[gentoo-nfp] Gentoo Social Contract and potential liabilities

[Sven Vermeulen]

Hi all

We've had the discussion in the past somewhat, but never truly took it
further. One of the questions I was recently asked is how to interpret the
following part of our Social Contract:

"""
Any external contributions to Gentoo (in the form of freely-distributable
sources, binaries, metadata or documentation) may be incorporated into
Gentoo provided that we are legally entitled to do so. However, Gentoo will
never depend upon a piece of software or metadata unless it conforms to the
GNU General Public License, the GNU Lesser General Public License, the
Creative Commons - Attribution/Share Alike or some other license approved by
the Open Source Initiative (OSI).
"""

This was brought forward when we started accepting user contributions
through GitHub. Yes, we've had the discussion that we don't depend on it.
But now the question was how do we need to interpret "depend on"?

Given that the sentence is in reference to the primary one ("Any external...")
does the dependency focus on the incorporation of software in Gentoo (provided
legal entitlement) and hence that this software, if it does not conform to the
LGPL et al, then that this software cannot be a strict, hard dependency? Let's call
this the "strict interpretation".

In this interpretation, we're talking about the incorporation of software,
metadata, documentation into Gentoo (and Gentoo in our social contract is
defined as a collection of free knowledge), of which the Gentoo operating
system (distribution) is a derivation of it. I personally read that as
adding the contributions by users and external sources into our entire
ecosystem / community, but I don't see the software or platform of external
services as being part of this. We make documentation on how to work with
GitHub, but GitHub itself is not part of Gentoo.

But perhaps the interpretation is broader than that? Perhaps service
dependency is something that is also covered by the statement. And when that
is the case, then the sentence about "Gentoo will never depend upon..."
becomes even more important. Do our communities not depend on services that
are handled by non-free software? Think about the propriatary operating
systems of the various routers that our network and internet traffic goes
through. Think about the propriatary software in use by the Government and
banking platforms that are keeping the state of the Gentoo Foundation (as a
legal entity) up?

In my opinion, we are not incorporating them into Gentoo. They are not
becoming part of Gentoo or of the community, but we do depend on them. And
for some of these services, the dependency is very soft (GitHub is not a
mandatory service for Gentoo) while others are hard (without the network
routers, few people can reach anyone and anything of Gentoo).

So far the first question (How to interpret the paragraph, and more
specifically the "depend on").

The second question that came is a traditional "What if". What if we are
depending on software and as such as in breach of our Social Contract. What
are the consequences? Are there any liabilities? Are certain contributions
to Gentoo affected by this breach?

Personally, I think software contributions are marked with the license they
come with. This license is not depending on the Social Contract. As such, I
think the liability is not with contributions in the form of tangible
assets, but in the form of intangible. We're all contributing time and
effort to the Gentoo Project. If we are in breach of the Social Contract,
are these contributions, which we often (or even exclusively) do in our free
time, suddenly "different"?

In the extreme case, could developers and users who contributed time and
effort to the Gentoo project ask for compensation the moment that we would
be in breach of the Social Contract?

So the second question is, what are the ramifications towards the Gentoo
community, Gentoo project and even Gentoo Foundation when Gentoo would be in
breach of this part of the Social Contract?

Wkr,
        Sven Vermeulen