`NOTICE` file missing, cannot determine who is the copyright holder(s)

[adamscott]

As of the start of the project, it seems that the LICENSE file hasn't been updated. It still indicates the template data.

   Copyright [yyyy] [name of copyright owner]

It is important for thirdparties (including open-source projects) that use this library to know the copyright holder(s) of the code.

[pimterry]

Hi @adamscott. I don't think that's correct - that text is part of the appendix "How to apply the Apache License to your work", and the placeholder is there as part of that explanation. This isn't supposed to be filled out directly, the LICENSE file itself should not be modified.

This text is just an example of how to directly attach licensing to individual files - that excerpt can be included as an inline comment inside individual files (with the placeholders completed) to mark them more explicitly & individually as being licensed under Apache 2. But that's not strictly necessary, and in my experience most projects skip this step and treat the LICENSE file in the root as sufficient indication of the licensing terms of the project (and it is also listed in the package.json too).

As far as I'm aware there's no expectation or formal standard for defining who the copyright holder is. The reality for open source projects is often very complex (e.g. hundreds or thousands of contributors, and in many cases the actual copyright will legally be owned by their employers rather than the individuals anyway). In practice it shouldn't matter - as long as you know you're not the copyright holder, you just need to follow the terms of the license 😄.

Note that I am not a lawyer, this is not legal advice, etc, but I think the approach in this repo is pretty standard practice for licensing in 99% of open source projects I've seen. Does that make sense?

[adamscott]

Hi @adamscott. I don't think that's correct - that text is part of the appendix "How to apply the Apache License to your work", and the placeholder is there as part of that explanation. This isn't supposed to be filled out directly, the LICENSE file itself should not be modified.

You're mixing up the license and the notice. Yes, Apache suggests to leave the LICENSE file alone. But you clearly forgot then to add a NOTICE file.

Usually, on GitHub, projects make the LICENSE file to includes both the license (unmodified) and the copyrights (the notice) afterwards. But as you said, if you don't want to modify the appendix directly, it's OK. (I'm not that familiar with the Apache 2.0 license). But you should add a NOTICE file then, that describes the copyright status of the work. Because Apache 2.0 isn't a copyleft license.

Here's how Apache explains how to apply the license to a project.

Here's a more detailed page about this by the Apache Project. The last part is especially important.

Here's the content of the NOTICE file for the Apache Royale project (that uses the Apache license):

Apache Royale Compiler
Copyright 2023 The Apache Software Foundation

This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).

The Initial Developer of the Original Code, known as Adobe Flex
and Adobe ASC 2.0 and JBurgGenerator.java, is Adobe Systems Incorporated 
(http://www.adobe.com/).
    Copyright 2003 - 2012 Adobe Systems Incorporated. All Rights Reserved.

The flex-compiler-oem compiler contains code written by Jeff Dyer at: 
    Copyright Mountain View Compiler Company (1998-2003).

Portions of JBurgGenerator.java contains code written by Tom Harwood
    Copyright Tom Harwood (2003-2008).

As far as I'm aware there's no expectation or formal standard for defining who the copyright holder is. The reality for open source projects is often very complex (e.g. hundreds or thousands of contributors, and in many cases the actual copyright will legally be owned by their employers rather than the individuals anyway). In practice it shouldn't matter - as long as you know you're not the copyright holder, you just need to follow the terms of the license 😄.

Well, if there's no copyright holder, who can claim the rights for the license? If I copy the code unlawfully, who have standing in courts for stop me if there's nobody that actually owns the code? Licenses are only a tool to apply copyright.

For example, the Godot Engine solved the issue of "who owns the code" with this:

Copyright (c) 2014-present Godot Engine contributors (see AUTHORS.md).
Copyright (c) 2007-2014 Juan Linietsky, Ariel Manzur.

So, technically, even if the copyright is owned by a lot of people, you can actually find out who owns it.

Note that I am not a lawyer, this is not legal advice, etc, but I think the approach in this repo is pretty standard practice for licensing in 99% of open source projects I've seen. Does that make sense?

Unfortunately, no.

[pimterry]

Here's how Apache explains how to apply the license to a project.

This says "consider also including a NOTICE file that references the License" - it's a nicety, it's not strictly required and rarely done in a projects like this IME.

Here's a more detailed page about this by the Apache Project

This is ASF project policy for projects run by Apache directly, not for all projects using the license.

For example, the Godot Engine solved the issue of "who owns the code" with this

Godot's own AUTHORS file referenced here says "This file does not strictly reflect copyright ownership for the engine source code.". Documentation like this exists for recognition of contributions etc - which is great! - but it has no guarantees over who owns copyright.

Well, if there's no copyright holder, who can claim the rights for the license? If I copy the code unlawfully, who have standing in courts for stop me if there's nobody that actually owns the code? Licenses are only a tool to apply copyright.

Anybody can claim copyright over something if they can demonstrate that (e.g. If I could show Godot somehow copied all my work, then I actually own the copyright, very approximately speaking). It doesn't matter whose name is written in a file in the project. In practice the git history is indeed a good basis for demonstrating this kind of thing though.

Coming back to my previous point though: it shouldn't matter, should it? As a user, you just use the project under the license. Why do you need to know precisely who the copyright holder(s) are?