issue_comments

FYI, xarray is now available in Debian.

Did my explanation make sense?

Yes, I agree and appreciate your feedback 👍.

I'll see what I can put together here to make things easier for downstream distributors. Since we do have a few files with mixed copyright, a NOTICE file could be appropriate.

The complex bit of code embedding is that both MIT and BSD have a clause saying that redistribution from source (even partially) should keep the original copyright notice (which includes authors, dates and license summary). It is straightforward to do when the original file is untouched, however things get a bit more difficult when portions of code gets included in larger modules, or so-called "compatibility" modules, where there is an aggregate of code with mixed copyright.

That's why the NOTICE file is useful. You just have to aggregate all copyright information in this one file and you are guaranteed to comply. Besides, commercial entities or packagers like myself, who need to survey the compliance of each software, have an easier time doing their work.

Did my explanation make sense?

I need a comprehensive list of all embedded code which falls under a different copyright than xarray

yes this makes sense. But just for my understanding. You said:

most projects from the scientific Python stack (including Numpy and Pandas that you mentioned) use the simpler BSD-3-Clause.

What we want to achieve here is properly acknowledge which part of the code is not from xarray, and therefore acknowledge libraries which are under the "simpler" BSD license. So I thought that the rules that should apply here are not Apache's ones but the BSD ones, right?

Most Apache-licensed software follow these guidelines, nonetheless. And for the case of xarray, where there are instances of embedded code from other copyrighted projects, I believe it should be beneficial to follow these conventions too. The final decision is yours at the end.

Regardless of your decision, I need a comprehensive list of all embedded code which falls under a different copyright than xarray.

Thanks,

From the page you link: "This document is a "how to" guide aimed at Apache Committers assembling LICENSE and NOTICE files for an Apache product."

Xarray is not an Apache product, so strictly speaking these guidelines do not apply.

"It does not apply to developers outside the ASF who are applying the Apache License to their work." https://www.apache.org/legal/src-headers.html

Probably we should include text of each license at the appropriate locations, or at least a direct reference to the fact hat it has a different license.

That is indeed the purpose of the NOTICE file. Since the Apache license state that all source code should start with the Apache copyright header, then individual copyrights from embedded portions of code should be listed in an additional NOTICE file to comply with their respective redistribution clauses.

I'm not opposed to adding a NOTICE file

You do know you are supposed to provide one as per the Apache Software Policy, right? Details about its content and formatting are provided here.

I am also providing an example from the ITK project, since you seem to be having doubts about my statement. I can give you many more if your are still not convinced.

but I haven't seen it in other projects in the scientific Python space

Because most projects from the scientific Python stack (including Numpy and Pandas that you mentioned) use the simpler BSD-3-Clause.

Maybe we're all just being careless, though :)

Nope, just yourself in this case.

@ghisvail Thanks for your interest here and your help distributing xarray.

Currently, adapted/copied work is only called out in the code base itself (e.g., 1, 2, 3). But this certainly could be done less haphazardly. Probably we should include text of each license at the appropriate locations, or at least a direct reference to the fact hat it has a different license.

I'm not opposed to adding a NOTICE file, but I haven't seen it in other projects in the scientific Python space that I emulated in xarray (e.g., pandas or NumPy). NumPy doesn't call out all the licenses included it in at all (and there are quite a few), except where the source code itself appears. Maybe we're all just being careless, though :).

As for the Apache license, I see terms like If the Work includes a "NOTICE" text file... but I don't actually see where it requires writing such a file.