Caught by our own licence gate the minute the anchor went up, which is the only
reason this is a same-day correction rather than something a reader finds first.
Two separate requirements, both real:
- section 4(b): the twenty upstream files this overlay modifies must carry a
prominent notice that we changed them. They did not. They do now, placed after
the upstream copyright header rather than over it, because 4(c) requires that
header to survive untouched. It does: eighteen still read "Copyright ConsenSys
AG.", two "Copyright contributors to Besu."
- section 4(d): NOTICE must carry the attribution notices of the work this
derives from. It named Hyperledger Besu only, while the files themselves carry
three distinct notices. All three are now reproduced. Naming one of three was a
smaller truth than the files tell.
The patch is regenerated from the corrected files and re-verified end to end, not
assumed: git apply --check and git apply both 0 on a pristine d2032017 checkout,
the resulting tree byte-identical to anchor/ (75 files compared, 0 differences),
and 605 tests with 0 failures across consensus:common and consensus:qbft.
- Apache 2.0 section 4(b): the patches modify files that are the work of
Hyperledger Besu and now say so, with the notice inside the modified files,
which is what the licence asks for and what applying the patch produces.
- patches/ and precompiles/ now carry the staged versions rather than an older
export. The two had drifted in both directions; the only thing the published
copy had that the staged one lacked was the word "audited" in front of Bouncy
Castle, which we cannot evidence and which the staged version had dropped.
- the brand was spelled two ways in the same repository, 62 times one way and 23
the other. It is Aere Network; AERE is the ticker. The 96 AERE_* code
identifiers are untouched.
Every source file in this repository carries SPDX-License-Identifier: Apache-2.0,
and the README has always said Apache 2.0. The LICENSE file said MIT. It was the
only thing in the repository that disagreed, and it was wrong.
This code derives from Hyperledger Besu, which is Apache 2.0. Several files sit in
Besu's own packages because that is where the client loads them from. Publishing
that under MIT was not a choice we were free to make, and it is not one we made
knowingly.
The LICENSE file now contains the Apache 2.0 text as published by the Apache
Software Foundation, byte for byte (sha256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30).
NOTICE records the derivation from Besu.
Nothing about the terms these files were offered under has changed: the file
headers governed before this commit and govern after it. The correction is
recorded in the README rather than made silently, because a licence is the one
thing in a repository a reader should not have to verify.
