How can I correctly apply the Apache 2.0 licence to contributed code from an existing repository?

Question

Given a repository github.com/x in github that is licenced with Apache 2.0. On their source files they have

Copyright [2019] [Evil Corp]

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Say that I now create a fork of github github.com/x and add some new files of my own under My Corp. I want to release this under Apache 2.0 to the public.

1. Do I need to add an Apache header Copyright [2019] [My Corp] to all of my new contributed source files?
2. If Evil Corp merges my fork/pull request do they have to display my Apache header with Copyright [2019] [My Corp]?
3. What happens if I change existing files from Evil Corp, do I need to change or add to their Apache header?

Answer 1

The copyright line is a statement of who owns the copyrights on that part of the project.

When you add a new file to a project, the copyrights belong to you (or your employer if you created the file as part of your work) and the copyright line should reflect that.

When you make significant creative changes to an existing file, the you (or again your employer) own part of the copyrights on that existing file and you are entitled to have that recognized by adding a copyright line next to the existing copyright line(s). Adding the copyright line is one way to fulfill the Apache 2.0 license requirement of adding a notice to the files that you changed them.

Most changes to, and especially removal of, copyright lines are not-done, because it can be seen as misappropriation of the code or misrepresentation of who created the code which is prohibited by most licenses, including the Apache 2.0 license.

---

To answer your specific questions

1. Do I need to add an Apache header Copyright [2019] [My Corp] to all of my new contributed source files?

Assuming [MyCorp] is the copyright holder of those files, then yes.

2. If Evil Corp merges my fork/pull request do they have to display my Apache header with Copyright [2019] [My Corp]?

They must leave such copyright notices intact in the source code. There is no requirement to actively show them on a GUI.
If you added an attribution notice to a NOTICES file, then they are required to show that.

3. What happens if I change existing files from Evil Corp, do I need to change or add to their Apache header?

If the change has any creative content, then you should add a copyright line next to theirs.

Answer 2

1. Do I need to add an Apache header Copyright [2019] [My Corp] to all of my new contributed source files?

You are not required, but you are allowed and encouraged to do so.

2. If Evil Corp merges my fork/pull request do they have to display my Apache header with Copyright [2019] [My Corp]?

Yes, they will have to keep your notice. Removing or falsifying copyright notices is illegal.

3. What happens if I change existing files from Evil Corp, do I need to change or add to their Apache header?

If your changes make you one of the copyright holders of the file, you are allowed to add your own copyright line to the header. You must not remove or falsify existing copyright notices.

It would be fairly unusual for a contributor to add their name to the header. This would be totally unworkable when there are dozens of contributors. Instead, I would recommend that contributors stay within the conventions of the project, and that projects keep track of the full list of copyright holders in the NOTICE file.