7

I have a question about the NOTICE and CHANGELOG files in Apache 2.0 license.

Here is the situation: I based my work on an Apache 2.0 licensed project. I did some minor changes (compared to the original work). It seems that I have two problems:

  1. According to the Apache 2.0 license, I have to include NOTICE file if it was in the original work. The problem is, that the notice file in the original work was probably never updated and is possibly incorrect as it does not include notices about library dependencies. Do I have to fix this myself or is it enough to just add the dependencies that were introduced by my changes?
  2. The license also requires that I state changes. The original work did not have any CHANGELOG file and changes were tracked in git (which I guess is not sufficient for the needs of the license). How and in what detail do I state the changes in this situation?
  3. (Bonus question) Because my work will most likely never be merged back to original project git repository I would like to be stated as one of the authors if possible. I suppose, that I add the mandatory license header to the files that I added to the project, but what about the changes in the files that I only modified? Should I add myself to the NOTICE file? I am not sure how would this look like so any example would be appreciated.

Also, I will not distribute it in binary form. Only the source code.

I understand, that this has already been discussed, but I am not sure what to do in a situation like this.

EDIT: As suggested, this is the project: https://github.com/brianfrankcooper/YCSB

EDIT: Please see comments under Thomas' answer if you need more clarification :)

  • 1
    Could you indicate which project you're using as a base? With the specific files involved you'll get more useful answers. – Stephen Kitt Apr 26 '16 at 5:41
  • @StephenKitt Hey, thanks! Hope this helps :) – NefariousOctopus Apr 26 '16 at 9:54
5

Let's break this down.

According to the Apache 2.0 license, I have to include NOTICE file if it was in the original work. The problem is, that the notice file in the original work was probably never updated and is possibly incorrect as it does not include notices about library dependencies. Do I have to fix this myself or is it enough to just add the dependencies that were introduced by my changes?

You do not need to continue to carry a NOTICE file. Section 4d allows you to include the attribution notices in a NOTICE file, within the source or documentation if it is provided alongside the derivative work, or within a display generated by the derivative work. Specifically, the last sentence of 4d allows you to add your own attribution text alongside (by modifying the NOTICE file) or as an addendum to the NOTICE text (putting both in the same file, within another document, or in a display generated by the derivative work).

Since you're stating that the original NOTICE file is wrong, I would consider doing an addendum by either adding a second NOTICE file that is fully correct, by using one file and calling out which was the NOTICE from the original project and which content is related to your derivative work, or in a display and calling out which was the original NOTICE text and which was your NOTICE text. Regardless - make sure that your NOTICE text is fully correct and don't modify the original project's NOTICE text at all.

The license also requires that I state changes. The original work did not have any CHANGELOG file and changes were tracked in git (which I guess is not sufficient for the needs of the license). How and in what detail do I state the changes in this situation?

A CHANGELOG is not required by Apache. The only mention of requirements related to changes is in 4b, which states that if you modify a file, that file must carry a prominent notice that the file has been changed. Typically, in a project that is using the Apache License (at least those released by the Apache Software Foundation), the top of each file will contain the boilerplate header. The method used to state that a file was changed is to add a new copyright line under the original one. If you are applying a new license to the changes, you would indicate this in the boilerplate header section as well.

Assuming that the initial commit to your git repository was the original work and every revision was your contribution to a derivative work, I think that this is sufficient. You are meeting the requirement of 4b by stating that a file has changed. There is no requirement to further identify changes beyond a file level, but your version control repository would allow for that, if necessary.

Because my work will most likely never be merged back to original project git repository I would like to be stated as one of the authors if possible. I suppose, that I add the mandatory license header to the files that I added to the project, but what about the changes in the files that I only modified? Should I add myself to the NOTICE file? I am not sure how would this look like so any example would be appreciated.

When you modify the boilerplate header, you would add your name. If you are keeping the Apache License for your work, you don't need to do anything else. If you are going to apply a different license, then you do need to identify the license for your contributions to mark off what is Apache License and what is under the other license.

The NOTICE file is only used for attribution to other people. For example, if you are including other projects in yours, the NOTICE file or NOTICE text somewhere else, clearly identifies these other projects and the license that they are under. Modifying the NOTICE file to point back to the original project that yours is a derivative work of would also be appropriate.

  • If I understand you correctly: 1. To state changes in file I only add copyright in the boilerplate header. 2. Newly added files contains the apache boilerplate header with only my copyright. 3. So it means that I create my text of the NOTICE and only append text of the original NOTICE stating, that it is the original? – NefariousOctopus Apr 26 '16 at 14:00
  • One more question: "including other projects" includes used third party libraries? Sorry, I want to be 100% sure :) – NefariousOctopus Apr 26 '16 at 14:02
  • @NefariousOctopus 1: Yes. 2: Yes, assuming you are also using the Apache License. Different boilerplate if you choose a different license. 3: Yes, that should be sufficient. 4: Yes, NOTICE is only for third-party work. – Thomas Owens Apr 26 '16 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.