Re: [gentoo-nfp] Gentoo Social Contract and potential liabilities

[Rich Freeman]

On Sat, Oct 24, 2015 at 8:33 AM, Sven Vermeulen <swift@g.o> wrote:
>
> This was brought forward when we started accepting user contributions
> through GitHub. Yes, we've had the discussion that we don't depend on it.
> But now the question was how do we need to interpret "depend on"?
>

The Council took up this topic last week.  I'm not suggesting the
Trustees are bound by this, but they certainly should be informed by
it.  What we agreed upon was:

"The Gentoo council encourages contributions to Gentoo via manyfold
ways. However, it also recognizes that the usage of Github, being a
closed-source service, poses the danger of data lock-in and should not
be preferred. The question has been posed whether the current usage of
Github is in line with the Gentoo social contract- a question still
open to interpretation.
With this background the council asks for implementation of
* the two-way mirroring of Github pull requests to bugzilla (including
  comments and patches)
* the public archiving of Github repository e-mail notifications
* and the mirroring of Github pull request git branches on Gentoo
  infrastructure
or functionally equivalent alternatives. The council believes that
this should suffice for all developers to dispell doubts about
adherence to the Gentoo social contract."

There is another side to this discussion which hasn't really been
touched upon.  Even if we wanted to move away from Github, what could
we actually do to prevent its use?  I think that attempting to do so
would be fairly divisive.  You can't tell somebody what tools they can
use to prepare their patches any more than you can tell them what text
editor to use to author their ebuilds.  A file that spent some time in
Github looks the same to Gentoo as a file that did not.  I don't think
anybody is going to support kicking devs who use it, or even those who
encourage its use for contributions.

Likewise, we don't actually have a policy that forces devs to close
bugs at all, so a dev could choose to only work on pull requests
submitted in Github and ignore bugs in Bugzilla.  I think that would
be ridiculous and counter-productive, but strictly speaking it would
be allowed by policy.  And what is the alternative, forcing devs to
close Bugzilla bugs in a certain time?  We don't require such things
because devs are volunteers and a dev closing two bugs is more useful
to us than a dev who quits and closes zero bugs because he's being
yelled at for not fixing twenty.

I think we'll get further by encouraging collaboration however it
happens.  When I fix a bug in an openrc script it isn't because I
personally benefit (I no longer use openrc), but rather because it
usually isn't hard for me to do and I know that lots of others will
benefit.  So, when you get a bug reported in an unconventional way, by
all means we should work to get it into Bugzilla, but we should be
fixing bugs because they're bugs, not because of how they're reported.

>
> In the extreme case, could developers and users who contributed time and
> effort to the Gentoo project ask for compensation the moment that we would
> be in breach of the Social Contract?
>

Under the present system, I'd think no, because all the real
contributions are licensed GPL-2+ which doesn't actually contain any
of our social contract terms.  If we accumulated some big war chest of
donations and then used them contrary to our announced purposes, that
might be grounds for a lawsuit.  However, we're not spending any
Foundation money on services like Github, and it seems unlikely that
we'd ever choose to do so, precisely because of the social contract.
While I think we shouldn't be opposed to developers using Github we
shouldn't be funding it.

I actually have suggested that Gentoo move towards something like the
FSFe FLA for copyright, and that does actually contain some clauses
for taking back contributions if Gentoo were to stray.  However, that
is targeted more at re-licensing.  For example, if you gave Gentoo an
exclusive license to your contribution under the FLA and Gentoo chose
to re-license it under a proprietary license, then the license would
be terminated and copyright would revert to you.  However, even that
approach doesn't cover the social contract, and Gentoo would still
have the same rights towards contributed code as it has under the GPL.

IMO, trying to build stuff like this into actual software licenses is
unwise.  As we can see there is a lot of debate over just what "depend
on" means and that isn't really a good foundation for a legal
document.  I think the debate is healthy, but taking this into courts
and bankrupting the Foundation over the issue is not.

> So the second question is, what are the ramifications towards the Gentoo
> community, Gentoo project and even Gentoo Foundation when Gentoo would be in
> breach of this part of the Social Contract?

I think the Social Contract is more about what we stand for.  Unless
we were to take this to an extreme, I doubt any court would want to
touch it from a legal perspective.

I think the real impact is that the Social Contract is a big part of
what brings us together.  If we completely disregard it, I suspect
we'd see a lot of people drifting away.  After all, we're all donating
our time.  We want to donate that time towards something that means
something.  So, the Social Contract is critically important to Gentoo
regardless of whether it has any legal basis.

There is always going to be some edge case that raises a vigorous
debate.  I think the key is that we're having this argument over a
gray area that is really on the periphery of what we do.  I don't
think that means we're compromising our core values - the fact that
we're so divided actually suggests to me that we take such matters
very seriously.

-- 
Rich