Assembling LICENSE and NOTICE files

This is a "how to" guide for Apache Committers assembling LICENSE and NOTICE files for their project's product.

Overview

The LICENSE file communicates the licensing of all content in an Apache product distribution. It always contains the text of the Apache License, and sometimes more information.

The NOTICE file is described in section 4.4 of the Apache License version 2.0. It is required by ASF policy.

The complete requirements for LICENSE and NOTICE files are available.

Guiding principle

The LICENSE and NOTICE files must exactly represent the contents of the distribution they reside in. Only components and resources that are actually included in a distribution have any bearing on the content of that distribution's NOTICE and LICENSE.

Location

LICENSE and NOTICE files belong at the top level of the source tree. ASF prefers that the files have their bare names, but a PMC can opt to call them LICENSE.txt and NOTICE.txt.

Step-by-step instructions

To assemble LICENSE and NOTICE files from scratch for products with complex requirements, follow these steps:

  • Copy the full Apache 2.0 license text into a LICENSE file.
  • Create a 'NOTICE' file specific to your product's details, and complying with the instructions below. An example NOTICE file is at the bottom of this page.
    • Add any mandatory legal notifications specific to the IP of your product.
    • For any bundled dependency, consider whether LICENSE and/or NOTICE need to be modified. Do not modify LICENSE or NOTICE for non-bundled dependencies.

Bundling permissively-licensed dependencies

Bundling a dependency which is issued under one of the following licenses is straightforward, assuming that license applies uniformly to all files within the dependency:

  • BSD (without advertising clause)
  • MIT/X11

In LICENSE, add a pointer to the dependency's license within the distribution and a short note summarizing its licensing:

This product bundles SuperWidget 1.2.3, which is available under a
"3-clause BSD" license. For details, see deps/superwidget/.

Under normal circumstances, there is no need to modify NOTICE to mention a bundled dependency.

NOTE: It's also possible to include the text of the 3rd party license within your product's LICENSE file. This is best reserved for short licenses. It's important to specify the version of the dependency as licenses sometimes change as product versions change.

There are a number of other "permissive" licenses which the ASF Legal Affairs Committee has approved for use. Some of these may require additions to NOTICE -- if in doubt, ask for assistance.

Bundling an Apache 2-0-licensed dependency

Assuming that the bundled dependency itself contains no bundled sub-components under other licenses, so the ALv2 applies uniformly to all files, there is no need to modify LICENSE. However, for completeness it is useful to list the products and their versions, as is done for products under other licenses.

If the dependency supplies a NOTICE file, its contents must be analyzed and the relevant portions bubbled up into the top-level NOTICE file.

Bundling other ASF products

It is not necessary to duplicate the line "This product includes software developed at the Apache Software Foundation...", though the ASF copyright line and any other portions of NOTICE must be considered for propagation.

Bundled vs. non-bundled dependencies

You must customize LICENSE and NOTICE files according to the content of the specific distribution they reside within. Do not add to LICENSE and NOTICE dependencies which are not in the distribution. Only bundled bits matter.

Example: If the only difference between apache-foo-1.0.tgz and apache-foo-1.1.tgz is that one bundles SuperWidget while the other forces users to download SuperWidget separately, LICENSE and NOTICE may need to be modified to account for the different bundled bits.

Dependencies of dependencies

Dependencies of dependencies (including so-called "transitive dependencies") are no different from first-order dependencies for the purposes of assembling LICENSE and NOTICE: LICENSE and NOTICE need only be modified to accommodate them only if their bits are bundled.

Modifications to NOTICE

The NOTICE file is reserved for a certain subset of legally required notifications which are not satisfied by either the text of LICENSE or the presence of licensing information embedded within the bundled dependency. Aside from Apache-licensed dependencies which supply NOTICE files of their own, it is uncommon for a dependency to require additions to NOTICE.

Copyright notifications which have been relocated, rather than removed, from source files must be preserved in NOTICE. However, elements such as the copyright notifications embedded within BSD and MIT licenses do not need to be duplicated in NOTICE. You can leave those notices in their original locations.

It is important to keep NOTICE as brief and simple as possible, as each addition places a burden on downstream consumers.

Do not add anything to NOTICE which is not legally required.

Binary distributions

What applies to canonical source distributions also applies to all redistributions, including binary redistributions:

All redistributions must obey the licensing requirements of the contents.

When assembling binary distributions, it is common to pull in and bundle additional dependencies which are not bundled with the source distribution. You must account for these additional dependencies in LICENSE and NOTICE. As a result, the LICENSE and NOTICE files for a binary distribution may differ from those in the source distribution it was built from.

In any case, the principle remains the same: LICENSE and NOTICE must exactly represent the contents of the distribution they reside in.

Example NOTICE file

The following is the text of the NOTICE file for Apache Royale:

Apache Royale
Copyright 2020 The Apache Software Foundation

This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).

The Initial Developer of some parts of the framework, which are copied from, derived from, or
inspired by Adobe Flex (via Apache Flex), is Adobe Systems Incorporated (http://www.adobe.com/).
Copyright 2003 - 2012 Adobe Systems Incorporated. All Rights Reserved.

The Initial Developer of the examples/mxroyale/tourdeflexmodules, 
is Adobe Systems Incorporated (http://www.adobe.com/).
Copyright 2009 - 2013 Adobe Systems Incorporated. All Rights Reserved.

The ping sound effect (ping.mp3) in 
examples/mxroyale/tourdeflexmodules/src/mx/effects/assets
was created by CameronMusic. (http://www.freesound.org/people/cameronmusic/sounds/138420/)

Copyright 2024, The Apache Software Foundation, Licensed under the Apache License, Version 2.0.
Apache® and the Apache feather logo are trademarks of The Apache Software Foundation...