apache / apache/lucene

Change `http://` to `https://` in our ASL2 copyright header?

Open
#14,099 0 comments 1 reaction 0 assignees View on GitHub
type:enhancement
Dominant language
Java
Stars
3.6k
Forks
1.4k
Avg merge
2d 11h
Merged PRs (30d)
88

Description

### Description

Randomly, while [grep'ing for `http` in our sources to locate links to external papers that inspired important changes in Lucene](https://github.com/apache/lucene/pull/14078#issuecomment-2569246977), I noticed that our standard `Apache Software License version 2.0` copyright header still uses the non-SSL (`http://`) link.

Should we update that to `https://`? Would that show that Lucene devs take security seriously or so ("lead by example")? If you load the [non-SSL url](http://www.apache.org/licenses/LICENSE-2.0) it redirects anyways to the SSL version.

Apache's [official guidelines on the copyright header text specifically state that `https` is acceptable](https://www.apache.org/legal/src-headers.html#headers), though the copy/paste text sample given there is non-SSL.

Curiously, a couple source files in Lucene *do* use the `https://` URL in the copyright header! [`gradlew.bat`](https://github.com/apache/lucene/blob/main/gradlew.bat#L8) and [`gradlew`](https://github.com/apache/lucene/blob/main/gradlew#L10), cool.

Using GitHub's search, I count ~[43.8K source files under the Apache org that use the SSL URL](https://github.com/search?q=org%3Aapache%20%22https%3A%2F%2Fwww.apache.org%2Flicenses%2FLICENSE-2.0%22&type=code), and [~1.3M source files that do not](https://github.com/search?q=org%3Aapache+%22http%3A%2F%2Fwww.apache.org%2Flicenses%2FLICENSE-2.0%22&type=code)! We could be early adopters and join the ~3.2% of Apache source code that does use the SSL link!

Contributor guide

Open the contributing guide

Research direction

Search the repository for the standard Apache Software License header and compare the existing http:// URL with the https:// versions in gradlew and gradlew.bat. Determine the complete set of source files that should use the secure URL, then verify that the resulting search no longer finds outdated headers without changing unrelated links.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
documentation
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.