Clean up derivative works

[chadwhitacre]

We've been loosey-goosey on copy/paste code re-use, time to tighten up. Need to .

Policy is basically - isolate to a separate file, and include OSS attribution in the file header.

• update policy doc🔒 - added a section
• remediate
  • Properly handle derivative works sentry#46196
  • https://github.com/getsentry/sentry-php/blob/master/src/Util/SentryUid.php#L17
  • https://github.com/getsentry/sentry-go/tree/master/internal/otel/baggage
  • https://github.com/getsentry/sentry-php/tree/master/stubs
  • Properly attribute vendored code sentry-javascript#7560
  • Add attribution and the text of their license at the top of the file team-mobile#96
• educate
  • Slack
  • email

[chadwhitacre]

Additional guidance:

if theres no attribution, retain the license and add attribution
dont need to ask
just link to repo

yeah I'm fine with link to the repo as attribution

also i would ALWAYS link to repo fwiw
so retain license, attribute link to repo no matter what
its just good hygiene

[evanpurkhiser]

AFAIK that bootstrap stuff is just completely vendored. So whatever doc string was in there when the file was copied is what was in it

[JoshFerge]

FWIW https://github.com/getsentry/sentry/blob/master/src/sentry/apidocs/spectacular_ports.py#L29-L30 is not copy/pasted, but a modified version of the libraries function. I've also partly contributed part of this vendored file upstream to the library

[JonasBa]

@chadwhitacre this renders weirdly for me, but I just took care of the fzf port. I ported that manually, so idk if we technically need the license, but since it's just a translation I dont mind keeping it.

[mitsuhiko]

@JonasBa if it's not a clean-room reimplementation it counts as a derivative work and thus needs to retain the original license.

[AbhiPrasad]

Opened getsentry/sentry-javascript#7560 to track this in JS. From inspecting all the JS SDK packages we have attribution links everywhere - but including the license text is inconsistent.

[antonpirker]

Python SDK: getsentry/sentry-python#1973