Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Sarah White]

On 10/11/2018 05:28 PM, Rich Freeman wrote:
> On Thu, Oct 11, 2018 at 5:09 PM Andrew Savchenko <bircoph@g.o> wrote:
>>
>> It does matter, at least in some other countries (non-US). Anyway I
>> doubt that even in US committer has right to change copyright
>> notice without author's approval.
>>
>
> I actually couldn't find any law that explicitly forbids swapping
> names in a copyright notice in the US.  It is illegal if you do it to
> conceal copyright infringement, but if you have a license to modify
> the work and redistribute it, and you respect all the licenses/etc,

[...]

>
> My thinking with the policy was to allow us to preserve these kinds of
> notices to avoid the issue, but the intent wasn't to keep grafting
> names onto them.
>
> As far as I can tell the Linux source code doesn't have any kind of
> consistent copyright notice use - it seems like whoever first
> contributes any random file picks whatever notice they want and it
> tends to not get touched after that.

[...]

>> It is virtually impossible to account for all authors of an ebuild,

> Why? We have git log. And we have "and others" clause to
> account > for trivial changes, e.g. if person making some
> mass-package trivial change, this may go to "and others".

--- end quotes ---

assuming "commit authors are copyright holders" shouldn't be
trusted blindly (the git log doesn't "solve everything")

~ moving on:

There are valid ways to track copyrightable changes over the
course of many years. I see no reason why a sensible format
can't be adopted and used, rather than debating "what about"
situations and other hypothetical issues to justify...

"Simplified Attribution" - I've not seen case law on this.

Does this mean "gentoo authors" will appear in court when
there's infringement? This is not a rhetorical question.

---

Using linux kernel as an example, MuQSS scheduler:

{tree:4.18-ck} /linux/kernel/sched/MuQSS.c

// SPDX-License-Identifier: GPL-2.0
/*
 *  kernel/sched/MuQSS.c, was kernel/sched.c
 *
 *  Kernel scheduler and related syscalls
 *
 *  Copyright (C) 1991-2002  Linus Torvalds
 *
 *  1996-12-23  Modified by Dave Grothe to fix bugs in semaphores and
 *		make semaphores SMP safe
 *  1998-11-19	Implemented schedule_timeout() and related stuff
 *		by Andrea Arcangeli
 *  2002-01-04	New ultra-scalable O(1) scheduler by Ingo Molnar:
 *		hybrid priority-list and round-robin design with
 *		an array-switch method of distributing timeslices
 *		and per-CPU runqueues.  Cleanups and useful suggestions
 *		by Davide Libenzi, preemptible kernel bits by Robert Love.
 *  2003-09-03	Interactivity tuning by Con Kolivas.
 *  2004-04-02	Scheduler domains code by Nick Piggin
 *  2007-04-15  Work begun on replacing all interactivity tuning with a
 *              fair scheduling design by Con Kolivas.
 *  2007-05-05  Load balancing (smp-nice) and other improvements
 *              by Peter Williams
 *  2007-05-06  Interactivity improvements to CFS by Mike Galbraith
 *  2007-07-01  Group scheduling enhancements by Srivatsa Vaddagiri
 *  2007-11-29  RT balancing improvements by Steven Rostedt, Gregory
Haskins,
 *              Thomas Gleixner, Mike Kravetz
 *  2009-08-13	Brainfuck deadline scheduling policy by Con Kolivas deletes
 *              a whole lot of those previous things.
 *  2016-10-01  Multiple Queue Skiplist Scheduler scalable evolution of BFS
 * 		scheduler by Con Kolivas.
 */

This is a very useful notice, because if someone has a snapshot
tarball, or other non-git copy of particular source files, the
lack of a proper notice is a legal problem (see below)

This has been mentioned - it's technically true
(to some extent, at least in most jurisdictions)

["copyright notices are not required for
a copyright holder to have a copyright"]

- This ignores the purpose: copyright notices are to make
sure when someone gets "free code", they don't assume it's
free for any/all purposes with zero restrictions:

the infringer could say the copyright status (copyleft
uses copyright law for enforcement) wasn't apparent due
to the lack of a clearly formatted copyright notice...

... so something generic like "gentoo authors" can be
difficult to enforce - I've not seen case law on this.

---

I believe licensing is the reason for GCO, not copyright
attribution. Language about committer, acked or signed-off,
and copyright holder VS licenses and GCO, all within the
same GLEP (#76) adds a lot of confusion because copyright
is barely mentioned, and not in a clearly defined way.

Copyright should be treated as a separate issue from GCO.

---

US law was mentioned. Source code copyrights are under:

17 USC § 401 - Notice of copyright: Visually perceptible copies

...

["the name of the owner of copyright in the work, or an
abbreviation by which the name can be recognized, or a
generally known alternative designation of the owner"]

...

["If a notice of copyright in the form and position
specified by this section appears on the published copy
or copies to which a defendant in a copyright infringement
suit had access, then no weight shall be given to such a
defendant’s interposition of a defense based on innocent
infringement in mitigation of actual or statutory damages,
except as provided in the last sentence of section 504(c)(2)."]

^ This is important. More non-rhetorical questions:

Do "gentoo authors" file a lawsuit when there's infringement?

How does jurisdiction work when the only thing which can
be known for certain is: "someone claimed the commit they
wrote was FOSS/Libre & they signed-off with a GCO line"

Does this mean GCO sign-off lines obligate the contributors
to respond whenever FOSS/Libre legal issues come up?

---

Most, if not all SPDX-style headers (which lists the specific
names of specific copyright holders) are in a format which
resembles what US copyrights law needs. it's wrong to claim:

["a generally known alternative designation of the owner"]

... is <legal name> generally know as: "gentoo authors" ?

(<legal name> is more likely to have a unique trade name,
and the uniqueness of it is what makes it legal. stripping
valid copyright notices and putting in something vague in
its place - that idea needs a proper legal review)

If there was a FLA policy in place, and gentoo formally held
itself out to protect (as a fiduciary) any FOSS/Libre interests
of the contributors; gentoo needs to hold the copyright, and
more importantly: invest in policy and planning to legally
protect FOSS/Libre interests when any infringement occurs.

the protection should be proper: a real entity. changing
the language from foundation to authors and treating it
like it's still a copyright assignment is pointless
unless the simplified attribution still assigns the
copyright to the gentoo foundation hold copyright.

~ this is unclear ~

If the gentoo foundation IS NOT the copyright holder...

the generic (simplified) attribution as: "gentoo authors"

["...in the form and position specified by this section"]

^ 17 USC § 401 generally expects a real entity (which can
be a natural person or legal entity / organization) to
hold copyright.

["the name of the owner of copyright in the work, or an
abbreviation by which the name can be recognized, or a
generally known alternative designation of the owner"]

~ "gentoo authors" (contributors) deserve peace of mind.

---

TL;DR

GLEP 76 shouldn't try to be an umbrella for multiple things.

~ as bircoph said: ["... creating additional barriers due to
vague and bureaucratic reasons."] - (it's a great quote)

---

{ apology for mixing / summarizing multiple quotes, I tried
my best, but inline replies are too confusing to proofread,
especially when multiple authors are being quoted. this is
actually my 10th draft I've been working on this for hours,
and it's still pretty rough. I tried. }