Licenses and Legal Matters

This is a guide from developers for developers and therefore not an official legal document. We try to be as accurate as possible but cannot guarantee that there are no mistakes. If in doubt, please send a question to the Opencast developer mailing list, to the Opencast Board or to the Apereo Foundation, preferably in that order.

Which Licenses May I Use for Opencast?

All libraries that are used in Opencast need to be compatible with the Educational Community License version 2.0:

  • In short, if the license is on this list, it is fine to use the library:

    • http://www.apache.org/legal/resolved.html#category-a
  • If instead it is listed here, we cannot use it:

    • http://www.apache.org/legal/resolved.html#category-x

Everything else needs to go to the Apereo lawyers.

Here is the slightly longer section from the „Apereo Licensing & Intellectual Property Practices“ page:

Third-Party Content

Third-party content (source code, binary artifacts like libraries, documentation, etc.) is anything that was not submitted directly to Apereo or that is not covered under an ICLA, CCLA, or SGLA. Apereo projects can use third-party content as long as the project is in compliance with the license under which the content is acquired, and as long as use of the third-party content does not violate Apereo's own licensing and policies. Use of any third-party content not available under one of the licenses on ASF's "Category A" list must first be reviewed by the project’s governance body since this has implications for how the derivative work can be used. See the Apereo documentation on Third-Party Licenses for more details.

Third-party content should be handled much differently from Apereo content. Copyright and license notices inside source files should not be modified and the standard Apereo source header should not be added. Licenses for the third-party content should be included with the distribution and appropriate notices should be included in the NOTICE file. Minor modifications to third-party sources should be licensed under the same terms as the original third-party source, while major modifications to third-party sources should be handed on a case-by-cases by the project's governance body.

How To Label Third Party Libraries

Third party libraries that are used within an Opencast system in production need to be listed in the NOTICES file, which can be found in the root directory of our code repository. Libraries and tools that are only used for testing or building the project, or are run via system call, do not need to be listed (e.g. maven, maven plugins, junit, ...).

JavaScript Libraries

For JavaScript libraries, list the file or folder that is included and give a short statement about the copyright and license. This can usually be taken from the copyright header at the top of the library.

Example:

modules/matterhorn-admin-ui-ng/src/main/webapp/lib/angular/*
  AngularJS v1.3.6
  (c) 2010-2014 Google, Inc. http://angularjs.org
  License: MIT

Java Libraries / Maven Dependencies

Java dependencies are listed pre module. Maven provides some helpful tools to list dependencies and even report libraries. Have a look at the output of mvn dependency:list and mvn dependency:tree or generate a full report for a module using:

mvn -s settings.xml project-info-reports:dependencies

This will create a file target/site/dependencies.html containing a full report, including the library versions and licenses.

Finally, add the library and license to the NOTICES file in the form:

rn-workflow-service-remote
  GroupId       ArtifactId    License
  commons-io    commons-io    The Apache Software License, Version 2.0