[gentoo-project] Re: [gentoo-dev-announce] Poll: Would you sign a Contributer License Agreement?

[Ulrich Mueller]

>>>>> On Thu, 31 May 2018, Ulrich Mueller wrote:

> (hoping that he hasn't snipped too much of the context)

Presumably I have. So find Greg's two messages below, in full (which
had gentoo-project in CC).

Ulrich


>>>>> On Wed, 30 May 2018, Greg KH wrote:

> On Wed, May 30, 2018 at 04:36:09PM +0200, Ulrich Mueller wrote:
>> A while back I requested information on past copyright assignments [1].
>> Since then, we have located some 30 of the assignment forms, signed by
>> developers (most of them retired by now) in 2004.
>>
>> Here is the second part of the exercise. The current draft of the new
>> Gentoo copyright policy [2] arranges for two procedures:
>>
>> 1. Certifying agreement to a "Gentoo Developer's Certificate of Origin"
>> by including a "Signed-off-by" line with every commit. This would
>> be virtually identical to the procedure used for the Linux kernel,
>> and would be mandatory. A draft of the Gentoo DCO can be seen at [3].

> Please please please do not "fork" the DCO.  It was specifically
> designed so that any project can use it, as-is, with no changes needed.
> Yes, some foolish projects have gone off and rewritten it, but that was
> crazy, and they now wish they did not, as it requires corporate lawyers
> to manually have to go review the "new" document to ensure that it
> really is doing what it thinks it is doing.

> Again, please just use the DCO.  It's at it's own web site, and is good
> to be used that way:
> 	https://developercertificate.org/

> Also, note, that if you do decide to copy it, I personally am going to
> get upset as it is a blatent copyright violation.  So there is that
> issue...
> Hint doing a s/open/free/ on the original text  does not mean that you
> suddenly have created a brand new document with no requirement to abide
> by the original document's copyright.  I see you claim that it was
> published in 2005 with a CC-BY-SA-2.5 License?  Do you have any
> reference for that, I know I spent a lot of time working on this in the
> past and I do not remember that...

> Again, just use the DCO, please.

>> 2. In addition, according to the current policy draft, developers would
>> be encouraged to sign a "Gentoo Contributor License Agreement (CLA)".
>> Its current draft version is at [4]. However, this would be
>> completely voluntary and *not* be required. The exact workflow
>> hasn't been drafted yet, but PGP signing of the form would be one
>> possibility. (Also note that the form includes fields for real name
>> and postal address.)
>>
>> The goals of the second item is to "make compliance with this policy
>> easier (fewer copyright holders to list), and allow the Foundation to
>> enforce copyrights and re-license content if appropriate" [2].
>> Apparently, we will only be able to achieve these goals if a
>> significant fraction of contributors will sign the CLA.
>>
>> So, before I pursue more work on the CLA I would like to ask all
>> developers and contributors:
>>
>> - Would you sign a "Gentoo Contributor License Agreement", similar to
>> the current draft in [4]?

> No, I personally will not sign any CLAs, sorry.

> Sent publically as the DCO thing should be discussed in public.

> thanks,

> greg k-h


>>>>> On Thu, 31 May 2018, Greg KH wrote:

> On Wed, May 30, 2018 at 11:44:34PM +0200, Ulrich Mueller wrote:
>> >>>>> On Wed, 30 May 2018, Greg KH wrote:
>>
>> > Please please please do not "fork" the DCO.  It was specifically
>> > designed so that any project can use it, as-is, with no changes
>> > needed.
>>
>> We simply cannot. We have files in the Gentoo repository that are not
>> under a free software license, and for these we need an extra clause.

> Your "extra clause" is pretty odd.  You took out the c) clause of the
> original DCO for some unknown reason as well, which is going to cause
> you big problems.

> Was this vetted by a lawyer?  Again, this is going to cause companies
> to have to spend lots of time and money to be able to get anyone to use
> this, do not change things lightly.

>> Otherwise we would have to specify in the policy that certain commits
>> are excepted from the requirement of a Signed-off-by line, and IMHO
>> that would be a much worse solution.
>>
>> Addition of the extra clause for licenses and similar files resulted
>> from a long discussion on 2018-01-25 in the #gentoo-council channel,
>> which included three council members and a trustee.

> No license lawyers?

> Are you _sure_ you need this change?

>> > Yes, some foolish projects have gone off and rewritten it, but that
>> > was crazy, and they now wish they did not, as it requires corporate
>> > lawyers to manually have to go review the "new" document to ensure
>> > that it really is doing what it thinks it is doing.
>>
>> > Again, please just use the DCO.  It's at it's own web site, and is
>> > good to be used that way:
>> > 	https://developercertificate.org/
>>
>> > Also, note, that if you do decide to copy it, I personally am going
>> > to get upset as it is a blatent copyright violation.  So there is
>> > that issue...
>>
>> How is it a copyright violation? We create a modified version of
>> a document that was released under a Creative Commons Attribution-
>> ShareAlike 2.5 License. Distribution of modified versions is allowed
>> under this license, and I believe that we include proper attribution.
>> Also section 4b of CC-BY-SA-2.5 explicitly allows distribution of a
>> modified work under CC-BY-SA-3.0.

> Fair enough, but please be sure to run the fact that you are changing
> something is obviously copyrighted by someone else with a declaration
> that it can not be changed, by relying on the wayback machine to make
> that change past a copyright lawyer.  There is a reason that the DCO is
> not under such a license anymore, as this "respin" proves it :)

>> > Again, just use the DCO, please.
>>
>> See above, the simple reason is that we need an exception for license
>> files.
>>
>> Then again, Linux might profit from such a clause too. See for example
>> the following commit:
>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/LICENSES/preferred/GPL-2.0?id=255247c2770ada6edace04173b35307869b47d99
>>
>> The commit message carries two Signed-off-by lines (and a Reviewed-by
>> by yourself). But let's look what the document says about its license:
>>
>> + Everyone is permitted to copy and distribute verbatim copies
>> + of this license document, but changing it is not allowed.
>>
>> Clearly, this isn't an open source license, because it doesn't allow
>> modifications. So I wonder how the committer could certify agreement
>> to the DCO 1.1 there?

> Section b) should cover this nicely.  If your lawyers somehow feel it
> does not, I will be glad to consult with the LF lawyers about this and
> have them discuss the matter.

> Also note that I really doubt that the fact that you can include
> verbatim copies of a license in a repo is going to make anyone upset at
> all, unless you modify that license text.  So you might all be worried
> about nothing "real" at all here.  License files are not code, just like
> documentation is not code, and almost all open source licenses do not
> cover either of them well, if at all.

> As an armchair thought experiment of this, how would the overall license
> of a GNU project's tarball release such as bash, which is GPLv3, cover
> the license file of the GPLv3 text that is included in the tarball?
> Would the inclusion of a file in the tarball that is obviously not under
> a free software license cause that project's license to somehow not be
> "free software"?

> It's a fun rabit hole to go down, but one that I think you will have to
> do on your own :)

>> > No, I personally will not sign any CLAs, sorry.
>>
>> This is interesting, since you had previously signed the copyright
>> assignment form to Gentoo Technologies, Inc. (To be precise, you PGP
>> signed it and sent it to recruiters@g.o on 2004-03-08.)

> That was because I was forced to do so in order to become a Gentoo
> developer at the time, and my employer at the time also insisted on it,
> as they were the owners of all of the work that I did on Gentoo, not me.
> I had no say in the matter at all, just like almost all other people
> employed in the US due to the standard employment contract used.  So to
> be clear, that was not _me_ giving up any copyrights, it was my
> employer.

> My position has changed on how best to handle copyrights in the 14 years
> since then, and I currently am employed by someone who allows me to keep
> my personal copyright (while also giving them a copy) so I guess I
> should figure out how to somehow retroactively not-sign it :)

> Any hints as to how to do that?

> Anyway, my strongest suggestion as to why not to change to use your
> custom license is the fact that you will now require all Gentoo
> developers who work for companies that allow their employers to
> contribute to Gentoo, to now have to have their lawyers read over this
> new license and come to an understanding of it before those people are
> allowed to contribute.  That's a huge waste of time and money and will
> make those companies, and developers, grumpy.

> And if developers ignore the fact that they should have run this change
> by their employers, that could get them into big trouble later on.

> thanks,

> greg k-h