License issue with requests and requests3

@kennethreitz @nateprewitt If this gets too long and you'd like to get streight to the point, feel free to skip the sections between `The Situation` to `Okay, but what does this all mean?` noninclusive if you just want the upshot. 

**Disclaimer:** IANAL and this is not legal advice. I've worked with copyright lawyers in the past and have dealt with similar issues at length for other large permissive-licensed open-source projects I've been a part of, e.g. Spyder in spyder-ide/spyder#7785 , but I duly recommend you consult with a licensed legal professional (that I assume the PSF retains) on this matter if you are in any doubt about how to move forward.

## The Situation

I would normally bring this sort of thing up over on kennethreitz/requests3 first, but issues are disabled for that repo, so I've opened an issue here as it is of intrinsic consequence to this project as well. It appears the Apache 2.0 license link, terms, text and setup.py tag was [recently removed](https://github.com/kennethreitz/requests3/commit/69eb662703b40db58fdc6c095d0fe130c56649bb) from that repo and instead replaced with CC0, i.e. public domain.

Meanwhile, it is still referred to [several places](https://github.com/kennethreitz/requests3/search?q=apache&unscoped_q=apache) other than the changelog, including the documentation, the ``__version__.py`` and in `:license:` tags in three `__init__.py` subpackage docstrings, all of which state the authors of the particular submodule are @sigmavirus24 and @Lukasa , and state ``see LICENSE for more details`` which is no longer correct as that file refers to an entirely different license from that which the code is actually released under.

## Explanation

Any individual contributor is free to re-release their past and future contributions under a different license (though cannot revoke the old), which presuming license is compatible (as CC0/PD is) are then incorporated into the Apache 2.0 project requests3. Furthermore, a maintainer can change the license under which contributors agree to submit future contributions to the repo, i.e. by adding the new license to the repo root and making clear (e.g. through filename, readme, PR template, etc.) that it is the canonical one. 

However, without a CLA in place or written permission from all 500+ contributors, no one individual has the right to unilaterally change the license of existing code that is not their own, nor impose a more permissive license than previously applied to the package as a whole.

For example, ISC and MIT --> Apache is permissible (though a copy of both these licenses still need to be included somewhere conspicuous, preferably along with at least a brief statement of what they apply to, e.g. in the Apache-mandated `NOTICE.txt`) since Apache is an effective superset of the terms of each of these licenses, so the combined derivative work may be licensed under it although the less strict ISC/MIT terms still apply to code as it existed up to the license switch.

## The Issue at Hand

In this case, moving the license of the combined work from Apache --> CC0 is not possible in practice without a from-scratch rewrite of every line of code that was either written by or meaningfully derived from code other than those who decide to relicense their work under the CC0, or separating out all that code into a different module, since all the Apache terms still apply except to code that's only ever been touched by the individual(s) relicensing it, or completely new code written from the point of the relicensing forward.

In particular, in section 4a and 4c of the Apache license applies, 

> a. You must give any other recipients of the Work or Derivative Works a copy of this License; and

> c. You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works

which is followed by,

> You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 

## Okay, but what does this all mean?

This means that `requests3` now beaches the Apache 2.0 license under which this `requests` codebase is licensed, as the latter requires inclusion of a copy of said license in the codebase, and indication that the combined derivative work is still subject to the license's terms. Furthermore, it should be made clear by some method (per the following [section](https://www.apache.org/licenses/LICENSE-2.0#apply)) which files the Apache license applies to, whether by file headers, information in the NOTICE.txt file, or expansion of the existing `:license:` tags in doctrings. Otherwise, downstream distributors (linux distros, Python distributions, packages vendoring requests, etc) will not be able to easily discern what code is covered by which license and have to assume the more restrictive Apache 2.0 terms for all of it, making it effectively be treated as Apache 2.0-only.

Given the lack of an associated issue, PR, documentation or meta-file change, or descriptive commit message, and lack of any clarification in the commit contents itself, it is unclear if by making that commit, @kennethreitz has decided to relicense his past contributions under the CC0 and not just those following it. If that is not the case, then only future contributions are affected, of which there is only one trivial one. Ergo, the entire work is still de-facto licensed Apache 2.0 (minus that one contribution) and the change by itself does not have any effect except causing the breach of the Apache 2.0 license. Alternatively, and what I've generally assumed here, the intention was also to relicense his past contributions as well that comprise the present work. This should be clarified somewhere, or it further minimizes any practical effect of this change to the package's license status.

As an addendum, this also means that forward-porting any further requests 2 code, or any code from any other library like httpx, etc. is not possible without that code also being covered by the same license as the original (Apache 2,0 or BSD respectively) and those license terms applying. rather than CC0. Conversely, any CC0-licensed code in requests3 can be used by any other repo, e.g. requests or httpx, without any conditions whatsoever (including no need to attribute the original author or respect any license terms).

@nateprewitt I can't see your reply on here for some reason, only in my email, but the TL;DR of the above is due to what you mention, `requests3` is apparently in serious breach of _this project's_ license and that of all your contributors, due to the issue identified above. Ergo, given I couldn't open an issue over there since issues are disabled, I raised and documented it here.

Requests3 hasn't received any updates and is now "archived" so we're not interested in pursuing any action. In the rare case that this comes up in the future it will be easy to settle as the full Git history is public anyways.

Yup, I noticed that too and didn't pursue this further, so yeah, seems like a moot point now—thanks for following up and closing this @sethmlarson . Seems like the intent may have been to release the primary author's own contributions to the public domain. And just in case it gets forked/actively developed again, if any misunderstandings persist they can always be cleared up then.