[License-discuss] Proposal: Apache Third Party License Policy

[jonathon]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



On 28/05/2015 16:48, Tzeng, Nigel H. wrote:

>> Right now, if I want to use a software package distributed by The Apa
che
>> Software Foundation, I can safely assume ^1 that it is the standard

> You still need to read the LICENSE & NOTICE files.

That is why I wrote:  « During coding, source code licenses are verified
to be what was expected, and what was advertised.»

By way of example, if I'm planning a project that requires Big Data
Analysis, and needs to scale up from petabytes of data, currently, I can
safely assume that Apache Hadoop uses a standard Apache License.
If this proposal takes place, I'll have to look at the license and
notice for every file in Hadoop, during the project planning stage, as
well as during the coding.
For a project planner, the difference is spending 30 minutes playing
with something from The Apache Foundation, to see if it "works" and
spending hours, ^1 verifying that the licenses are what they purport to
be, before spending any time playing with the software, determining
suitability for the project.  And then during the coding process,
somebody will have to spend time verifying that the licenses are what
they were purported to be, and checked out as being, during the project
planning stage.

^1: I am aware of software that reads License and Notice files, to
determine that they conform with known, accepted, licenses.  However,
that software can overlook bizarre clauses.

jonathon

  * English - detected
  * English

  * English

 <javascript:void(0);>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBAgAGBQJVZ1JrAAoJEE1PKy9+kxpl16IQAINYeuNdZaUWEFNSWGWBEAkU
ueUXuHsZwGZf2MJkGiw0sdfqMMtATxSqHPWgiNz7BDaIKR6VMHgsD5zQ9Hlwfw1k
l4fLBDIctrq4A49tDFpR3nSabE7jwUgR790RnsV3rR/HBdczzx6vrNTxXhrC5CMv
LY+Y8R/39E/dtUIj1kwnhQWYyi+iQGb/10lDtwHCVeALh5rZF9Apd73QsPCV+H6u
//VJE//zHu/UJmrIX/h9ZyEQwQ93GLoouimTjjVEYhnHPRc6m5HQuLntU4J+rCUV
bPArdkQuRFpduMHIbtZ0kHwsqowZDeM5GDePZDbKHst5kXRta8Q1wXn5Jkm4u8+0
zq22ioPqinhuZdIbhzgnseA3uGnOTxkDVixh9WByyQeZ9H16bfYdEAQpFrGgHkXN
X+4yOtzk/7EhGjmf52PBc4YClVaahbN0kxaU2O+9WJDA/qIF9CBoUnGKzGDr2VXF
SPaW3DlN0PONhJWNM6YVglm7+aywPVZ8ITGBQYj31Z9B2CTtnwDl2TwhJio1ECDo
pLl1bH25YOo56jQXRS1jbMec1X30Ludn14/ubuTd7PrqUBZFtb/ThPxp5UzVGxps
K1OXAwHBKPpaJUzLvn69Pl2JNG9SW5Giaf1Gt7bb6FnM+hLFtST58Js1l4PG8js8
U1qQM/OvDkNYy+o8YEz/
=xL4Y
-----END PGP SIGNATURE-----