Although EdgeX Foundry is an Apache 2.0 License product, it often uses other open source products, libraries and other works. This is not uncommon for open source efforts. When using other products, contributors must insure that products they use are compatible with the Apache 2.0 license.
PROPOSED - this content is pending review and approval of the TSC and EdgeX Governing Board
Responsibilities
When ever a contributor adds a product or dependency on another 3rd party tool, library, package, or other product to EdgeX (such as adding a new required package to the list of packages required by a Go Lang service), the contributor must check that the addition is compatible with the Apace 2 License of EdgeX. When unsure, contributors should check with the TSC and the Linux Foundation about compatibility before including the addition in any Pull Request or other official artifact contribution.
Contributors must create an Attribution.txt file when submitting the initial Pull Request for any new EdgeX Foundry repository. This Attribution file should contain any used/referenced open source in the repository (see Contents below). This may include reference to other EdgeX Foundry products so that a user or other contributor can easily trace inclusion by association.
Contributors must update the Attribution.txt file when submitting a Pull Request that adds any new used/referenced open source as a result of the Pull Request. This may include reference to other EdgeX Foundry products so that a user or other contributor can easily trace inclusion by association.
Contents of Attribution.txt
The Attribution.txt file is relatively simple. It should contain the following:
"The following open source projects are referenced by [EdgeX Foundry service, package, or artifact containing this file]:"
Iterate the following for each open source product/project referenced:
"[package] (compatible license such as BSC-3, MIT, etc.) [URL to the resource]
[URL to the package's license file]"
Here is an example Attribution file contents
The following open source projects are referenced by Core Data Go:
pkg/errors (BSD-2) https://github.com/pkg/errors
https://github.com/pkg/errors/blob/master/LICENSE
gorilla/mux (BSD-3) https://github.com/gorilla/mux
https://github.com/gorilla/mux/blob/master/LICENSE
gopkg.in/mgo.v2 (unspecified) https://gopkg.in/mgo.v2
https://github.com/go-mgo/mgo/blob/v2-unstable/LICENSE
Location of Attribution.txt
The Attribution.txt file should be placed where it can be easily be incorporated into EdgeX project artifacts (Docker images, JAR files, etc.). Below is a list of the default placement of the Attribution file for different types of projects:
- Go Lang Projects and Services: Placed in the /cmd folder for each service
- Java Projects and Services: Placed in the base of the project
- C Projects and Services: Placed in the base of the project