Re: [gentoo-nfp] Gentoo Social Contract and potential liabilities

[Anthony G. Basile]

On 10/24/15 9:18 AM, Rich Freeman wrote:
> On Sat, Oct 24, 2015 at 8:33 AM, Sven Vermeulen <swift@g.o> wrote:
>>
>> This was brought forward when we started accepting user contributions
>> through GitHub. Yes, we've had the discussion that we don't depend on it.
>> But now the question was how do we need to interpret "depend on"?
>>
>
> The Council took up this topic last week.  I'm not suggesting the
> Trustees are bound by this, but they certainly should be informed by
> it.  What we agreed upon was:
>
> "The Gentoo council encourages contributions to Gentoo via manyfold
> ways. However, it also recognizes that the usage of Github, being a
> closed-source service, poses the danger of data lock-in and should not
> be preferred. The question has been posed whether the current usage of
> Github is in line with the Gentoo social contract- a question still
> open to interpretation.
> With this background the council asks for implementation of
> * the two-way mirroring of Github pull requests to bugzilla (including
>    comments and patches)
> * the public archiving of Github repository e-mail notifications
> * and the mirroring of Github pull request git branches on Gentoo
>    infrastructure
> or functionally equivalent alternatives. The council believes that
> this should suffice for all developers to dispell doubts about
> adherence to the Gentoo social contract."
>
> There is another side to this discussion which hasn't really been
> touched upon.  Even if we wanted to move away from Github, what could
> we actually do to prevent its use?  I think that attempting to do so
> would be fairly divisive.  You can't tell somebody what tools they can
> use to prepare their patches any more than you can tell them what text
> editor to use to author their ebuilds.  A file that spent some time in
> Github looks the same to Gentoo as a file that did not.  I don't think
> anybody is going to support kicking devs who use it, or even those who
> encourage its use for contributions.
>
> Likewise, we don't actually have a policy that forces devs to close
> bugs at all, so a dev could choose to only work on pull requests
> submitted in Github and ignore bugs in Bugzilla.  I think that would
> be ridiculous and counter-productive, but strictly speaking it would
> be allowed by policy.  And what is the alternative, forcing devs to
> close Bugzilla bugs in a certain time?  We don't require such things
> because devs are volunteers and a dev closing two bugs is more useful
> to us than a dev who quits and closes zero bugs because he's being
> yelled at for not fixing twenty.
>
> I think we'll get further by encouraging collaboration however it
> happens.  When I fix a bug in an openrc script it isn't because I
> personally benefit (I no longer use openrc), but rather because it
> usually isn't hard for me to do and I know that lots of others will
> benefit.  So, when you get a bug reported in an unconventional way, by
> all means we should work to get it into Bugzilla, but we should be
> fixing bugs because they're bugs, not because of how they're reported.
>
>>
>> In the extreme case, could developers and users who contributed time and
>> effort to the Gentoo project ask for compensation the moment that we would
>> be in breach of the Social Contract?
>>
>
> Under the present system, I'd think no, because all the real
> contributions are licensed GPL-2+ which doesn't actually contain any
> of our social contract terms.  If we accumulated some big war chest of
> donations and then used them contrary to our announced purposes, that
> might be grounds for a lawsuit.  However, we're not spending any
> Foundation money on services like Github, and it seems unlikely that
> we'd ever choose to do so, precisely because of the social contract.
> While I think we shouldn't be opposed to developers using Github we
> shouldn't be funding it.
>
> I actually have suggested that Gentoo move towards something like the
> FSFe FLA for copyright, and that does actually contain some clauses
> for taking back contributions if Gentoo were to stray.  However, that
> is targeted more at re-licensing.  For example, if you gave Gentoo an
> exclusive license to your contribution under the FLA and Gentoo chose
> to re-license it under a proprietary license, then the license would
> be terminated and copyright would revert to you.  However, even that
> approach doesn't cover the social contract, and Gentoo would still
> have the same rights towards contributed code as it has under the GPL.
>
> IMO, trying to build stuff like this into actual software licenses is
> unwise.  As we can see there is a lot of debate over just what "depend
> on" means and that isn't really a good foundation for a legal
> document.  I think the debate is healthy, but taking this into courts
> and bankrupting the Foundation over the issue is not.
>
>> So the second question is, what are the ramifications towards the Gentoo
>> community, Gentoo project and even Gentoo Foundation when Gentoo would be in
>> breach of this part of the Social Contract?
>
> I think the Social Contract is more about what we stand for.  Unless
> we were to take this to an extreme, I doubt any court would want to
> touch it from a legal perspective.
>
> I think the real impact is that the Social Contract is a big part of
> what brings us together.  If we completely disregard it, I suspect
> we'd see a lot of people drifting away.  After all, we're all donating
> our time.  We want to donate that time towards something that means
> something.  So, the Social Contract is critically important to Gentoo
> regardless of whether it has any legal basis.
>
> There is always going to be some edge case that raises a vigorous
> debate.  I think the key is that we're having this argument over a
> gray area that is really on the periphery of what we do.  I don't
> think that means we're compromising our core values - the fact that
> we're so divided actually suggests to me that we take such matters
> very seriously.
>

I have no idea where you're going with this. If Gentoo is unwilling 
uphold the SC then it should not have made that promise.  You don't just 
get out of a contract because ${reasons}.  There were many man-hours of 
labor put into Gentoo under that agreement, and its not unreasonable 
that some will legally demand that Gentoo stand by it.  This make us 
liable, especially as the leadership, liable.  It is not unreasonable to 
request legal council at this point so that we are better informed.

-- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
[phone]