Many licenses consist of two parts: the license terms, and the license notice where the copyright holders actually grant the license. The Apache license suggests a specific text for this notice.
Here, the upstream software contains only the license terms and metadata about the license, but not the actual notice. This complicates downstream use, but since the intent is clear this is not fatal.
I would suggest that you do attribute the upstream project, but do not synthesize a copyright notice. You do not know who the copyright holder is or when they published the software, but you do have reason to believe they licensed it under the Apache License.
I would use a section 4(d) NOTICE file to explain the origin:
- which files are impacted
- where they were taken from (name/link/author of the project)
- that they were licensed under Apache as well
In the impacted files, I would add a short notice and refer to details in the NOTICE file. If you modify the copied files, per section 4(b) you should add a prominent notice that you changed them. Taken together, you should probably add header comments with the following info:
- from which project the file was taken from
- that details are explained in the NOTICE file
- that the file was modified
You should also add license headers with your own copyright line to the NOTICE file, and to those files that you modified substantially.
If you decide that you do not want to license your code under Apache 2 this is not a problem. But in that case, you should not use Apache's NOTICE mechanism but probably put the relevant information into the LICENSE file itself, or possibly into a README.
