[gentoo-project] Re: [gentoo-dev-announce] Poll: Would you sign a Contributer License Agreement?

[Ulrich Mueller]

>>>>> On Thu, 31 May 2018, Greg KH wrote:

>> We simply cannot. We have files in the Gentoo repository that are not
>> under a free software license, and for these we need an extra clause.

> Your "extra clause" is pretty odd.  You took out the c) clause of the
> original DCO for some unknown reason as well, which is going to cause
> you big problems.

No, previous clause (c) has been moved to (d).

And previous clause (d) is a separate paragraph below the list,
because the logical structure of it made no sense before. In the
original DCO, "I certify that" refers to items (a) to (c) only,
but (d) is separate from it. (So while at it, we have fixed this as
well, in order to make the structure consistent with the meaning.)

> Was this vetted by a lawyer? Again, this is going to cause companies
> to have to spend lots of time and money to be able to get anyone to
> use this, do not change things lightly.

Huh? The wording is quite simple, and it won't take anybody with even
half a brain more than 2 minutes to figure it out.

> [...]

> Are you _sure_ you need this change?

Pretty sure, yes. The alternative would be to have exceptions to the
S-o-b policy, and it would be a nightmare to verify that.

>> How is it a copyright violation? We create a modified version of
>> a document that was released under a Creative Commons Attribution-
>> ShareAlike 2.5 License. Distribution of modified versions is
>> allowed under this license, and I believe that we include proper
>> attribution. Also section 4b of CC-BY-SA-2.5 explicitly allows
>> distribution of a modified work under CC-BY-SA-3.0.

> Fair enough, but please be sure to run the fact that you are
> changing something is obviously copyrighted by someone else with a
> declaration that it can not be changed, by relying on the wayback
> machine to make that change past a copyright lawyer.  There is a
> reason that the DCO is not under such a license anymore, as this
> "respin" proves it :)

"The CC licenses are irrevocable. This means that once you receive
material under a CC license, you will always have the right to use it
under those license terms, even if the licensor changes his or her
mind and stops distributing under the CC license terms."
https://creativecommons.org/faq/

Plus, if the DCO would be under a non-free license, then by its own
terms we won't be able to commit it to our documentation. :) And in
fact, also our Social Contract requires our documentation to be under
a free license.

>> > Again, just use the DCO, please.
>>
>> See above, the simple reason is that we need an exception for license
>> files.
>>
>> Then again, Linux might profit from such a clause too. See for example
>> the following commit:
>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/LICENSES/preferred/GPL-2.0?id=255247c2770ada6edace04173b35307869b47d99
>>
>> The commit message carries two Signed-off-by lines (and a Reviewed-by
>> by yourself). But let's look what the document says about its license:
>>
>> + Everyone is permitted to copy and distribute verbatim copies
>> + of this license document, but changing it is not allowed.
>>
>> Clearly, this isn't an open source license, because it doesn't allow
>> modifications. So I wonder how the committer could certify agreement
>> to the DCO 1.1 there?

> Section b) should cover this nicely.

Section (b) says "covered under an appropriate free software license",
and this condition is obviously not fulfilled.

> If your lawyers somehow feel it does not, I will be glad to consult
> with the LF lawyers about this and have them discuss the matter.

> Also note that I really doubt that the fact that you can include
> verbatim copies of a license in a repo is going to make anyone upset
> at all, unless you modify that license text.  So you might all be
> worried about nothing "real" at all here.  License files are not
> code, just like documentation is not code, and almost all open
> source licenses do not cover either of them well, if at all.

I agree to all of this, but it is not the question at hand.
The question is if a developer can certify a commit of an immutable
license file, and I don't see how he could certify it with the
original DCO, which unconditionally requires an open source license.

Also we want people to actually think about what they certify. IANAL,
but wouldn't it weaken one's legal position if someone found commits
of non-open-source material certified by the original DCO (which
requires open source)? Might it not even be taken as a sign that
developers add these Signed-off-by lines carelessly?

> As an armchair thought experiment of this, how would the overall
> license of a GNU project's tarball release such as bash, which is
> GPLv3, cover the license file of the GPLv3 text that is included in
> the tarball?

GNU projects usually have a license notice in every file. For bash it
is GPL-3+ for most of the files, but some (like README or NEWS) are
distributed under more relaxed terms, and COPYING allows only its
verbatim distribution. So no, GPL-3 doesn't cover its own license
text.

> Would the inclusion of a file in the tarball that is obviously not
> under a free software license cause that project's license to
> somehow not be "free software"?

> It's a fun rabit hole to go down, but one that I think you will have
> to do on your own :)

Other distros are aware of the problem, too:
https://lists.debian.org/debian-legal/2018/04/msg00006.html

Ulrich