Re: [gentoo-nfp] Gentoo Social Contract and potential liabilities

[Sven Vermeulen]

On Sat, Oct 24, 2015 at 09:18:02AM -0400, Rich Freeman wrote:
> On Sat, Oct 24, 2015 at 8:33 AM, Sven Vermeulen <swift@g.o> wrote:
> >
> > This was brought forward when we started accepting user contributions
> > through GitHub. Yes, we've had the discussion that we don't depend on it.
> > But now the question was how do we need to interpret "depend on"?
> >
>
> The Council took up this topic last week.  I'm not suggesting the
> Trustees are bound by this, but they certainly should be informed by
> it.  What we agreed upon was:
>
> "The Gentoo council encourages contributions to Gentoo via manyfold
> ways. However, it also recognizes that the usage of Github, being a
> closed-source service, poses the danger of data lock-in and should not
> be preferred. The question has been posed whether the current usage of
> Github is in line with the Gentoo social contract- a question still
> open to interpretation.
> With this background the council asks for implementation of
> * the two-way mirroring of Github pull requests to bugzilla (including
>   comments and patches)
> * the public archiving of Github repository e-mail notifications
> * and the mirroring of Github pull request git branches on Gentoo
>   infrastructure
> or functionally equivalent alternatives. The council believes that
> this should suffice for all developers to dispell doubts about
> adherence to the Gentoo social contract."

This, and the remainder of the discussion in this thread, already assumes
that there is a dependency applicable. There is still the strict
interpretation of that paragraph, which somewhat excludes services (it being
about the release of our contributions, or the collection of software and
documentation that constitutes Gentoo).

People can also interpret it that it includes services, in which case we should
know if "dependence" is in a terminal sense (without it, we can't survive)
or in other degrees of dependency (losing functionality, or just losing
performance). Right now, services such as those that GitHub provides are not
a hard dependency. If GitHub closes its doors suddenly, we will not lose
functionality, merely some performance in one of our contributing processes.

That is not something I personally see as being dependent upon. But that is
how I feel when I see the term "depend on". It's a language construction,
not a mathematically defined statement, so I definitely understand if people
read "depend on" as in "there is a relationship between the two".

So the other discussions are to be seen in the "worst case", which even then
is not a final end. Our "Social Contract" has been written with a specific
purpose in mind. It is an attempt to write down the principles in a readable
and clear way. Like always, language interpretations can occur. If we notice
that the interpretation of the text is not in line with our principles then
we should start the process of making our principles more clear.

That then starts with finding consensus from the Gentoo Project on how they
want to evolve. Are the principles of "Gentoo is and will remain Free
Software" in jeopardy or not? In what way would we need to either refine the
contract, or provide a FAQ document alongside the contract that explains how
we feel about specific interpretations (or more specifically, the
relationship we would have with external services)?

I deliberately did not include this in the thread (i.e. I did not ask
"Do you consider external services as being part of Gentoo" and
"When do you feel Gentoo depends on an external service") as I think first
we need to know if there is ground to do this or not.

Wkr,
	Sven Vermeulen