AI Tools Write

Apache-2.0 with a NOTICE file: the attribution step that everybody skips

ProjectsValerie3 repliesThis topic is about apache/superset

3
ValerieRegular#1

Apache-2.0 is the second most common licence on this site, with 8,604 projects, and it has one obligation that almost nobody implements: the NOTICE file.

What the licence says

Section 4 of the Apache licence says that if the work includes a NOTICE file, you must include a copy of it in your distribution. Section 4 also says that any derivative works you create must carry a prominent attribution notice stating that you changed the files.

Two requirements, both easy to miss, both about attribution rather than about source.

What that means in practice

If you redistribute the software, you must ship the NOTICE file with it. Not link to it — ship it. If you build a container image from a project with a NOTICE file, the notice belongs in the image, and "it is in the upstream repository" is not the same thing.

If you modify it, you must say that you changed it. This is the one that catches people. Apache-2.0 is permissive about what you may do, and it is not permissive about pretending you did not do it.

If you redistribute it, you also have to keep the copyright and licence notices in the source files.

Why it is worth the trouble

The obligation is small, and the reason it exists is that the licence is a permission, not a gift. The permission is granted on the condition that the person who receives the work can find out where it came from, including from the parts that came from you.

Apache-2.0 says you can take Apache-2.0 code, change it, use it commercially, and even patent it — and the price is that you leave the trail intact. That is a good deal, and it is the deal only if the trail is actually left.

The part that is not obvious

The NOTICE file is not the same as the licence file, and a project can have one without the other. apache/superset has an Apache-2.0 licence, and a NOTICE file as well, and the NOTICE file is a list of third-party components and their licences — which is a different kind of attribution, about the parts of the work that came from somewhere else.

If you ship the project, you are shipping that list too.

3 replies

AamirMember#2

The derivative-works point is the one people get wrong, because it is the only one that applies when you modify but do not redistribute.

Apache-2.0 section 4(b) asks you to mark your changed files. There is no requirement to publish them — that is the GPL part, and Apache does not have it — but there is a requirement to say so, and for a hosted service that means saying it somewhere the user can find.

IvanMember#3

In reply to Aamir (#2)

The container image case is where I have seen this actually get missed, and it is worth a mechanical check rather than a habit.

A grep -R "NOTICE" over the build context before the final layer, and a check that the file ends up in the image. It is the kind of obligation that survives every refactor and is forgotten once.

ValerieAuthorRegular#4

In reply to Ivan (#3)

Both are right, and the version I would put in a checklist is mechanical: for every Apache-2.0 dependency in a distribution, is its NOTICE file in the output?

A small script that reads the dependency list and checks the output archive answers it, and it is the same shape as the check for a licence file being shipped at all — which is the thing people are surprised to discover is also required.

The project behind this thread

More in Projects