Re: [gentoo-project] rfc: copyright attribution clarifications

[Sarah White]

On 11/24/18 9:22 PM, Rich Freeman wrote:
> On Sat, Nov 24, 2018 at 9:04 PM Sarah White <kuzetsa@××××××××××.ovh> wrote:
>>
>> On 11/24/18 8:37 PM, Rich Freeman wrote:
>>
>> So if it isn't meant to say that gentoo will be looking
>> after the legal aspects of a FOSS/Libre-copyleft licensed
>> package or document or tool, then what's the purpose to
>> put gentoo's name on it?
>
> You have to put somebody's name in the notice, and it was felt that
> "Gentoo Authors" gets the job done.  "Gentoo Authors" is not Gentoo.
> They are the authors contributing to the ebuild.
>
>> There's some innuendo and/or implication that copyright
>> holders who have their own name listed in a copyright
>> notice are intending to do something other than participate
>> in FOSS/Libre work, or perhaps may not truly wish to
>> contribute in good faith.
>
> Not at all.  The issue is that accumulating names creates clutter, and
> create some sense that people who are named are doing more than people
> who aren't named, which may lead to more people wanting to be named.
>
> This is also why the policy allows for an AUTHORS file or use of a
> VCS.  The intent isn't to deny people credit.  It is to provide credit
> in a more reasonable manner vs having it spammed on the first lines of
> every file in the tree, and try to create a culture where we don't
> equate copyright notice with credit or property.
>
>> Does gentoo have a legitimate reason
>> to substitute a gentoo copyright notice in place of an
>> otherwise valid notice?
>
> The GLEP already allows existing works that have a non-Gentoo notice
> to keep their notice and add "and others" if there are further
> additions if they are brought into Gentoo from outside.  This doesn't
> mean that we keep adding names to things.  This was intended for
> things like eudev where we took an entire mature code body and forked
> it.  This doesn't make as much sense for somebody contributing a 10
> line ebuild to a repository containing thousands of ebuilds.
>
>> Is there an intent to create a sort of gatekeeper role
>> within the gentoo organization to request documentation
>> if a contributor uses a non-gentoo copyright notice?
>
> As the GLEP stands developers are already gatekeepers by virtue of
> being the only ones with commit access, and being required to sign off
> on the DCO.  This requires them to be aware of the copyright status of
> the works they are committing, but we do not require the accumulation
> of documentation.  However, the GLEP does not provide for multi-line
> notices and the intent isn't to keep accumulating them over time.  The
> intent was to be able to bring outside stuff in as-is as long as the
> notices are reasonable and then just freeze them in time with "and
> others" or simplify them with Gentoo Authors if appropriate.
>


Fair point. GLEP 76 even mentions commits in several places.

[1] From GLEP 76 itself:

["This policy documents how Gentoo contributors comply and
document copyright for any contributions made to Gentoo."]

Specifically the section: Copyright Attribution

["It must list the main copyright holder, who is usually
the original author, or the contributor holding copyright
to the largest portion of the file."]

But then the other section: Simplified Attribution

... which contains some guidance for an alternative form:

["Alternatively, projects are welcome to use a simplified
form of the copyright notice, which reads:"]

~ This word "alternatively", strongly implies that the
default form should be used unless there is an overly
complicated or long list of entities / people who hold
copyright ~ at that point I agree with what you said:

["... simplify them with Gentoo Authors if appropriate."]

From a quick glance at bug #670702, I'm noticing there was
some confusion about GLEP 76 layout conventions. [2]

I think the confusing may have partly come from people who
are experienced working with some of the better-known metadata
formatting styles (for copyright, license, etc.) which is used
in other organizations.

Debian uses some SPDX-styled copyright formatting, along
with some other (non-SPDX, possibly in-house) formats.
It's an interesting mix, but still well-documented. [3]

And as for SPDX itself, the full spec is far more exhaustive
than anything gentoo or debian is using. Even the one-page
summary for SPDX is well-written. Open standards exist, and
I'm a fan of this one in particular. [4]

This wording from GLEP 76 seems unambiguous to me:

Exceptional circumstances are required for simplified
attribution be more appropriate, compared to the default of
a proper copyright notice which lists the entity whom held
copyright when a contribution was made.

-- kuza

[1] https://www.gentoo.org/glep/glep-0076.html
[2] https://bugs.gentoo.org/670702
[3] https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
[4] https://spdx.org/sites/cpstandard/files/pages/files/spdx_onepager.pdf