apache-2.0: are there plans to handle the content of a NOTICE file?

[mawl]

Hey,

We've got a question from a customer if it would be possible to print out the content of NOTICE files in NOTICE_default or other freemarker based output along with the license texts.

NOTICE files are optionally included in package sources/distributions licensed under apache-2.0.

If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.

You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.

see https://www.apache.org/licenses/LICENSE-2.0.html#redistribution

To fulfill the license requirement, the text of the NOTICE file has to be handled like license text, which are using the category "include-in-notice-file":

ort/examples/license-classifications.yml

Lines 55 to 58 in f222ad5

	- id: "Apache-2.0"
	categories:
	- "permissive"
	- "include-in-notice-file"

ort/reporter/src/main/resources/templates/notice/default.ftl

Line 27 in ce4c831

[#assign noticeCategoryName = "include-in-notice-file"]

examples of notice files:
https://github.com/apache/maven/blob/master/NOTICE
https://github.com/oss-review-toolkit/ort/blob/main/NOTICE

ScanCode Toolkit would get copyright statements in the notice file but no other information, so this wouldn't be an option.

Thanks for your answer.

[sschuberth]

FYI, @maxhbr recently reached out to me with a similar use-case to gather ThirdPartyNotices.txt files from dependencies.

[sschuberth]

A first step would probably be to extend the default LicenseFilePatterns to include "NOTICE" so that these files get included into file archives created by the scanner, if enabled.

[maxhbr]

I think this needs a new concept in the file archiver, e.g. NoticeFilePatterns. Their semantics are slightly different. Otherwise the copyrights in NOTICE are matched to the NOTICE and not the Apache-2.0.

[fviernau]

Mind clarifying the following:

1. Is the desired use case to take all NOTICE files of all (non-excluded) dependencies into account?
2. The NOTICE file of a package x is to my understanding mainly about replicating the licenses of the dependencies of
   x. ORT however make the assumption that the license information for any package is contained in the source code
   repository (or source artifact) of that particular package. This implies that the content of the NOTICE file can be
   resembled by using the license information obtained for each respective package. So, adding the content of (ALL)
   NOTICE would introduce a huge redundancy.

So regarding 2 the following questions

1. why shouldn't we continue to rely on re-assembling the NOTICE file content as ORT has done so far, because according to the base assumption, nothing would be missing there.
2. How would the redundancy (overlap of all NOTICE files in dependency tree) problem be solved, if ORT started considering NOTICE files?

[dgutson]

Sorry my ignorance, why is this related to apache-2.0? (I mean in the title of the issue). Are NOTICE files Apache-2 specific?
Adding a 👍 for interest.

[sschuberth]

Are NOTICE files Apache-2 specific?

More or less yes, but having similar NOTICE files became a de-facto standard also for non-Apache / non-ASF projects to fulfill third-party license obligations. Not all Apache-2.0 licensed projects require a NOTICE file, but ASF projects require one by policy. If one such ASF project with an ASF-style NOTICE file is in your dependency tree, it makes sense to use its NOTICE file as part of ORT's NOTICE file.

[mawl]

Hey,

We have a lot of interest in this feature - I would like to know if there is any progress.

[sschuberth]

I'm not aware of anyone working on it, or planning to do so. Would you be willing to sponsor the development?

[mawl]

@sschuberth: Sponsorship can be an option. What's the best way to get in touch?

[sschuberth]

@sschuberth: Sponsorship can be an option. What's the best way to get in touch?

You can reach out to me under the email address I use for commits in this repo.

[sschuberth]

Is the desired use case to take all NOTICE files of all (non-excluded) dependencies into account?

IMO, yes.

why shouldn't we continue to rely on re-assembling the NOTICE file content as ORT has done so far, because according to the base assumption, nothing would be missing there.

Because (at least according to the opinion of some lawyers) it's not only about resembling the content of the NOTICE file, but to "include a readable copy of the attribution notices contained within such NOTICE file". So literally the same attribution notices should be used, and when regenerating them though ORT, there is a risk of not matching the original attribution notices literally.

How would the redundancy (overlap of all NOTICE files in dependency tree) problem be solved, if ORT started considering NOTICE files?

For people who want and enable this feature once it's there, maybe it's fine to not address the redundancy at all. Yes, it's massive over-reporting, similar to shipping the source code of all OSS dependencies instead of only for those that require it, but it's work.

Later on, we could take a deeper look at how at least Apache projects generate NOTICE or NOTICE.txt files. Individual attribution notices seem to be separated by ---. So maybe we could split and deduplicate whole attribution notices based on that, at least.