docs: attribute the projects this reimplements - #44
Merged
Merged
Conversation
This repo is Apache-2.0 and reimplements two MIT-licensed projects, and until now said so nowhere that carries legal weight: no NOTICE, and no copyright line for either upstream anywhere in the tree. The README's one-line "a Go reimplementation of pre-commit" is a description, not an attribution. internal/identify is the concrete exposure. Its extension, filename and interpreter tables follow upstream identify's data closely, because they have to — those tags are what hooks' types filters match against, so a table that diverges is a hook that silently skips files. NOTICE reproduces both MIT licenses in full and states plainly that this is neither affiliated with nor endorsed by the pre-commit project, so a reader who arrives from upstream learns that in the first paragraph rather than inferring it. GoReleaser now ships NOTICE in every archive, which is what Apache-2.0 section 4(d) actually asks for; listing files at all overrides its defaults, hence LICENSE and README reappearing there. Refs #43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A port that does not name what it ports from is the easiest possible thing to be criticised for, and right now this repo does not name it anywhere binding. There is no
NOTICE, and neither upstream copyright appears in the tree.NOTICE— reproduces the MIT licenses of pre-commit (© 2014 Anthony Sottile, Ken Struys) and identify (© 2017 Chris Kuehl, Anthony Sottile) in full, and states that this project is not affiliated with or endorsed by either.internal/identify/identify.go— a package comment recording that the tag tables follow upstream's data and that upstream wins when they disagree. It is the one place where the derivation is close enough to be worth marking in the source..goreleaser.yaml— shipsNOTICEin every archive. Apache-2.0 §4(d) wants the notice travelling with the distribution, and a NOTICE only in the repo does not do that. Settingfiles:replaces GoReleaser's defaults, soLICENSEandREADME.mdare relisted.No behavior change.
goreleaser checkpasses.Refs #43