Guide: Improve attribution

[Sealjay]

Goal

Create a TODO Guide to improve content, submitted by @byjrack - topic: Doing Attribution well.

I see a ton of variance in what I see internally and externally when it comes to Attribution for 3rd party works. What is in the artifact, how it is made available, etc. I believe there are general common practices like the http://www.apache.org/legal/src-headers.html#notice which is a foundation principle and not a part of the license.

I would appreciate help building some consensus approaches to doing attribution well.

• How to make it available in web and binary works?
• What does it contain for the works? Include the version? Use SPDX as a framework?
• Inclusive of all transitive or only the directs?
• Ecosystem support for auto-generation for the tooling and platforms we are using (OCI may look a bit different compared to Maven)

Description

This was ideated in #19 and todogroup/todogroup.org#143

Action Items

• Review external content
• Create first draft
• Submit pull request for review