{"action":"opened","issue":{"url":"https://api.github.com/repos/cf-tm-bot/cli/issues/431","repository_url":"https://api.github.com/repos/cf-tm-bot/cli","labels_url":"https://api.github.com/repos/cf-tm-bot/cli/issues/431/labels{/name}","comments_url":"https://api.github.com/repos/cf-tm-bot/cli/issues/431/comments","events_url":"https://api.github.com/repos/cf-tm-bot/cli/issues/431/events","html_url":"https://github.com/cf-tm-bot/cli/issues/431","id":199100352,"number":431,"title":"As a software distributor, I want to **include copyright** statements from cf CLI **dependencies** so that I am compliant with their conditions for distribution - Story Id: 137140225","user":{"login":"cf-tm-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-tm-bot","html_url":"https://github.com/cf-tm-bot","followers_url":"https://api.github.com/users/cf-tm-bot/followers","following_url":"https://api.github.com/users/cf-tm-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-tm-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-tm-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-tm-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-tm-bot/orgs","repos_url":"https://api.github.com/users/cf-tm-bot/repos","events_url":"https://api.github.com/users/cf-tm-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-tm-bot/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-01-06T01:06:16Z","updated_at":"2017-01-06T01:06:16Z","closed_at":null,"body":"**This story can wait as none of our current dependencies require attribution in a NOTICE file.**\n(although, would be nice to have one with the CFF copyright statement)\nAlso, it may be more efficient to create a static file in the GH repo instead of generating it automatically: we don't add new dependencies that often. That would also make it easier to lay it out better: https://wiki.creativecommons.org/wiki/Best_practices_for_attribution\n\nBackground of this story/requirement is summarised in http://www.apache.org/dev/licensing-howto.html#binary.\n\nNOTE TO SELF:\n[Apache 2.0 mandates](https://github.com/cloudfoundry/cli/blob/master/LICENSE#L107-L112) to bundle a NOTICE file if Apache 2.0 licensed dependencies have one, and include `the attribution notices contained within such NOTICE file`.\n\nGrepping current vendored dependencies, there are no NOTICE files!\n(But looking at the repo's, they'll follow soon)\n**Looking at docker/docker's, attribution notices are hard to grep for.\nPrepare and update this file manually?**\n\nsee also https://github.com/apache/spark/blob/master/NOTICE\nhttps://android.googlesource.com/platform/system/core/+/771ab014c24a682b32990da08e87e2f0ab765bd2/NOTICE\nAttribution list in NOTICE: https://github.com/Netflix/asgard/blob/master/NOTICE.txt\nhttps://svn.apache.org/repos/asf/httpd/httpd/trunk/LICENSE\nhttps://www.cloudera.com/documentation/other/Licenses/topics/Third-Party-Licenses.html\n\n[Apache suggests to add LICENSE file first to archives so it appears on the top](http://apache.org/dev/apply-license.html#new)\n\n* Windows binary: include LICENSE, NOTICE\n* Linux tgz: include LICENSE, NOTICE\n* OS X tgz: include LICENSE, NOTICE\n* Windows installer: include LICENSE, NOTICE, copy to same location as cf.exe\n* Deb: debian/copyright, NOTICE.txt\n\n\nidea for debian/copyright:\nincl: Apache 2.0 license\nothers & copyright in comments:\n\nPlease include in the 64 bit Windows binary (zip) distribution of the cf CLI (other binaries and installers follow in subsequent stories), a file named `NOTICE` with the following content:\n\n1. The following:\n\n   ```\n   Copyright (c) 2015-Present CloudFoundry.org Foundation, Inc. All Rights Reserved.\n   \n   This product contains software that is Copyright (c) 2013-2015 Pivotal Software, Inc.\n   \n   ```\n\n2. Followed by, for each vendored dependency that ends up in the built cf CLI (i.e. exclude dependencies only used for testing):\n  1. If the dependency is MIT, Simplified BSD or New BSD licensed, move on to next dependency;\n  1. If the dependency is Apache 2.0 licensed *and* has no \"NOTICE\" text file, move on to next dependency;\n  1. If the dependency is Apache 2.0 licensed *and* has a \"NOTICE\" text file:\n    1. All attributions in that NOTICE file:\n\n   ```\n   \n   This product includes software (https://github.com/cloudfoundry/cli/tree/master/vendor/github.com/cloudfoundry-incubator/cli-plugin-repo/web) that is:\n   Copyright (c) 2015-Present CloudFoundry.org Foundation, Inc. All Rights Reserved.\n   Copyright (c) 2014-2015 Pivotal Software, Inc.\n   and is licensed to you under the Apache License, Version 2.0 (the \"License\").\n   \n   ```\n\n\n   ```\n   \n   This product includes software (https://github.com/cloudfoundry/cli/tree/master/vendor/github.com/docker/docker) that is:\nCopyright (c) Keith Rarick, licensed under the MIT License.\n   \n   ```\n\nand at the end, add:\n```\nThis product is licensed to you under the Apache License, Version 2.0 (the \"License\").\n\nYou may not use this product except in compliance with the License.\n```\n\n\n---\n\nMirrors: [story 137140225](https://www.pivotaltracker.com/story/show/137140225) submitted on Jan 6, 2017 UTC\n- **Requester**: Dies Koper\n- **Estimate**: 0.0"}}
{"actor":{"display_login":"cf-tm-bot"}}