License template is used without applied year and contributors

[mateusz-dobrowolny]

Describe the bug

Someone removed the license copyrights. It looks like the software is not licensed to anyone at this moment.
See this commit for details:
4b9099a#diff-d0ed4cc3fb70489fe51c7e0ac180cba2a7472124f9f9e9ae67b01a37fbd580b7

At the end of the license.txt file you have instruction how to apply the license.

OMG!

Regards,
Mateusz

To Reproduce

Just read the content of this file:
https://raw.githubusercontent.com/dotnet/aspnetcore/main/LICENSE.txt

Exceptions (if any)

Further technical details

• ASP.NET Core version
• Include the output of dotnet --info
• The IDE (VS / VS Code/ VS4Mac) you're running on, and its version

[sharwell]

This issue relates to the impact of #8733 on downstream consumers attempting to add aspnetcore to their THIRD-PARTY-NOTICES.txt file. Prior to that pull request, it was straightforward to copy/paste the attribution (to get something conceptually similar to this). This is no longer possible, since the copyright holder has been replaced by a generic placeholder.

/cc @terrajobst

[terrajobst]

I'm confused about #8733. I would expect the license in this repo to say:

Copyright (c) .NET Foundation and Contributors

@Eilon, could you provide more insight into the intention of #8733?

[Eilon]

Here's my understanding from not being a lawyer:

That text in the Apache license is telling YOU how to apply Apache to YOUR code. So you fill in whatever year/name you want for YOUR code. It's just the standard general information. The instructions don't change based on where the instructions are copied, but what you do with the instructions is specific to the project. Nothing should ever change in the standard Apache license text.

So within the AspNetCore repo, every source file has something like that in every file to apply the license to that file, for example:

aspnetcore/src/Components/Forms/src/EditContext.cs

Lines 1 to 2 in 1395fa8

	// Copyright (c) .NET Foundation. All rights reserved.
	// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.

[Eilon]

And from the horse's mouth: https://infra.apache.org/apply-license.html#new

To apply the ALv2 to a new software distribution, include one copy of the license text by copying the contents of LICENSE-2.0.txt into a file called LICENSE in the top directory of your distribution.

It says nothing about modifying the license text in that file.

And then for each source/document file in the project:

Each original source document (code and documentation, but not the LICENSE and NOTICE files) should include a short license header at the top.

[mateusz-dobrowolny]

@Eilon Thanks for comments.
I am just collecting different nuget packages and gathering lincese files from different repos, and this project seemed to have different approach.

However, this does not look so obvious now.
https://www.apache.org/foundation/license-faq.html#Apply-My-Software

Include a copy of the Apache License, typically in a file called LICENSE, in your work, and consider also including a NOTICE file.
It is also valuable to tag each of your source-code files in case they become detached from the LICENSE file. 

So it looks like file LICENSE.txt seems to be OK.

However, in .cs files, there is a problem with missing year.
As an example:
https://github.com/aspnet/Security/blob/master/src/Microsoft.AspNetCore.Authentication.Cookies/Constants.cs

It does not contain year, which is required. On the other hand it contains copyright symbol, which is not required.
More on the symbol usage:
https://www.copyrightlaws.com/copyright-symbol-notice-year/

Year seems to be mandatory to include:
https://www.apache.org/foundation/license-faq.html#Apply-My-Software

Copyright [yyyy] [name of copyright owner]

I am not sure about other files, except .cs files. All those .xml, .yml, etc - do not contain the copyright header.
So I am not sure now what is "expected".
However, the instruction how to apply license sais directly:
The text should be enclosed in the appropriate comment syntax for the file format.
Not to mention that including comments in .json files seems to be far from trivial thing.

To just have a better overview of how LICENSE.txt files are used across github in other Microsoft projects, here are few examples:
https://raw.githubusercontent.com/microsoft/ApplicationInsights-dotnet/2.12.0/LICENSE
https://raw.githubusercontent.com/dotnet/aspnetcore/v3.1.16/LICENSE.txt
https://raw.githubusercontent.com/dotnet/aspnetcore/2.2.0/LICENSE.txt
https://raw.githubusercontent.com/aspnet/HttpAbstractions/2.2.0/LICENSE.txt
https://raw.githubusercontent.com/aspnet/SignalR/1.1.0/LICENSE.txt

[Eilon]

Ultimately this was also based on guidance from our attorneys at Microsoft, and for the most part we applied their guidance with what was at the time (~10 years ago??) their best knowledge on what to do.

Tagging @Pilchie here because this project is run by his team now. I don't live here anymore but they still let me hang out sometimes 😄

[Eilon]

BTW some of those repos, such as https://github.com/aspnet/HttpAbstractions/, are old archived repos, and also when looking at tags, those are old point-in-time and for various technical reasons are not updated. Usually only the 'main' branch is updated to reflect "current" guidance.

I agree it's quite inconsistent but the guidance on what to do is also often inconsistent or subject to various interpretations.

[Pilchie]

Note that for .NET 6, we're planning on moving to MIT as part of #18873, so I expect things will be cleaned up as part of that.

[mateusz-dobrowolny]

I agree I should have been used "main" or "master" / "development" branches.

Here are updated examples:
MIT 2015 Microsoft (easy to use):
https://raw.githubusercontent.com/microsoft/ApplicationInsights-dotnet/develop/LICENSE

generic Apache 2.0 (hard to use) - this repo
https://raw.githubusercontent.com/dotnet/aspnetcore/main/LICENSE.txt

Apache 2.0 license modified file at the bottom! 😉 (can this be used at all? I do not think so)
https://raw.githubusercontent.com/aspnet/HttpAbstractions/master/LICENSE.txt -
https://raw.githubusercontent.com/aspnet/SignalR/master/LICENSE.txt

[Pilchie]

Your bottom two links are to archived repos that are not under active development. As I mentioned above, we'll be updating dotnet/aspnetcore to MIT over the next month or so before .NET 6 ships.

[dougbu]

@Pilchie now that we're MIT, is it time to close this❔ Unless there's action(s) necessary in our servicing branches of course…

[Pilchie]

I don't think there is any further action required here.

[sharwell]

I'm marking this as Fixed (as opposed to obsolete) because the consumer problem described by #34340 (comment) was eliminated by the MIT license update. The ability to copy/paste for third-party notices has been restored.