[gentoo-project] [RFC] GLEP 76: Copyright Policy [v2]

[Ulrich Mueller]

>>>>> On Sun, 10 Jun 2018, Ulrich Mueller wrote:

> Please find below the draft of a new copyright policy, which was in
> the making since 2013 at least. After several iterations, we have
> come up with a policy with the following key elements:

> - Gentoo projects must release their work under GPL-compatible free
>   software licenses, preferably under GPL-2 or later. CC-BY-SA-3.0
>   (or 4.0) can be used for documentation.

> - All commits to Gentoo repositories must be accompanied by a
>   certificate of origin. Typically, this would be declared by adding
>   a "Signed-off-by:" line (or several of them) to every commit.
>   This model is very similar to the one used for development of the
>   Linux kernel.

> - The copyright notice, especially for ebuilds, will contain the
>   name of the largest contributor, plus an "and others" clause when
>   necessary. (So the "Copyright Gentoo Foundation" lines will be
>   phased out.)

Find an updated version below, taking input from IRC and mailing lists
into consideration. The main changes are:

- Take into account that some assets (like images) won't allow for
  a copyright notice in the file itself.
- Don't rely on line counting, but state that the main copyright
  holder must be listed.
- Allow for a simplified form of the copyright notice, attributing
  copyright to "The Gentoo Authors".

The source of the GLEP can be found at [1] (or included below);
the rendered version is at [2].

Ulrich

[1] ReST: https://gitweb.gentoo.org/data/glep.git/tree/glep-0076.rst
[2] HTML: https://www.gentoo.org/glep/glep-0076.html


---
GLEP: 76
Title: Copyright Policy
Author: Richard Freeman <rich0@g.o>,
        Alice Ferrazzi <alicef@g.o>,
        Ulrich Müller <ulm@g.o>,
        Robin H. Johnson <robbat2@g.o>,
        Michał Górny <mgorny@g.o>
Type: Informational
Status: Draft
Version: 1
Created: 2013-04-23
Last-Modified: 2018-06-17
Post-History: 2018-06-10, 2018-06-19
Content-Type: text/x-rst
---


Status
======

The policies on this page have no effect!  These are draft policies up
for discussion, not final versions.


Abstract
========

This GLEP introduces a copyright and licensing policy for Gentoo
projects.  It requires all contributions of software or documentation
to be released under a free license, and to be accompanied by a
certificate of origin.


Motivation
==========

The copyright ownership of Gentoo materials is ambiguous due to
historical factors, and this GLEP attempts to improve the process
going forward.

In the beginning (2000 or earlier), the copyright header stated that
*Gentoo Technologies, Inc.* was the copyright holder, without any
formal paperwork.  The formal assignment document was however only
introduced in early 2004.  The assignment had many objectors (mostly
on the ``gentoo-core`` mailing list).  The developer recruiting
procedures attempted to require signing of the document as a condition
for becoming a developer, but it was not applied to pre-existing
developers, or those that objected.

Later, the *Gentoo Foundation* was established, and copyrights were
formally transferred (including nullifying original developer
assignments to *Gentoo Technologies, Inc.*), and the copyright header
was updated.  The formal assignment document text was updated in 2006,
but the formal assignment process had already been abandoned in
mid-2004.

Throughout this, the presence of copyright headers existed as a
policy, and continues to exist to this day.  Some files also still
contain or have in the past contained additional copyright headers,
attributing ownership to other parties.

The policy to have copyright notices ascribing copyright ownership to
the Gentoo Foundation caused an issue when Gentoo developers forked
another project and hosted the fork on Gentoo infrastructure.  To
comply with the previous policy the copyright notices were modified,
which caused concerns with the project the files were forked from.
Our previous policy completely neglected the possibility that Gentoo
might want to host files that were not created internally.

Finally, since the early days of Gentoo new ideas around copyright
licensing have become more popular, such as the FSFE's Fiduciary
License Agreement [#FLA]_, which takes a copyleft approach to
copyright licensing, while also better complying with copyright laws
in nations that have author's rights.

The goal here was to create a policy that was flexible enough to cover
forks and situations where Gentoo would not own the majority of the
copyright in a file.


Specification
=============

Purpose / Scope
---------------

This policy documents how Gentoo contributors comply and document
copyright for any contributions made to Gentoo.  Anyone committing
documentation or sources to any repository hosted on Gentoo
infrastructure or to any official Gentoo project (independently
of hosting) must comply with this policy.  Unofficial Gentoo projects
are also recommended to use this policy.

Questions regarding this policy should be directed to the trustees or
the -project list.  Any concerns over possible copyright violations
should be directed to the Trustees if they cannot be worked out to
anyone's satisfaction with the appropriate maintainer.


Licensing of Gentoo Projects
----------------------------

Every Gentoo project must abide by the Gentoo Social Contract
[#SOCIAL-CONTRACT]_ and release its work under one or more of the
following:

a) The GNU General Public License, version 2 or later (GPL-2+)
   [#GPL-2]_.

b) The Creative Commons Attribution-ShareAlike 3.0 License
   (CC-BY-SA-3.0, only for documentation) [#CC-BY-SA-3.0]_.
   *[Note: or version 4.0, to be decided]*

c) A license approved as GPL compatible by the Free Software
   Foundation [#GPL-COMPAT]_.

Exceptions for other free software licenses will be granted by the
Gentoo Foundation on a case by case basis.

For easy reference, the license for each project should be documented
on the wiki page at [#PROJECTS]_.


Certificate of Origin
---------------------

All commits to Gentoo project repositories shall be accompanied by a
certificate of origin.  The purpose of the certificate is to declare
that the contribution can be modified and redistributed in accordance
with the project's license.

For commits made using a VCS, the committer shall certify agreement
to the Gentoo DCO by adding ``Signed-off-by: Name <e-mail>`` to the
commit message as a separate line.  Committers must use their real
name, i.e., the name that would appear in an official document like
a passport.

The following is the current Gentoo DCO::

    Gentoo Developer's Certificate of Origin, revision 1

    By making a contribution to this project, I certify that:

    (1) The contribution was created in whole or in part by me, and I have
        the right to submit it under the free software license indicated
        in the file; or

    (2) The contribution is based upon previous work that, to the best
        of my knowledge, is covered under an appropriate free software
        license, and I have the right under that license to submit that
        work with modifications, whether created in whole or in part by
        me, under the same free software license (unless I am permitted
        to submit under a different license), as indicated in the file; or

    (3) The contribution is a license text (or a file of similar nature),
        and verbatim distribution is allowed; or

    (4) The contribution was provided directly to me by some other person
        who certified (1), (2), (3), or (4), and I have not modified it.

    I understand and agree that this project and the contribution are
    public and that a record of the contribution (including all personal
    information I submit with it, including my sign-off) is maintained
    indefinitely and may be redistributed consistent with this project or
    the free software license(s) involved.

The Gentoo DCO is licensed under a Creative Commons
Attribution-ShareAlike 3.0 Unported License [#CC-BY-SA-3.0]_.
It is based on the Linux Kernel DCO [#OSDL-DCO]_, released by Open
Source Development Labs, Inc. in 2005 under a CC-BY-SA-2.5 License.


Copyright Attribution
---------------------

All copyrightable files included in Gentoo projects must contain
appropriate copyright and license notices, as defined by this policy.
For files in textual format, these notices normally appear near the
top of the file.  When technical limitations do not allow for text
notices in the file itself (e.g., for binary image file formats),
copyright and license can be stated in an accompanying text file in
the same directory.

A proper copyright notice reads::

    Copyright YEARS MAIN-CONTRIBUTOR [OTHER-CONTRIBUTOR]... [and others]

It must list the main copyright holder, who is usually the original
author, or the contributor holding copyright to the largest portion
of the file.  Additional copyright holders can be listed, but this is
normally not required.  The "and others" text may be omitted if the
explicitly listed contributors hold copyright to the entire file.

Anyone finding a file out of compliance should file a bug against the
associated project/package providing as much information as possible.
Files that are not brought into compliance within 60 days or upon a
request for removal by a aggrieved copyright holder will be removed.
Any concerns not addressed by a maintainer can be appealed to the
Trustees.


Simplified Attribution
----------------------

Alternatively, projects are welcome to use a simplified form of the
copyright notice, which reads::

    Copyright YEARS The Gentoo Authors

Projects using this scheme must track authorship in a VCS, unless they
list all authors of copyrightable contributions in an ``AUTHORS`` file.


Rationale
=========

Policy
------

This document aims to provide a single consistent copyright policy for
all Gentoo projects.  It is explicitly enforced for all official Gentoo
projects in order to protect the interests of Gentoo as a whole,
including its contributors, developers and users.  Additionally, it is
enforced for all other projects hosted on Gentoo infrastructure in order
to protect the Gentoo infrastructure owners and improve consistency.

The copyright model is built on the DCO model used by the Linux kernel
and requires all contributors to certify the legitimacy of their
contributions.  This also requires that they use their real name for
signing; an anonymous certification or one under a pseudonym would not
mean anything.

In the future, a second stage of this policy may use a combination of
the DCO model and an FLA model [#FLA]_ as it is used by different open
source projects.  Contributors would be able to freely choose whether
they sign the FLA document or not.


Licensing of Projects
---------------------

The Social Contract mentions GPL-2 and CC-BY-SA-2.0, both with the
option to use them in a later version ("at our discretion").  In order
to facilitate interchange of software between different projects, we
aim for uniformity of their licensing.  Therefore, items a) and b)
explicitly recommend the use of GPL-2+ and CC-BY-SA-3.0.  The latter
is restricted to be used for documentation, because Creative Commons
themselves recommend against using their licenses for software
[#CC-SOFTWARE]_.

Other GPL-compatible free software licenses that are not explicitly
listed are allowed by item c).  This covers cases where compatibility
to licenses used by upstream projects is necessary.  (For example,
the Gentoo BSD project may want to use the 2-clause or 3-clause BSD
license).

By default, GPL-incompatible licenses (e.g., the CDDL) are not
allowed, because their use would hinder interchange of code between
Gentoo projects.  However, the Foundation can grant exceptions to
this, as long as the license in question is a free software or open
source license.


DCO Changes
-----------

The Gentoo DCO rev. 1 has been based on Linux Kernel DCO 1.1
[#OSDL-DCO]_.  It features the following modifications from
the original:

1. The enumeration has been modified to use numeric points.

2. Additional point (3) has been inserted::

       (3) The contribution is a license text (or a file of similar nature),
       and verbatim distribution is allowed; or

3. The original point (c) has shifted to become point (4), and has been
   updated to account for the additional point (3).

4. The original point (d) has been transformed into a stand-alone
   paragraph following the enumeration.

5. The term "open source" has been replaced by "free software"
   throughout.

The new point was deemed necessary to allow committing license files
into the Gentoo repository, since those files usually do not permit
modification.  It has been established that adding a clear provision
for this case is better than excluding those commits from DCO
compliance.  Debian was facing a similar problem [#DEBIAN-LICENSE]_.

The update of point (c) was necessary to allow the new clause being
certified by the person providing the contribution.

The term "free software" is used for consistency with the language
of the Gentoo Social Contract [#SOCIAL-CONTRACT]_.

The remaining changes were merely editorial.  It has been established
that the last point is really separate from the other points, so it is
more appropriate to separate it from the enumeration by putting it
in a separate paragraph.


Copyright Notice
----------------

Especially for ebuild repositories, constantly keeping track of the
main copyright holder of any file would be rather inconvenient and
tedious.  Therefore, projects are free to use either a traditional
copyright notice listing the individual author(s), or a simplified
notice with an attribution to "The Gentoo Authors".  The latter
resembles the scheme used by the Chromium project [#CHROMIUM]_.


Acknowledgements
================

Many people have participated in invaluable discussions on this GLEP.
In particular, the authors would like to thank David Abbott,
Roy Bamford, Kristian Fiskerstrand, Andreas K. Hüttel, Manuel Rüger,
Matija Šuklje, Matthew Thode, and Alec Warner for their input.


References
==========

.. [#SOCIAL-CONTRACT] Gentoo Social Contract,
   https://www.gentoo.org/get-started/philosophy/social-contract.html

.. [#GPL-2] GNU General Public License, version 2 or later,
   http://www.gnu.org/licenses/gpl-2.0.html

.. [#CC-BY-SA-3.0] Creative Commons Attribution-ShareAlike 3.0
   Unported License, http://creativecommons.org/licenses/by-sa/3.0/

.. [#GPL-COMPAT] GPL-compatible free software licenses,
   https://www.gnu.org/licenses/license-list.en.html#GPLCompatibleLicenses

.. [#PROJECTS] Licensing of Gentoo projects,
   https://wiki.gentoo.org/wiki/Project:Licenses/Licensing_of_Gentoo_projects

.. [#OSDL-DCO] Developer's Certificate of Origin 1.1,
   https://web.archive.org/web/20060524185355/http://www.osdlab.org/newsroom/press_releases/2004/2004_05_24_dco.html

.. [#FLA] FSFE Legal: Fiduciary Licence Agreement (FLA),
   https://fsfe.org/activities/ftf/fla.en.html

.. [#CC-SOFTWARE] Can I apply a Creative Commons license to software?
   https://creativecommons.org/faq/#can-i-apply-a-creative-commons-license-to-software

.. [#DEBIAN-LICENSE] [debian-legal] License of the GPL license,
   https://lists.debian.org/debian-legal/2018/04/msg00006.html

.. [#CHROMIUM] Chromium: Contributing Code,
   https://www.chromium.org/developers/contributing-code#TOC-Legal-stuff


Copyright
=========

This work is licensed under the Creative Commons Attribution-ShareAlike 3.0
Unported License.  To view a copy of this license, visit
http://creativecommons.org/licenses/by-sa/3.0/.