatibility of the licenses, you should hold off using the code until you are certain that your questions have been satisfactorily answered.
