From a469273adda336625f96b9d769ea27b33999f146 Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Sun, 27 Sep 2026 13:48:54 +0000 Subject: [PATCH] Standardize attribution formatting and exclude editorial commentary --- docs/policy/documentation.md | 6 +-- docs/policy/oss.md | 74 +++++++++++++++++++------------ examples/licensing/attribution.md | 43 ++++++++++++++++++ 3 files changed, 92 insertions(+), 31 deletions(-) create mode 100644 examples/licensing/attribution.md diff --git a/docs/policy/documentation.md b/docs/policy/documentation.md index b59e3bc..8a84499 100644 --- a/docs/policy/documentation.md +++ b/docs/policy/documentation.md @@ -1,8 +1,8 @@ # Documentation Policy -**Base Policy Version:** 1.5 +**Base Policy Version:** 1.6 -**Last Updated**: 2026-09-26 +**Last Updated**: 2026-09-27 ## Base Policy Template @@ -83,7 +83,7 @@ secret values. | Open source licensing and attribution policy | `docs/policy/oss.md` | Project licensing defaults and author choices, COPYRIGHT conventions, upstream attribution format, license-text and notice-link conventions, discoverability, maintenance, and handling of concrete exceptions. | Component entries, license texts, release commands, and dependency security review. | | Project copyright and license grant | `COPYRIGHT` | Project identity, copyright holders and years, SPDX expression, license grant, warranty disclaimer, and statement about third-party material. | Complete license texts and upstream component attribution. | | Project license texts | `LICENSE` | Complete project license text and incorporated companion text, with project-specific fields where required by the selected license. | General licensing policy and upstream component attribution. | -| Upstream component attribution | `docs/oss/attribution.md` | Component names, copyright statements, license identification, and license, notice, and source links. | General attribution policy and complete standard license texts. | +| Upstream component attribution | `docs/oss/attribution.md` | Factual component identification, copyright statements, license identification, required upstream notices, and license, notice, and source links in the House Format. | General attribution policy, exception reasoning, research narratives, compliance commentary, and complete standard license texts. | | Standard dependency license texts | `docs/oss/licenses/` | Complete, verbatim standard license texts shared by attribution entries where applicable. | Project-specific upstream notices, attribution prose, and policy interpretation. | | Repository-specific release procedure | `docs/release.md` | Maintainer prerequisites, candidate preparation, concrete validation and publication commands, automated publication guards, asynchronous deliverable publication, separate delivery status, optional consumer-facing verification, and failure recovery. | General release requirements, product installation guidance, historical release summaries, and current compatibility contracts. | | CLI contract (if applicable) | `docs/cli.md` | Commands, arguments, flags, invocation semantics, and exit codes. | End-to-end operating procedures, configuration field definitions, runtime filesystem layout, module implementation details. | diff --git a/docs/policy/oss.md b/docs/policy/oss.md index 9b54605..8960129 100644 --- a/docs/policy/oss.md +++ b/docs/policy/oss.md @@ -1,8 +1,8 @@ # Open Source Licensing And Attribution Policy -**Base Policy Version:** 1.3 +**Base Policy Version:** 1.4 -**Last Updated**: 2026-09-26 +**Last Updated**: 2026-09-27 ## Base Policy Template @@ -94,35 +94,51 @@ preserve notices or add them where the applicable terms require them. ## Upstream Attribution House Format -Each component entry has five fields: +Begin `docs/oss/attribution.md` with `# Open Source Attribution Notices`, +followed directly by component entries. Do not add an introductory summary, +policy links, audit narrative, disclaimer, or concluding explanation. -1. **Project name**, normally as the entry heading. +Each entry presents these five fields in order, with blank lines between them: + +1. **Project name** as a level-two heading. An optional identification paragraph + may follow, such as `Selected module: MODULE at VERSION.` with the module and + version in backticks. A factual qualifier such as `(transitive dependency)` + is permitted; do not describe dependency-discovery methods. 2. **Upstream copyright statement or statements**, preserving their wording. -3. **SPDX license identifier or expression**, when applicable. -4. **License and notice links**, covering the applicable standard texts and - upstream project-specific material. -5. **Source repository link**, identifying the source corresponding to the - imported version. + Put multiple statements in separate paragraphs. If the selected upstream + source supplies no applicable statement, omit this field without inventing + one or adding an explanation of its absence. +3. **SPDX license identifier or expression**, when applicable, using + `SPDX-License-Identifier: EXPRESSION`. +4. **License and notice links**, beginning `License and notices:`, separated + by ` | `, and ending with a period. Label local standard texts by license + name, such as `MIT` or `Apache 2.0`. Label upstream files by their actual + filenames, such as `COPYRIGHT`, `LICENSE`, `NOTICE`, or `PATENTS`. +5. **Source repository link**, using `[Source](COMMIT_URL).` with no `Source:` + prefix or additional description. -Illustrative Markdown, with placeholders for the actual upstream information: +Use the copyable [attribution example](../../examples/licensing/attribution.md). +Its three illustrative entries demonstrate a normal entry, omission of an +unavailable copyright statement, and multiple copyrights and license texts. +Replace the uppercase placeholders and illustrative URLs with actual component +information. Local license links are relative to the destination +`docs/oss/attribution.md`; copy the applicable texts into its `licenses/` +directory. Do not copy example entries for components the project does not use. -```markdown -## Example Library +These are five fields, not a line limit. Omit the SPDX field when no applicable +identifier exists; identify nonstandard terms through the linked text. Preserve +licensing alternatives and exceptions, and record a selected option when +relevant through the factual license identification. Do not invent an identifier +or silently resolve an unsettled licensing choice. -Copyright - -SPDX-License-Identifier: Apache-2.0 - -License and notices: [Apache 2.0](licenses/Apache-2.0.txt) | [NOTICE]() - -Source: [Example Library]() -``` - -These are five fields, not a line limit. Include multiple statements and links -where needed. Omit the SPDX field when no applicable identifier exists; identify -nonstandard terms accurately through the linked text. Preserve licensing -alternatives and exceptions, and record a selected option when relevant. Do not -invent an identifier or silently resolve an unsettled licensing choice. +Keep entries factual. Do not add agent-authored explanations of license +expressions, file-level license scope, research performed, retained source +notices, or compliance conclusions. Avoid filler such as "none is invented +here" and embellished link labels such as "upstream LICENSE", "additional +patent grant", or "at the imported commit". Preserve actual required upstream +content; this rule excludes editorial additions, not required notices. Policy +interpretation and exception reasoning belong in the adopted OSS policy or an +appropriate decision record, not the attribution document. ## License Texts And Upstream Links @@ -191,8 +207,10 @@ to implement this policy. Use the House Format routinely. Raise an exception only for a concrete obligation or unresolved rights question it does not address, including any arising from a particular distribution channel. Record the issue and selected treatment in the -adopted policy or affected attribution entry as appropriate. Resolve the issue -before the affected use or distribution without reopening settled choices. +adopted OSS policy or an appropriate decision record. Attribution entries +contain the resulting factual identification and required material, without +repeating that reasoning. Resolve the issue before the affected use or +distribution without reopening settled choices. Common ownership of projects is neither required nor a blanket exception. Apply the formatting convention prospectively. Do not rewrite published tags, diff --git a/examples/licensing/attribution.md b/examples/licensing/attribution.md new file mode 100644 index 0000000..62c5d66 --- /dev/null +++ b/examples/licensing/attribution.md @@ -0,0 +1,43 @@ +# Open Source Attribution Notices + +## PROJECT_ONE + +Selected module: `MODULE_ONE` at `VERSION_ONE`. + +Copyright (C) YEAR_ONE COPYRIGHT_HOLDER_ONE + +SPDX-License-Identifier: MIT + +License and notices: [MIT](licenses/MIT.txt) | +[COPYRIGHT](https://example.invalid/PROJECT_ONE/blob/COMMIT_ONE/COPYRIGHT) | +[LICENSE](https://example.invalid/PROJECT_ONE/blob/COMMIT_ONE/LICENSE). + +[Source](https://example.invalid/PROJECT_ONE/tree/COMMIT_ONE). + +## PROJECT_TWO + +Selected module: `MODULE_TWO` at `VERSION_TWO`. + +SPDX-License-Identifier: Apache-2.0 + +License and notices: [Apache 2.0](licenses/Apache-2.0.txt) | +[LICENSE](https://example.invalid/PROJECT_TWO/blob/COMMIT_TWO/LICENSE). + +[Source](https://example.invalid/PROJECT_TWO/tree/COMMIT_TWO). + +## PROJECT_THREE + +Selected module: `MODULE_THREE` at `VERSION_THREE` (transitive dependency). + +Copyright (C) YEAR_THREE COPYRIGHT_HOLDER_THREE + +Copyright (C) YEAR_FOUR COPYRIGHT_HOLDER_FOUR + +SPDX-License-Identifier: MIT AND Apache-2.0 + +License and notices: [MIT](licenses/MIT.txt) | +[Apache 2.0](licenses/Apache-2.0.txt) | +[LICENSE](https://example.invalid/PROJECT_THREE/blob/COMMIT_THREE/LICENSE) | +[NOTICE](https://example.invalid/PROJECT_THREE/blob/COMMIT_THREE/NOTICE). + +[Source](https://example.invalid/PROJECT_THREE/tree/COMMIT_THREE).