public inbox for gentoo-project@lists.gentoo.org
 help / color / mirror / Atom feed
From: Ulrich Mueller <ulm@gentoo.org>
To: gentoo-project@lists.gentoo.org
Subject: [gentoo-project] Re: [gentoo-dev-announce] Poll: Would you sign a Contributer License Agreement?
Date: Thu, 31 May 2018 12:23:32 +0200	[thread overview]
Message-ID: <23311.52516.719358.967392@a1i15.kph.uni-mainz.de> (raw)
In-Reply-To: <23311.52239.216285.800776@a1i15.kph.uni-mainz.de>

[-- Attachment #1: Type: text/plain, Size: 9373 bytes --]

>>>>> On Thu, 31 May 2018, Ulrich Mueller wrote:

> (hoping that he hasn't snipped too much of the context)

Presumably I have. So find Greg's two messages below, in full (which
had gentoo-project in CC).

Ulrich


>>>>> On Wed, 30 May 2018, Greg KH wrote:

> On Wed, May 30, 2018 at 04:36:09PM +0200, Ulrich Mueller wrote:
>> A while back I requested information on past copyright assignments [1].
>> Since then, we have located some 30 of the assignment forms, signed by
>> developers (most of them retired by now) in 2004.
>> 
>> Here is the second part of the exercise. The current draft of the new
>> Gentoo copyright policy [2] arranges for two procedures:
>> 
>> 1. Certifying agreement to a "Gentoo Developer's Certificate of Origin"
>> by including a "Signed-off-by" line with every commit. This would
>> be virtually identical to the procedure used for the Linux kernel,
>> and would be mandatory. A draft of the Gentoo DCO can be seen at [3].

> Please please please do not "fork" the DCO.  It was specifically
> designed so that any project can use it, as-is, with no changes needed.
> Yes, some foolish projects have gone off and rewritten it, but that was
> crazy, and they now wish they did not, as it requires corporate lawyers
> to manually have to go review the "new" document to ensure that it
> really is doing what it thinks it is doing.

> Again, please just use the DCO.  It's at it's own web site, and is good
> to be used that way:
> 	https://developercertificate.org/

> Also, note, that if you do decide to copy it, I personally am going to
> get upset as it is a blatent copyright violation.  So there is that
> issue...
> Hint doing a s/open/free/ on the original text  does not mean that you
> suddenly have created a brand new document with no requirement to abide
> by the original document's copyright.  I see you claim that it was
> published in 2005 with a CC-BY-SA-2.5 License?  Do you have any
> reference for that, I know I spent a lot of time working on this in the
> past and I do not remember that...

> Again, just use the DCO, please.

>> 2. In addition, according to the current policy draft, developers would
>> be encouraged to sign a "Gentoo Contributor License Agreement (CLA)".
>> Its current draft version is at [4]. However, this would be
>> completely voluntary and *not* be required. The exact workflow
>> hasn't been drafted yet, but PGP signing of the form would be one
>> possibility. (Also note that the form includes fields for real name
>> and postal address.)
>> 
>> The goals of the second item is to "make compliance with this policy
>> easier (fewer copyright holders to list), and allow the Foundation to
>> enforce copyrights and re-license content if appropriate" [2].
>> Apparently, we will only be able to achieve these goals if a
>> significant fraction of contributors will sign the CLA.
>> 
>> So, before I pursue more work on the CLA I would like to ask all
>> developers and contributors:
>> 
>> - Would you sign a "Gentoo Contributor License Agreement", similar to
>> the current draft in [4]?

> No, I personally will not sign any CLAs, sorry.

> Sent publically as the DCO thing should be discussed in public.

> thanks,

> greg k-h


>>>>> On Thu, 31 May 2018, Greg KH wrote:

> On Wed, May 30, 2018 at 11:44:34PM +0200, Ulrich Mueller wrote:
>> >>>>> On Wed, 30 May 2018, Greg KH wrote:
>> 
>> > Please please please do not "fork" the DCO.  It was specifically
>> > designed so that any project can use it, as-is, with no changes
>> > needed.
>> 
>> We simply cannot. We have files in the Gentoo repository that are not
>> under a free software license, and for these we need an extra clause.

> Your "extra clause" is pretty odd.  You took out the c) clause of the
> original DCO for some unknown reason as well, which is going to cause
> you big problems.

> Was this vetted by a lawyer?  Again, this is going to cause companies
> to have to spend lots of time and money to be able to get anyone to use
> this, do not change things lightly.

>> Otherwise we would have to specify in the policy that certain commits
>> are excepted from the requirement of a Signed-off-by line, and IMHO
>> that would be a much worse solution.
>> 
>> Addition of the extra clause for licenses and similar files resulted
>> from a long discussion on 2018-01-25 in the #gentoo-council channel,
>> which included three council members and a trustee.

> No license lawyers?

> Are you _sure_ you need this change?

>> > Yes, some foolish projects have gone off and rewritten it, but that
>> > was crazy, and they now wish they did not, as it requires corporate
>> > lawyers to manually have to go review the "new" document to ensure
>> > that it really is doing what it thinks it is doing.
>> 
>> > Again, please just use the DCO.  It's at it's own web site, and is
>> > good to be used that way:
>> > 	https://developercertificate.org/
>> 
>> > Also, note, that if you do decide to copy it, I personally am going
>> > to get upset as it is a blatent copyright violation.  So there is
>> > that issue...
>> 
>> How is it a copyright violation? We create a modified version of
>> a document that was released under a Creative Commons Attribution-
>> ShareAlike 2.5 License. Distribution of modified versions is allowed
>> under this license, and I believe that we include proper attribution.
>> Also section 4b of CC-BY-SA-2.5 explicitly allows distribution of a
>> modified work under CC-BY-SA-3.0.

> Fair enough, but please be sure to run the fact that you are changing
> something is obviously copyrighted by someone else with a declaration
> that it can not be changed, by relying on the wayback machine to make
> that change past a copyright lawyer.  There is a reason that the DCO is
> not under such a license anymore, as this "respin" proves it :)

>> > Again, just use the DCO, please.
>> 
>> See above, the simple reason is that we need an exception for license
>> files.
>> 
>> Then again, Linux might profit from such a clause too. See for example
>> the following commit:
>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/LICENSES/preferred/GPL-2.0?id=255247c2770ada6edace04173b35307869b47d99
>> 
>> The commit message carries two Signed-off-by lines (and a Reviewed-by
>> by yourself). But let's look what the document says about its license:
>> 
>> + Everyone is permitted to copy and distribute verbatim copies
>> + of this license document, but changing it is not allowed.
>> 
>> Clearly, this isn't an open source license, because it doesn't allow
>> modifications. So I wonder how the committer could certify agreement
>> to the DCO 1.1 there?

> Section b) should cover this nicely.  If your lawyers somehow feel it
> does not, I will be glad to consult with the LF lawyers about this and
> have them discuss the matter.

> Also note that I really doubt that the fact that you can include
> verbatim copies of a license in a repo is going to make anyone upset at
> all, unless you modify that license text.  So you might all be worried
> about nothing "real" at all here.  License files are not code, just like
> documentation is not code, and almost all open source licenses do not
> cover either of them well, if at all.

> As an armchair thought experiment of this, how would the overall license
> of a GNU project's tarball release such as bash, which is GPLv3, cover
> the license file of the GPLv3 text that is included in the tarball?
> Would the inclusion of a file in the tarball that is obviously not under
> a free software license cause that project's license to somehow not be
> "free software"?

> It's a fun rabit hole to go down, but one that I think you will have to
> do on your own :)

>> > No, I personally will not sign any CLAs, sorry.
>> 
>> This is interesting, since you had previously signed the copyright
>> assignment form to Gentoo Technologies, Inc. (To be precise, you PGP
>> signed it and sent it to recruiters@gentoo.org on 2004-03-08.)

> That was because I was forced to do so in order to become a Gentoo
> developer at the time, and my employer at the time also insisted on it,
> as they were the owners of all of the work that I did on Gentoo, not me.
> I had no say in the matter at all, just like almost all other people
> employed in the US due to the standard employment contract used.  So to
> be clear, that was not _me_ giving up any copyrights, it was my
> employer.

> My position has changed on how best to handle copyrights in the 14 years
> since then, and I currently am employed by someone who allows me to keep
> my personal copyright (while also giving them a copy) so I guess I
> should figure out how to somehow retroactively not-sign it :)

> Any hints as to how to do that?

> Anyway, my strongest suggestion as to why not to change to use your
> custom license is the fact that you will now require all Gentoo
> developers who work for companies that allow their employers to
> contribute to Gentoo, to now have to have their lawyers read over this
> new license and come to an understanding of it before those people are
> allowed to contribute.  That's a huge waste of time and money and will
> make those companies, and developers, grumpy.

> And if developers ignore the fact that they should have run this change
> by their employers, that could get them into big trouble later on.

> thanks,

> greg k-h

[-- Attachment #2: Type: application/pgp-signature, Size: 490 bytes --]

  reply	other threads:[~2018-05-31 10:23 UTC|newest]

Thread overview: 44+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-30 14:36 [gentoo-project] Poll: Would you sign a Contributer License Agreement? Ulrich Mueller
2018-05-30 17:45 ` Robin H. Johnson
2018-05-30 18:56   ` Rich Freeman
2018-05-30 22:02     ` Ulrich Mueller
2018-05-31  5:48   ` kuzetsa
2018-05-31 18:53     ` Ulrich Mueller
     [not found] ` <20180530182136.GB18004@kroah.com>
2018-05-30 21:44   ` [gentoo-project] Re: [gentoo-dev-announce] " Ulrich Mueller
2018-05-30 22:31     ` Rich Freeman
2018-05-30 22:44       ` Ulrich Mueller
     [not found]     ` <20180531070321.GC7744@kroah.com>
2018-05-31  9:34       ` Ulrich Mueller
2018-05-31 10:18       ` Ulrich Mueller
2018-05-31 10:23         ` Ulrich Mueller [this message]
2018-05-31 22:24     ` Jonas Stein
2018-05-31 22:27       ` Kristian Fiskerstrand
2018-05-31 23:52         ` Raymond Jennings
2018-06-01  1:55           ` R0b0t1
2018-06-01  2:32             ` Rich Freeman
2018-06-01 11:49               ` Ulrich Mueller
2018-06-01  1:52       ` Ulrich Mueller
2018-06-04 12:35 ` [gentoo-project] " Ulrich Mueller
2018-06-04 12:44   ` Kristian Fiskerstrand
     [not found]   ` <20180625013334.GA28404@kroah.com>
2018-06-25  6:50     ` [gentoo-project] Re: [gentoo-core] " Ulrich Mueller
2018-06-25  7:02       ` Paweł Hajdan, Jr.
     [not found]       ` <20180625070525.GA6151@kroah.com>
2018-06-25  7:54         ` Ulrich Mueller
     [not found]           ` <20180625110540.GB3058@kroah.com>
2018-06-25 14:08             ` Rich Freeman
2018-06-25 14:37             ` Ulrich Mueller
2018-06-25 14:46               ` M. J. Everitt
2018-06-25 14:56                 ` Rich Freeman
2018-06-25 15:53                   ` Denis Dupeyron
2018-06-25 16:50                     ` Rich Freeman
2018-06-25 19:02                       ` Denis Dupeyron
2018-06-25 20:13                         ` Michał Górny
2018-06-25 20:28                           ` Paweł Hajdan, Jr.
2018-06-25 20:33                           ` Denis Dupeyron
2018-06-25 20:31                     ` Alec Warner
2018-06-25 20:52                       ` Denis Dupeyron
2018-06-25 21:06                         ` Alec Warner
2018-06-25 21:06                         ` Ulrich Mueller
2018-06-25 22:10                           ` Rich Freeman
2018-06-25 23:55                     ` Andreas K. Huettel
2018-06-25 16:54                 ` Ulrich Mueller
2018-06-25 17:10                   ` M. J. Everitt
2018-06-25 17:37                     ` Rich Freeman
2018-06-09  9:02 ` [gentoo-project] " Ulrich Mueller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=23311.52516.719358.967392@a1i15.kph.uni-mainz.de \
    --to=ulm@gentoo.org \
    --cc=gentoo-project@lists.gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox