Per File Copyright and License

[hollyfeld]

I haven't noticed any source with this header content. Should the typical Apache 2.0 header be used?

Boiler plate Apache 2.0 per file content

If desired, please provide the specifics.

[mrinalwadhwa]

Hi Pat, thank you for the suggestion.

I think we want to avoid having to do this per file, if we can, to avoid the extra clutter.

I found this SO thread that points out that one of the original goals of Apache 2.0 was to avoid having to mention the license per file.
https://softwareengineering.stackexchange.com/questions/317041/should-i-add-the-license-in-every-header-and-source-file
https://mail-archives.apache.org/mod_mbox/www-announce/200401.mbox/%[email protected]%3E

to allow the license to be reusable without modification by any project (including non-ASF projects), to allow the license to be included by reference instead of listed in every file

ChooseALicense also says its optional
https://choosealicense.com/licenses/apache-2.0/

So I think we shouldn't do this unless we find a really good legal reason for it.

[hollyfeld]

Hey Mrinal,

I agree that it is optional and adds overhead, but it is also recommended, and I think that merits a couple questions:

1. Why does Apache and so many other well known projects/organizations that use the Apache 2.0 license include the boilerplate?

The main reason is to maintain copyright and license affinity at the file level.

Full Text at Apache Legal

WHY IS A LICENSING HEADER NECESSARY?¶
License headers allow someone examining the file to know the terms for the work, even when it is distributed without the rest of the distribution. Without a licensing notice, it must be assumed that the author has reserved all rights, including the right to copy, modify, and redistribute.

2. What makes Ockam different from these other projects/organizations when it comes to licensing decisions?

I can't think of a difference, and with Ockam providing building blocks for several concepts, developers cherry picking individual source files seems common and ripe for losing license and copyright affinity.

Here is a possible problematic scenario:

Developer X at Company A starts a new project that uses a hardware security module. Ockam has some code that is helpful, but the developer doesn't use Ockam as an SDK for some reason. The developer cherry picks some files and these files have no license headers.

The project is launched and Developer X leaves Company A. Company A starts a new project with Developer Y. Some of the code is relevant from Developer X's project, so Developer Y pulls it into the new project, and by the way, Company A now utilizes a license header for all new work. Developer Y is unaware of Ockam and applies Company A's license. Developer Y also makes a few changes to the file.

Company A is acquired by Company B, and the rabbit hole continues...

Including the license header requires a deliberate act of removal to get into a conflict state, versus a potentially honest mistake.

My 2 cents is that the boiler plate header should be included to prevent inadvertent legal issues and protect against overt ones over the long term, but of course IANAL.

[mrinalwadhwa]

All good points. Thank you for writing them.
I'll pass the thread to our legal team and we can follow whatever they advise.

[jjscheel]

@mrinalwadhwa, I have to agree with @hollyfeld. while it's a pain, practicing good license pedigree is like going to the dentist twice yearly for teeth cleaning: it may not be needed, but it's good hygiene.

As a noob, I'd be happy to spearhead a "cleanup" of module headers. But, won't undertake it until we agreement on what and when.