Open Source Licensing, Copyright Notices, Contributions: What To Do?
Posted by Davy Brion on December 20th, 2009
There are two interesting problems that i’m facing with open-sourcing Agatha, and i’m not quite sure how to deal with it correctly. The first is how to apply the license of my choice to the actual code. I’m using Apache License 2.0, and this is their recommendation (emphasis mine):
To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don’t include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
This sort of implies that i’m required to put this boilerplate notice in each file, which is just tedious and the odds are pretty high that you’re going to forget to put this in one (or more) of the files that will be added later on.
Instead, i put a LICENSE.txt file in the root folder of the project with the following content:
Copyright 2009 Agatha RRSL Project, original authors and contributors
Licensed under the Apache License, Version 2.0 (the "License");
you may not use the files in this directory structure except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Honestly, i have no idea if i’m allowed to do that. I can’t think of a reason why i shouldn’t be able to do this since it certainly sounds reasonable to do so, but then again i’m not a lawyer and i wouldn’t be surprised if there are reasons for not doing so. If anyone can provide advice on this, it would be much appreciated 
Another thing that left me wondering is the actual copyright notice. In the 1.0 release, i unfortunately used the following copyright statement for both the LICENSE.txt as well as the copyright information on the assembly level:
Copyright 2009 Davy Brion
Now, i did write most of the code, i did start the project and i do own the project. But i did not write all of the code as there have been some contributions from other people. I certainly want to give credit where credit is due, so i’ve changed that copyright notice (both in the LICENSE.txt file and the assembly copyright notices) to:
Copyright 2009 Agatha RRSL Project, original authors and contributors
I then added a CONTRIBUTORS.txt file at the same location of the LICENSE.txt file which contains the names of the contributors and the parts they worked on. I think that’s all i need to do to to be fair and correct, but again, i’m not entirely sure on this.
If anyone can provide feedback on these issues, please do so
December 20th, 2009 at 7:49 pm
For the open source projects I manage, we just use the R# file header text in the “Shared Code settings” section of Resharper. This way, every time a file is changed a Quick Cleanup properly applies the header text, along with making the sure the source is formatted properly.
I do believe it is supposed to be on each file, but I’m not an attorney — that’s just how we interpreted what we read since it clearly indicated source comments.
We do this for Topshelf, MassTransit, Magnum, and several other Apache 2.0 projects.
December 22nd, 2009 at 9:24 am
I also think it is better to apply it to every file. When you distribute it as a zip package i don’t think it is a problem to just add the license file as you did. However when parts of the project end up in search engines (like http://www.google.com/codesearch?q=agatha), the link between the code-file and the license-file could get broken and the user could get the impression that the file is in the public domain, has no license at all,…
December 24th, 2009 at 8:02 pm
For contributor attribution, I think it’s OK to rely on the info in your source control: a list of contributions is difficult to maintain and is pretty sure to go out of sync. Still a nice thing to do, but it looks hard to make it the reference.
One thing I’ve always been wondering about: for binary files such as images, are you supposed to also put copyright notices in? For most image formats, it’s technically possible, but how about when it’s not?
December 25th, 2009 at 11:25 am
@Bertrand
i can only rely on the info in SVN for people with commit access… i want to keep a record of people who send patches that are committed by one of the committers as well
December 26th, 2009 at 9:09 pm
Two very good questions. Let me shed a little (non lawyer) light on it. In my understanding, if you write something you own the copyright. The crux is how do you prove you are the original author. The way to do it is to note it right in your work. In source code that is what header files are for and if you want that even to extend to the binaries generated, then you add a static variable with the Copyright notice. Also important is to spell out truthfully when the work was created/changed. If in doubt, the older work wins, as no one can copy something that did not exist at the time of writing one’s own work.
Copyright should be owned by a natural or legal person, such as you or an Incorporation for your project. this is important as only a copyright holder can sue for infringement. So if “Agatha RRSL Project, original authors and contributors” is not legal person that can file suit in court you copyright notice is not worth that much.
For contributions you should have a contributor’s contract or make otherwise clear, how their copyright is handled. For example you can state that bug fixes are assumed under your copyright, but substantial additions/enhancements are mentioned under shared copyright (like book collaborators) and you mention both names. Still in the case of shared copyright you both have to agree to sue someone in court, so it makes the process more difficult. May be best is to assume the copyright, but mention contributors in a contributor’s file (as you do).
License: As you own the code you and only you are allowed to use it or give permission for others to use it. This is what the license now does it gives permission to use it and to build derivative works of it. The Apache Foundations recommendation is sound, to put the license as well as the copyright in every single file with material creative content. So if you feel your style sheets are not that important, leave it out. Consider that in this day an age, search engines, etc. do publish single files or even snippets of those files, so only putting the license notice into a single file in an archive is not enough. Also, you might mix your code with files you actually licensed from other authors/projects. Putting the notice in every single file does make clear which is which. The actual full license text can be in a single file in the archive.
If all this seems too much a burden, then you can always place the code in to the public domain, giving up you copyright all together.
Full disclosure, I work as a development manager for a company that produces code analysis tools to manage open source in software source code..
December 27th, 2009 at 3:10 pm
@PlanBForOOo
i appreciate the tip on the copyright notice, so i’m definitely changing that back to my name.
as for the license notice in each file… i really don’t get that. If a search engine shows snippets of one of my files and it doesn’t happen to show the license in that snippet, then what good is it to include the license in each file? isn’t it also the responsibility of the person who might use that code to do just a little bit of research about the licensing conditions for that piece of code?
there are quite a few projects that do not include the license notice in each file, and they don’t really seem to suffer any disadvantages because of it.
December 28th, 2009 at 5:58 pm
Hi Davy,
it sure is the responsibility of someone copying/using source code to research it’s license and to be in compliance (Although many programmers don’t seem to get that). However, as with copyright, if you want to proof what license a certain file is under, then you better put a notice there.
For example the person you discover has used your code might claim it came with some other package and that had a readme file saying the package was licensed under the XYZ license (different from your license). So how should the person know that it included your code and that your code was actually licensed under Apache 2.0? So to make it crystal clear, you add the header as recommended by the Apache Foundation. As mentioned I’m not a lawyer, however I trust the Apache Foundation has spend some considerable time and money on lawyers to set the rules right. So if I’d like their license terms for my project, I’d also follow their recommendation to express it.
Yes it is a bit of a hassle, But that is a one time effort and your build scripts can have some test for the presence of the header and so alarm you if you are about to release something that does not contain the header. Then it is less than a minute to correct this.
Thanks for sharing your project under an OSS license!