Distributing a proprietary app together with an ASLv2'ed derived work

Question

My proprietary Java app includes a modified version of a 3rd party library distributed under Apache Software License, version 2.0. The 3rd party library doesn't come from the Apache Software Foundation, neither does it include any NOTICE file (mentioned in 4.(d) section of the License).

1. Do I need to distribute the modified source code? (I assume the answer is no, but just making sure.)
2. Would a free-form statement like "this product uses 3rd party software licensed under ASL 2.0, license available at http://www.apache.org/licenses/LICENSE-2.0" somewhere in the THIRDPARTYLICENSEREADME.txt file be sufficient?
3. Do I need to provide any information as per which exact ASLv2'ed software my product uses?

Answer 1

Apache has a pretty good FAQ regarding their license. The relevant points:

1. No, you do not have to provide the source code.

2. Not quite. That statement almost covers the "proper attribution" requirement (but see #3), however you also are required to include a copy of the ASLv2 itself.

3. Bizarrely, I can't find anything on the Apache website to clarify this issue; it looks like the exact criteria for "proper attribution" appear to consist of preserving the NOTICE file and any notices in source files. Personally, I would be very surprised if "proper attribution" of a work did not include specifying what the work is and where it came from.