[gentoo-nfp] [PATCH 0/4] Some updates to the Social Contract

[gentoo-nfp] [PATCH 0/4] Some updates to the Social Contract

[Ulrich Müller]

The first patch of the series changes the requirement for contributions
from OSI-approved to FSF-approved licenses. In practice this will make
very little difference, but it avoids the problem that we require
CC-BY-SA for documentation, which isn't an OSI approved license.
See the commit message for a more complete rationale.

The second patch shifts the responsibility for exceptions to the public
bug policy from Trustees to the Council.

The remaining two patches are editorial changes.

Ulrich Müller (4):
  Social contract: Change OSI approved to FSF approved
  Social contract: Exceptions to the public bug policy
  Social contract: Update spelling of CC-BY-SA license
  Social contract: Restore Gentoo metastructure link

 get-started/philosophy/social-contract.md | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

-- 
2.45.2

[gentoo-nfp] [PATCH 1/4] Social contract: Change OSI approved to FSF approved

[Ulrich Müller]

Rationale:
- The Creative Commons Attribution-ShareAlike License is approved by
  the FSF but not by the OSI.
- The OSI has approved some dubious licenses (e.g. Watcom-1.0) which
  we do not want.
- FSF approved is more in line with the term "free software" (instead
  of "open source") that is used throughout.
- GLEP 76 says "approved as GPL compatible by the Free Software
  Foundation" (which is a stronger requirement).

Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 get-started/philosophy/social-contract.md | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/get-started/philosophy/social-contract.md b/get-started/philosophy/social-contract.md
index 6972245..36f2e35 100644
--- a/get-started/philosophy/social-contract.md
+++ b/get-started/philosophy/social-contract.md
@@ -32,11 +32,10 @@ under the GNU General Public License version 2 (or later, at our discretion) or
 Any external contributions to Gentoo (in the form of freely-distributable sources, binaries, metadata or documentation) may be incorporated into Gentoo
 provided that we are legally entitled to do so.
 However, Gentoo will never depend upon a piece of software or metadata unless it conforms to the GNU General Public License, the GNU Lesser General Public License,
-the Creative Commons - Attribution/Share Alike or some other license approved by the Open Source Initiative ([OSI](https://www.opensource.org/licenses)).
+the Creative Commons - Attribution/Share Alike or some other license approved by the Free Software Foundation ([FSF](https://www.fsf.org/licensing/)).
 
 <div class="alert alert-success">
-Note: We are considering extending the above clause to require that all core Gentoo components must conform
-to a license approved by the OSI and Free Software Foundation (<a href="https://www.gnu.org/">FSF</a>).
+Note: Details of our copyright policy are regulated by [GLEP 76](https://www.gentoo.org/glep/glep-0076.html).
 </div>
 
 ## We will give back to the free software community
-- 
2.45.2

[gentoo-nfp] [PATCH 2/4] Social contract: Exceptions to the public bug policy

[Ulrich Müller]

After Gentoo Linux has become an associated project of SPI, the
Council is the obvious entity to be responsible for the tasks
previously assigned to the Trustees.

See also commit b48c808 and bug 536668 for a previous update of the
same sentence.

Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 get-started/philosophy/social-contract.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/get-started/philosophy/social-contract.md b/get-started/philosophy/social-contract.md
index 36f2e35..f51989d 100644
--- a/get-started/philosophy/social-contract.md
+++ b/get-started/philosophy/social-contract.md
@@ -46,4 +46,4 @@ We will establish relationships with free software authors and collaborate with
 
 We will keep our [bug report database](https://bugs.gentoo.org/) open for public view at all times; reports that users file online will immediately become visible to others.
 
-Exceptions may be made at the discretion of the Trustees.
+Exceptions may be made at the discretion of the Council.
-- 
2.45.2

[gentoo-nfp] [PATCH 3/4] Social contract: Update spelling of CC-BY-SA license

[Ulrich Müller]

Its official name is "Creative Commons Attribution-ShareAlike License".
Change version to 2.0 because there never was a version 2.

Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 get-started/philosophy/social-contract.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/get-started/philosophy/social-contract.md b/get-started/philosophy/social-contract.md
index f51989d..d126690 100644
--- a/get-started/philosophy/social-contract.md
+++ b/get-started/philosophy/social-contract.md
@@ -28,11 +28,11 @@ A Gentoo project does not need to produce a Gentoo operating system in order to
 ## Gentoo is and will remain free software
 
 We will release our contributions to Gentoo as free software, metadata or documentation,
-under the GNU General Public License version 2 (or later, at our discretion) or the Creative Commons - Attribution / Share Alike version 2 (or later, at our discretion).
+under the GNU General Public License version 2 (or later, at our discretion) or the Creative Commons Attribution-ShareAlike License version 2.0 (or later, at our discretion).
 Any external contributions to Gentoo (in the form of freely-distributable sources, binaries, metadata or documentation) may be incorporated into Gentoo
 provided that we are legally entitled to do so.
 However, Gentoo will never depend upon a piece of software or metadata unless it conforms to the GNU General Public License, the GNU Lesser General Public License,
-the Creative Commons - Attribution/Share Alike or some other license approved by the Free Software Foundation ([FSF](https://www.fsf.org/licensing/)).
+the Creative Commons Attribution-ShareAlike License or some other license approved by the Free Software Foundation ([FSF](https://www.fsf.org/licensing/)).
 
 <div class="alert alert-success">
 Note: Details of our copyright policy are regulated by [GLEP 76](https://www.gentoo.org/glep/glep-0076.html).
-- 
2.45.2

[gentoo-nfp] [PATCH 4/4] Social contract: Restore Gentoo metastructure link

[Ulrich Müller]

This had existed in the GuideXML version before:
https://gitweb.gentoo.org/archive/proj/gentoo.git/tree/xml/htdocs/main/en/contract.xml#n66
Presumably, the link was dropped when migrating to Tyrian layout.

Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 get-started/philosophy/social-contract.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/get-started/philosophy/social-contract.md b/get-started/philosophy/social-contract.md
index d126690..e8c47f1 100644
--- a/get-started/philosophy/social-contract.md
+++ b/get-started/philosophy/social-contract.md
@@ -22,7 +22,7 @@ A Gentoo operating system should satisfy the self-hosting requirement.
 In other words, the operating system should be able to build itself from scratch using the aforementioned tools and metadata.
 If a product associated with an official Gentoo project does not satisfy these requirements, the product does not qualify as a Gentoo operating system.
 
-An official list of Gentoo projects is listed under the Gentoo Metastructure.
+An official list of Gentoo projects is listed under the [Gentoo metastructure](https://wiki.gentoo.org/wiki/Project:Gentoo).
 A Gentoo project does not need to produce a Gentoo operating system in order to be officially recognized.
 
 ## Gentoo is and will remain free software
-- 
2.45.2

Re: [gentoo-nfp] [PATCH 1/4] Social contract: Change OSI approved to FSF approved

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 1659 bytes --]

On Fri, Jul 19, 2024 at 07:44:12AM +0200, Ulrich Müller wrote:
> Rationale:
> - The Creative Commons Attribution-ShareAlike License is approved by
>   the FSF but not by the OSI.
> - The OSI has approved some dubious licenses (e.g. Watcom-1.0) which
>   we do not want.
> - FSF approved is more in line with the term "free software" (instead
>   of "open source") that is used throughout.
> - GLEP 76 says "approved as GPL compatible by the Free Software
>   Foundation" (which is a stronger requirement).
NAK in the present format.

"Gentoo will never depend upon a piece of software or metadata unless it conforms to ... or some other license approved by the FSF"
"Gentoo will never depend upon a piece of software or metadata unless it conforms to ... or some other license approved by the FSF"

What does that really mean for us?
The impacted things are licenses that are OSI-approved but *NOT*
FSF-approved, and count as "Gentoo depends on this".

Artistic License 1.0: licenses/Artistic (note that Artistic-2 is FSF-approved)
NASA: nothing packaged
Watcom: 2 packages, nothing critical

Artistic-1 is common in older Perl packages - and they tend to NOT have
the || GPL variant in their licensing.

We need to verify the "depends on this" argument before we can make this
change.

Or we need a different way to say which licenses are valid (like
excluding the Watcom & NASA licenses).

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation President & Treasurer
E-Mail   : robbat2@gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 1113 bytes --]

Re: [gentoo-nfp] [PATCH 1/4] Social contract: Change OSI approved to FSF approved

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 3138 bytes --]

>>>>> On Fri, 19 Jul 2024, Robin H Johnson wrote:

> On Fri, Jul 19, 2024 at 07:44:12AM +0200, Ulrich Müller wrote:
>> Rationale:
>> - The Creative Commons Attribution-ShareAlike License is approved by
>> the FSF but not by the OSI.
>> - The OSI has approved some dubious licenses (e.g. Watcom-1.0) which
>> we do not want.
>> - FSF approved is more in line with the term "free software" (instead
>> of "open source") that is used throughout.
>> - GLEP 76 says "approved as GPL compatible by the Free Software
>> Foundation" (which is a stronger requirement).

> NAK in the present format.

> "Gentoo will never depend upon a piece of software or metadata unless it conforms to ... or some other license approved by the FSF"
> "Gentoo will never depend upon a piece of software or metadata unless it conforms to ... or some other license approved by the FSF"

> What does that really mean for us?
> The impacted things are licenses that are OSI-approved but *NOT*
> FSF-approved, and count as "Gentoo depends on this".

> Artistic License 1.0: licenses/Artistic (note that Artistic-2 is FSF-approved)
> NASA: nothing packaged
> Watcom: 2 packages, nothing critical

> Artistic-1 is common in older Perl packages - and they tend to NOT have
> the || GPL variant in their licensing.

I state that the current wording with OSI-approved isn't any better.
OSI-approved isn't a superset of GPL-approved, e.g. CC0-1.0 (which is
used for software) is missing.

> We need to verify the "depends on this" argument before we can make this
> change.

I think that multiple interpretations are possible:

1. It applies only to our own works, like ebuilds and documentation that
   are authored by developers and contributors. I believe that in this
   case we would be fine with GPL-approved (but not with OSI-approved
   because of CC-BY-SA used as documentation license).

2. In addition, it also applies to everything that is needed for Gentoo
   as an operating system, i.e. at least all packages that are needed
   for the install media and stages. Presumably, in that case even the
   union of @FSF-APPROVED, @FSF-APPROVED-OTHER and @OSI-APPROVED won't
   be enough, but we'd need most that is listed in @FREE. Especially,
   we'd need some of the licenses in @MISC-FREE that aren't approved by
   either organisation.

(Also, what about non-free firmware in the second case?)

> Or we need a different way to say which licenses are valid (like
> excluding the Watcom & NASA licenses).

I am strongly opposed to a license blacklist in the Social Contract.

How about this:

"Gentoo will never depend upon a piece of software or metadata
unless it conforms to ... or some other license that fulfills the
[Free Software Definition](https://www.gnu.org/philosophy/free-sw.html)
or the [Definition of Free Cultural Works](https://freedomdefined.org/)."

This is basically how we operate in practice, assuming the default
ACCEPT_LICENSE="@FREE" setting.

IIUC Debian doesn't rely on FSF or OSI approval either, but they keep
their own list of (DFSG-approved) licenses.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

Re: [gentoo-nfp] [PATCH 1/4] Social contract: Change OSI approved to FSF approved

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 2893 bytes --]

On Fri, Jul 19, 2024 at 09:59:01PM +0200, Ulrich Mueller wrote:
> > Artistic-1 is common in older Perl packages - and they tend to NOT have
> > the || GPL variant in their licensing.
> I state that the current wording with OSI-approved isn't any better.
> OSI-approved isn't a superset of GPL-approved, e.g. CC0-1.0 (which is
> used for software) is missing.
I agree OSI isn't better, but it impacts less things in the tree right
now.

> > We need to verify the "depends on this" argument before we can make this
> > change.
> 
> I think that multiple interpretations are possible:
> 
> 1. It applies only to our own works, like ebuilds and documentation that
>    are authored by developers and contributors. I believe that in this
>    case we would be fine with GPL-approved (but not with OSI-approved
>    because of CC-BY-SA used as documentation license).
> 
> 2. In addition, it also applies to everything that is needed for Gentoo
>    as an operating system, i.e. at least all packages that are needed
>    for the install media and stages. Presumably, in that case even the
>    union of @FSF-APPROVED, @FSF-APPROVED-OTHER and @OSI-APPROVED won't
>    be enough, but we'd need most that is listed in @FREE. Especially,
>    we'd need some of the licenses in @MISC-FREE that aren't approved by
>    either organisation.
> 
> (Also, what about non-free firmware in the second case?)
This part of the social contract is sufficiently unclear that it
probably needs a much wider discussion - but let's keep the patch series
on track with a potential solution.

> > Or we need a different way to say which licenses are valid (like
> > excluding the Watcom & NASA licenses).
> I am strongly opposed to a license blacklist in the Social Contract.
We already have an implicit license acceptance list in @FREE.

> How about this:
> 
> "Gentoo will never depend upon a piece of software or metadata
> unless it conforms to ... or some other license that fulfills the
> [Free Software Definition](https://www.gnu.org/philosophy/free-sw.html)
> or the [Definition of Free Cultural Works](https://freedomdefined.org/)."
Approximately yes.

> This is basically how we operate in practice, assuming the default
> ACCEPT_LICENSE="@FREE" setting.
Let's codify that?
Additional text as the next sentence: 
===
This shall be specified by the @FREE license group in line with the GLEP
23 specification, as maintained by the Gentoo License team.
===

> IIUC Debian doesn't rely on FSF or OSI approval either, but they keep
> their own list of (DFSG-approved) licenses.
Yes, and DFSG does accept Artistic-1 ;-).

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation President & Treasurer
E-Mail   : robbat2@gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 1113 bytes --]

Re: [gentoo-nfp] [PATCH 0/4] Some updates to the Social Contract

[Michael Orlitzky]

I don't object to any of these changes, but can we just... unilaterally
change the terms of a contract? What if instead of updating the OSI
bit, we deleted it instead? In the interest of propriety I think this
should be a wider discussion.

> Social contract: Exceptions to the public bug policy

Security auditing bugs are hidden by default, and there are probably
other examples. Though I'd rather see them be made public than to
weasel-word this paragraph.

Re: [gentoo-nfp] [PATCH 0/4] Some updates to the Social Contract

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1668 bytes --]

>>>>> On Sat, 20 Jul 2024, Michael Orlitzky wrote:

> I don't object to any of these changes, but can we just... unilaterally
> change the terms of a contract? What if instead of updating the OSI
> bit, we deleted it instead? In the interest of propriety I think this
> should be a wider discussion.

Good point. We should certainly be careful there, and not make any
changes that would modify the intentions of the Social Contract.

Then again, the heading of the section is "Gentoo is and will remain
free software", and everything below it is an exemplification of it.
I don't think that changing "OSI-approved" to "FSF-approved" or even
"licenses fulfilling the Free Software Definition" would touch the
substance of this.

There is also "Note: We are considering extending the above clause ..."
which says that the details of the sections can be expected to change.

>> Social contract: Exceptions to the public bug policy

> Security auditing bugs are hidden by default, and there are probably
> other examples. Though I'd rather see them be made public than to
> weasel-word this paragraph.

The current wording "Exceptions may be made at the discretion of the
Trustees" was introduced in bug 536668 [1]. If I read comment #5
correctly, the idea was indeed that the Trustees would have to approve
each private bug.

That doesn't reflect how we handle things. So maybe we should revert
to a variant of the previous wording:

| Exceptions may be made for security-related information with
| the request not to publicize before a certain deadline,
| community-relations information, or at the discretion of the Council.

Ulrich

[1] https://bugs.gentoo.org/536668

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]