[gentoo-project] Call for agenda items - Council meeting 2018-10-14

[gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Sergei Trofimovich]

Hello all!

14 October (in 2 weeks from now)
at 19:00 UTC Council will meet again.

Please provide agenda items you would like council@ to
look at (and act) as a reply to this email.

To get the idea what usually happens at those meetings
you can have a glance at past meeting notes summary at:
    https://wiki.gentoo.org/wiki/Project:Council/Meeting_logs

Thank you!

-- 

  Sergei

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1888 bytes --]

>>>>> On Sun, 30 Sep 2018, Sergei Trofimovich wrote:

> Hello all!
> 14 October (in 2 weeks from now)
> at 19:00 UTC Council will meet again.

> Please provide agenda items you would like council@ to
> look at (and act) as a reply to this email.

The new copyright policy (GLEP 76) leaves it to projects to decide
whether they use the long form or the simplified form of the copyright
attribution. I would like to ask the council to decide that the
simplified attribution [1] shall be used for ebuilds in the Gentoo
repository.

Rationale:

- Policy of the Gentoo repository is a global issue that should be
decided by the council.

- Quoting the GLEP: "Especially for ebuild repositories, constantly
keeping track of the main copyright holder of any file would be rather
inconvenient and tedious." This is particularly true for ebuilds in the
Gentoo repository, where tracing the main contributor of all ebuilds
would be a major effort. A developer who is updating an ebuild shouldn't
have to do a copyright audit, in order to find out if the notice is
still accurate or needs to be updated. Using the simplified attribution
avoids that.

- Changing an existing copyright notice (e.g., from "Dev. E. Loper and
others" to "Gentoo Authors") could be problematic from a legal point
of view, so using the simplified form from the very beginning may be
preferable.

- Our previous policy to require "Gentoo Foundation" in the copyright
notice doesn't seem to have caused any significant problems with
contributors. So I would expect "Gentoo Authors" to work as well.
If necessary, organisations that hold copyright to parts of the tree
could be traced in an AUTHORS file. (That would resemble the scheme
used by the Chromium project [2].)

Ulrich

[1] https://www.gentoo.org/glep/glep-0076.html#simplified-attribution
[2] https://www.chromium.org/developers/contributing-code#TOC-Legal-stuff

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1975 bytes --]

On Wed, 10 Oct 2018 09:43:52 +0200 Ulrich Mueller wrote:
> >>>>> On Sun, 30 Sep 2018, Sergei Trofimovich wrote:
> 
> > Hello all!
> > 14 October (in 2 weeks from now)
> > at 19:00 UTC Council will meet again.
> 
> > Please provide agenda items you would like council@ to
> > look at (and act) as a reply to this email.
> 
> The new copyright policy (GLEP 76) leaves it to projects to decide
> whether they use the long form or the simplified form of the copyright
> attribution. I would like to ask the council to decide that the
> simplified attribution [1] shall be used for ebuilds in the Gentoo
> repository.

I'd like to voice strongly against this motion.

Rationale:

- We have out of the Gentoo repository ebuilds which may be
incorporated in the main repository and are licensed properly but
an author requires his copyright in the first line to be preserved.
GPL-2 allows us to use such ebuilds, but our past copyright policy
mandating "Gentoo Foundation" doesn't, as well as proposed motion
which mandates "Gentoo Authors" instead of the list of authors
including main author if they require so.

- GLEP 76 already did significant harm to our community by
outlawing current anonymous or pseudonymous contributions. Moreover
we have people who want to join community, but keep their identity
hidden. This is understandable, especially for security or privacy
oriented software. The harm should go no further. We have a lot of
talks how we need more developers, but what we are doing in many
steps including GLEP 76 is exactly the opposite: we are creating
additional barriers due to vague and bureaucratic reasons.

Of course if authors wants to use "Gentoo Authors" this should be
allowed, especially for automatic migration from the "Gentoo
Foundation" line. But we must preserve the right to use explicit
list of authors (including "and others" if necessary) if a
maintainer wants so.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Brian Dolbec]

[-- Attachment #1: Type: text/plain, Size: 3299 bytes --]

On Thu, 11 Oct 2018 15:31:39 +0300
Andrew Savchenko <bircoph@gentoo.org> wrote:

> On Wed, 10 Oct 2018 09:43:52 +0200 Ulrich Mueller wrote:
> > >>>>> On Sun, 30 Sep 2018, Sergei Trofimovich wrote:  
> >   
> > > Hello all!
> > > 14 October (in 2 weeks from now)
> > > at 19:00 UTC Council will meet again.  
> >   
> > > Please provide agenda items you would like council@ to
> > > look at (and act) as a reply to this email.  
> > 
> > The new copyright policy (GLEP 76) leaves it to projects to decide
> > whether they use the long form or the simplified form of the
> > copyright attribution. I would like to ask the council to decide
> > that the simplified attribution [1] shall be used for ebuilds in
> > the Gentoo repository.  
> 
> I'd like to voice strongly against this motion.
> 
> Rationale:
> 
> - We have out of the Gentoo repository ebuilds which may be
> incorporated in the main repository and are licensed properly but
> an author requires his copyright in the first line to be preserved.
> GPL-2 allows us to use such ebuilds, but our past copyright policy
> mandating "Gentoo Foundation" doesn't, as well as proposed motion
> which mandates "Gentoo Authors" instead of the list of authors
> including main author if they require so.
> 
> - GLEP 76 already did significant harm to our community by
> outlawing current anonymous or pseudonymous contributions. Moreover
> we have people who want to join community, but keep their identity
> hidden. This is understandable, especially for security or privacy
> oriented software. The harm should go no further. We have a lot of
> talks how we need more developers, but what we are doing in many
> steps including GLEP 76 is exactly the opposite: we are creating
> additional barriers due to vague and bureaucratic reasons.
> 
> Of course if authors wants to use "Gentoo Authors" this should be
> allowed, especially for automatic migration from the "Gentoo
> Foundation" line. But we must preserve the right to use explicit
> list of authors (including "and others" if necessary) if a
> maintainer wants so.
> 
> Best regards,
> Andrew Savchenko

+1

My employer sponsors a lot of Gentoo ebuild and project work.  We are
currently waiting for approval from the legal department to be able to
continue after the Glep 76 approval and subsequent enforcement.  It
very well may include a requirement to include a company copyright
notice for the work done on comapny time and equipment.

I have prepared a patch to repoman which fully implements Glep 76. [1]
It adds a COPYRIGHT_OWNER variable to make.conf which can be set.
The COPYRIGHT_OWNER is only ever ensured (possibly added) to the
existing copyright line if the --copyright option is given on the cli.
It is also used to generate a new copyright line if one did not exist.

This option should only ever be used for significant changes to an
ebuild.  I could extend it to include a --others option to append the
"and others" to the copyright.  But I don't know if that will be used
enough to justify the extra code.

This patch also makes repoman more friendly for downstream repositiries
which could set the copyright apropriately without manual editing.


[1] https://github.com/gentoo/portage/pull/376

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1897 bytes --]

>>>>> On Thu, 11 Oct 2018, Brian Dolbec wrote:

> My employer sponsors a lot of Gentoo ebuild and project work.  We are
> currently waiting for approval from the legal department to be able to
> continue after the Glep 76 approval and subsequent enforcement.  It
> very well may include a requirement to include a company copyright
> notice for the work done on comapny time and equipment.

> I have prepared a patch to repoman which fully implements Glep 76. [1]
> It adds a COPYRIGHT_OWNER variable to make.conf which can be set.
> The COPYRIGHT_OWNER is only ever ensured (possibly added) to the
> existing copyright line if the --copyright option is given on the cli.
> It is also used to generate a new copyright line if one did not exist.

As I've already commented in the pull request [1], I think this isn't
something that should be automated in a QA tool like repoman.

IMHO, repoman should accept both forms of the copyright notice, as long
as they're syntactically well-formed. Otherwise, it should leave the
copyright holder alone (with the possible exception of updating Gentoo
Foundation to Gentoo Authors).

> This option should only ever be used for significant changes to an
> ebuild.

Right, but I think there is the danger that the feature will be abused,
e.g. that people will use it also for non-copyrightable changes.

Also see my reply to bircoph's posting. The copyright notice has a
very specific purpose. It should neither be mistaken as an authors'
attribution, not should it be abused as a "scent mark".

> I could extend it to include a --others option to append the "and
> others" to the copyright. But I don't know if that will be used enough
> to justify the extra code.

> This patch also makes repoman more friendly for downstream repositiries
> which could set the copyright apropriately without manual editing.

> [1] https://github.com/gentoo/portage/pull/376

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Rich Freeman]

On Thu, Oct 11, 2018 at 1:49 PM Ulrich Mueller <ulm@gentoo.org> wrote:
>
> >>>>> On Thu, 11 Oct 2018, Brian Dolbec wrote:
>
> > My employer sponsors a lot of Gentoo ebuild and project work.  We are
> > currently waiting for approval from the legal department to be able to
> > continue after the Glep 76 approval and subsequent enforcement.  It
> > very well may include a requirement to include a company copyright
> > notice for the work done on comapny time and equipment.
>
> > I have prepared a patch to repoman which fully implements Glep 76. [1]
> > It adds a COPYRIGHT_OWNER variable to make.conf which can be set.
> > The COPYRIGHT_OWNER is only ever ensured (possibly added) to the
> > existing copyright line if the --copyright option is given on the cli.
> > It is also used to generate a new copyright line if one did not exist.
>
> As I've already commented in the pull request [1], I think this isn't
> something that should be automated in a QA tool like repoman.
>
> IMHO, repoman should accept both forms of the copyright notice, as long
> as they're syntactically well-formed. Otherwise, it should leave the
> copyright holder alone (with the possible exception of updating Gentoo
> Foundation to Gentoo Authors).
>
> > This option should only ever be used for significant changes to an
> > ebuild.
>
> Right, but I think there is the danger that the feature will be abused,
> e.g. that people will use it also for non-copyrightable changes.
>

Also, unless we want some kind of endlessly-concatenating copyright
notice, I don't think we want repoman just changing the line.

Suppose I change an existing ebuild, and for the sake of argument
let's assume that my changes are sufficient to be "copyrightable."
Existing ebuild says "Copyright Gentoo Authors" / etc.  I want it to
say "Copyright Rich Freeman and Others" / etc.  Whether adding an
extra 10% to an ebuild really warrants that change is debatable, but
let's let that slide.  Now suppose ulm comes along with similar
demands, does he just wipe out my name and substitute his own?  Or
does this turn into the BSD advertising clause where we start
accumulating names?

The GLEP has been through many iterations, but the intent was always
to avoid turning the copyright notice into some kind of authors list
because it fails pretty badly at that.  It gets unwieldy very quickly,
and if everybody wants to stamp their names all over everything
presumably they're going to cry foul if somebody else wants to stamp
their name over top.

We already ran into a bit of a PR issue when somebody overwrote the
udev authors with the Gentoo Foundation when forking eudev.  There was
no ill intent - they were just trying to comply with a policy.  But,
suppose I make a 20% change to a file - am I going to upset some
outsider whose code I borrowed by "stripping" their copyright notices.
I believe when I looked up the laws regarding this it is actually only
a crime to do so when it is used to conceal infringement, which isn't
happening if we're sticking to the FOSS license, but people get really
sensitive about these things.

The intent around being flexible with copyright notices is so that we
can do things like forking eudev, because the policy basically will
accept the previous copyright notices if they are sane.  However, the
intent isn't for people to be having wars over whether they're getting
"credit."  You already have credit in git.  Outsiders should also be
getting credit in git (you can ack them in the commit, just as the
kernel does).  And major contributors have sometimes been known to ask
the Foudation to write a note to affirm their contributions for job
applications and such.  There are better ways to give people credit
than copyright notices, which also serve a legal purpose (which is far
simpler).

So, having repoman stamp names all over things seems like a bad idea,
because we have to deal with what happens when multiple people start
stamping over each other's stuff.  If a company cares THAT much about
having their name in the notice, then will they care when their
competitor who also has the same policy stamps their name over top?
How can repoman handle that sanely short of concatenating, presumably
avoiding duplication in a text field with poor structure/etc...

-- 
Rich

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 2396 bytes --]

On Thu, Oct 11, 2018 at 8:55 AM Andrew Savchenko <bircoph@gentoo.org> wrote:

> On Wed, 10 Oct 2018 09:43:52 +0200 Ulrich Mueller wrote:
> > >>>>> On Sun, 30 Sep 2018, Sergei Trofimovich wrote:
> >
> > > Hello all!
> > > 14 October (in 2 weeks from now)
> > > at 19:00 UTC Council will meet again.
> >
> > > Please provide agenda items you would like council@ to
> > > look at (and act) as a reply to this email.
> >
> > The new copyright policy (GLEP 76) leaves it to projects to decide
> > whether they use the long form or the simplified form of the copyright
> > attribution. I would like to ask the council to decide that the
> > simplified attribution [1] shall be used for ebuilds in the Gentoo
> > repository.
>
> I'd like to voice strongly against this motion.
>
> Rationale:
>
> - We have out of the Gentoo repository ebuilds which may be
> incorporated in the main repository and are licensed properly but
> an author requires his copyright in the first line to be preserved.
> GPL-2 allows us to use such ebuilds, but our past copyright policy
> mandating "Gentoo Foundation" doesn't, as well as proposed motion
> which mandates "Gentoo Authors" instead of the list of authors
> including main author if they require so.
>
> - GLEP 76 already did significant harm to our community by
> outlawing current anonymous or pseudonymous contributions. Moreover
> we have people who want to join community, but keep their identity
> hidden. This is understandable, especially for security or privacy
> oriented software. The harm should go no further. We have a lot of
> talks how we need more developers, but what we are doing in many
> steps including GLEP 76 is exactly the opposite: we are creating
> additional barriers due to vague and bureaucratic reasons.
>
> Of course if authors wants to use "Gentoo Authors" this should be
> allowed, especially for automatic migration from the "Gentoo
> Foundation" line. But we must preserve the right to use explicit
> list of authors (including "and others" if necessary) if a
> maintainer wants so.
>

My reading of ulm's proposal is that it is allowed.

Ebuilds "shall" use the simple attribution, not that they "must" use it.

To me that implies the simple attribution should be the default, but the
complex attribution is acceptable in the ::gentoo repo.
Maybe I'm misunderstanding the proposal?

-A



> Best regards,
> Andrew Savchenko
>

[-- Attachment #2: Type: text/html, Size: 3194 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 415 bytes --]

>>>>> On Thu, 11 Oct 2018, Alec Warner wrote:

> My reading of ulm's proposal is that it is allowed.

> Ebuilds "shall" use the simple attribution, not that they "must" use it.

> To me that implies the simple attribution should be the default, but the
> complex attribution is acceptable in the ::gentoo repo.

> Maybe I'm misunderstanding the proposal?

No, you've understood it exactly how it was meant.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 713 bytes --]

On Thu, 11 Oct 2018 19:35:13 +0200 Ulrich Mueller wrote:
> >>>>> On Thu, 11 Oct 2018, Alec Warner wrote:
> 
> > My reading of ulm's proposal is that it is allowed.
> 
> > Ebuilds "shall" use the simple attribution, not that they "must" use it.
> 
> > To me that implies the simple attribution should be the default, but the
> > complex attribution is acceptable in the ::gentoo repo.
> 
> > Maybe I'm misunderstanding the proposal?
> 
> No, you've understood it exactly how it was meant.

Then please write this explicitly in the proposed change. Right now
it is only "shall" vs "must" difference which may confuse people
and create misunderstanding in future.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 932 bytes --]

On Thu, Oct 11, 2018 at 5:24 PM Andrew Savchenko <bircoph@gentoo.org> wrote:

> On Thu, 11 Oct 2018 19:35:13 +0200 Ulrich Mueller wrote:
> > >>>>> On Thu, 11 Oct 2018, Alec Warner wrote:
> >
> > > My reading of ulm's proposal is that it is allowed.
> >
> > > Ebuilds "shall" use the simple attribution, not that they "must" use
> it.
> >
> > > To me that implies the simple attribution should be the default, but
> the
> > > complex attribution is acceptable in the ::gentoo repo.
> >
> > > Maybe I'm misunderstanding the proposal?
> >
> > No, you've understood it exactly how it was meant.
>
> Then please write this explicitly in the proposed change. Right now
> it is only "shall" vs "must" difference which may confuse people
> and create misunderstanding in future.
>

If we update the wording, are you happy with the proposal now that we have
a shared understanding of its intent?

-A


>
> Best regards,
> Andrew Savchenko
>

[-- Attachment #2: Type: text/html, Size: 1540 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1188 bytes --]

On Thu, 11 Oct 2018 20:09:39 -0400 Alec Warner wrote:
> On Thu, Oct 11, 2018 at 5:24 PM Andrew Savchenko <bircoph@gentoo.org> wrote:
> 
> > On Thu, 11 Oct 2018 19:35:13 +0200 Ulrich Mueller wrote:
> > > >>>>> On Thu, 11 Oct 2018, Alec Warner wrote:
> > >
> > > > My reading of ulm's proposal is that it is allowed.
> > >
> > > > Ebuilds "shall" use the simple attribution, not that they "must" use
> > it.
> > >
> > > > To me that implies the simple attribution should be the default, but
> > the
> > > > complex attribution is acceptable in the ::gentoo repo.
> > >
> > > > Maybe I'm misunderstanding the proposal?
> > >
> > > No, you've understood it exactly how it was meant.
> >
> > Then please write this explicitly in the proposed change. Right now
> > it is only "shall" vs "must" difference which may confuse people
> > and create misunderstanding in future.
> >
> 
> If we update the wording, are you happy with the proposal now that we have
> a shared understanding of its intent?

Yes, I'll be happy as long as alternate form (explicit authors list
with optional "and others") will be allowed with clear wording.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Sarah White]

On 10/11/2018 08:24 PM, Andrew Savchenko wrote:
> On Thu, 11 Oct 2018 20:09:39 -0400 Alec Warner wrote:
>> On Thu, Oct 11, 2018 at 5:24 PM Andrew Savchenko <bircoph@gentoo.org> wrote:
>>
>>> On Thu, 11 Oct 2018 19:35:13 +0200 Ulrich Mueller wrote:
>>>>>>>>> On Thu, 11 Oct 2018, Alec Warner wrote:
>>>>
>>>>> My reading of ulm's proposal is that it is allowed.
>>>>
>>>>> Ebuilds "shall" use the simple attribution, not that they "must" use
>>> it.
>>>>
>>>>> To me that implies the simple attribution should be the default, but
>>> the
>>>>> complex attribution is acceptable in the ::gentoo repo.
>>>>
>>>>> Maybe I'm misunderstanding the proposal?
>>>>
>>>> No, you've understood it exactly how it was meant.
>>>
>>> Then please write this explicitly in the proposed change. Right now
>>> it is only "shall" vs "must" difference which may confuse people
>>> and create misunderstanding in future.
>>>
>>
>> If we update the wording, are you happy with the proposal now that we have
>> a shared understanding of its intent?
> 
> Yes, I'll be happy as long as alternate form (explicit authors list
> with optional "and others") will be allowed with clear wording.
> 
> Best regards,
> Andrew Savchenko
> 

That's a good clarification on the meaning, but the
simplified attribution itself is still kinda vague.

(for reasons which I struggled to summarize clearly)

(sorry about that)

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 439 bytes --]

>>>>> On Thu, 11 Oct 2018, Andrew Savchenko wrote:

> Then please write this explicitly in the proposed change. Right now
> it is only "shall" vs "must" difference which may confuse people
> and create misunderstanding in future.

To say it with very simple words (and borrowing a phrase from the
old Ebuild HOWTO): There can be ebuilds in the Gentoo repository that
don't use the simplified attribution, but *your* ebuild should.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 896 bytes --]

On Fri, Oct 12, 2018 at 08:05:20AM +0200, Ulrich Mueller wrote:
> >>>>> On Thu, 11 Oct 2018, Andrew Savchenko wrote:
> 
> > Then please write this explicitly in the proposed change. Right now
> > it is only "shall" vs "must" difference which may confuse people
> > and create misunderstanding in future.
> 
> To say it with very simple words (and borrowing a phrase from the
> old Ebuild HOWTO): There can be ebuilds in the Gentoo repository that
> don't use the simplified attribution, but *your* ebuild should.

Ulrich,

sorry if I'm repeating a question about this that was already asked, but
I'm confused about something.

Under this proposal, are copyright notices allowed that do not mention
Gentoo Authors at all?

I work for the same Company as dol-sen, and we may need to put the
company's copyright on any new ebuilds we write on work time.

Thanks,

William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 888 bytes --]

>>>>> On Fri, 12 Oct 2018, William Hubbs wrote:

> On Fri, Oct 12, 2018 at 08:05:20AM +0200, Ulrich Mueller wrote:
>> To say it with very simple words (and borrowing a phrase from the
>> old Ebuild HOWTO): There can be ebuilds in the Gentoo repository that
>> don't use the simplified attribution, but *your* ebuild should.

> Under this proposal, are copyright notices allowed that do not mention
> Gentoo Authors at all?

They are, if the ebuild is an original work that is written from
scratch. "Gentoo Authors" would be strongly preferred, though.

> I work for the same Company as dol-sen, and we may need to put the
> company's copyright on any new ebuilds we write on work time.

That would require us to constantly keep track if the entity listed in
the notice is still the main copyright holder, and I cannot predict how
much burden this would be for future maintenance.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Rich Freeman]

On Fri, Oct 12, 2018 at 1:27 PM Ulrich Mueller <ulm@gentoo.org> wrote:
>
> That would require us to constantly keep track if the entity listed in
> the notice is still the main copyright holder, and I cannot predict how
> much burden this would be for future maintenance.
>

Note that the intent here (for my part) was not to strictly monitor
this.  If somebody points out "hey, you have the wrong name here" then
it can be fixed like any other bug.  There really are no negative
legal consequences that I'm aware of if you don't have the largest
single copyright holder listed.

As far as I can tell the Linux kernel makes no effort at all to
maintain their copyright notices.  If a file says "Copyright 1982 IBM"
and the entire file gets rewritten 14 times so not even a single word
of the original remains, chances are it says "Copyright 2018 IBM."  I
imagine nobody cares enough to try to stay on top of this, because not
listing your name in no way waives any of your rights to the file.

-- 
Rich

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[desultory]

On 10/11/18 13:35, Ulrich Mueller wrote:
>>>>>> On Thu, 11 Oct 2018, Alec Warner wrote:
> 
>> My reading of ulm's proposal is that it is allowed.
> 
>> Ebuilds "shall" use the simple attribution, not that they "must" use it.
> 
>> To me that implies the simple attribution should be the default, but the
>> complex attribution is acceptable in the ::gentoo repo.
> 
>> Maybe I'm misunderstanding the proposal?
> 
> No, you've understood it exactly how it was meant.
> 
Especially given the audience, "should" would convey that intent more
clearly than "shall". [1]

> Ulrich
> 

[1] https://www.ietf.org/rfc/rfc2119.txt

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1039 bytes --]

>>>>> On Sat, 13 Oct 2018, desultory  wrote:
> On 10/11/18 13:35, Ulrich Mueller wrote:
>>>>>>> On Thu, 11 Oct 2018, Alec Warner wrote:

>>> My reading of ulm's proposal is that it is allowed.

>>> Ebuilds "shall" use the simple attribution, not that they "must" use it.

>>> To me that implies the simple attribution should be the default, but the
>>> complex attribution is acceptable in the ::gentoo repo.

>>> Maybe I'm misunderstanding the proposal?

>> No, you've understood it exactly how it was meant.

> Especially given the audience, "should" would convey that intent more
> clearly than "shall". [1]

> [1] https://www.ietf.org/rfc/rfc2119.txt

| 3. SHOULD   This word, or the adjective "RECOMMENDED", mean that there
|    may exist valid reasons in particular circumstances to ignore a
|    particular item, but the full implications must be understood and
|    carefully weighed before choosing a different course.

LGTM, especially the part that the implications must be carefully
weighed before ignoring the policy.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Mart Raudsepp]

[-- Attachment #1: Type: text/plain, Size: 1666 bytes --]

Ühel kenal päeval, L, 13.10.2018 kell 11:15, kirjutas Ulrich Mueller:
> > > > > > On Sat, 13 Oct 2018, desultory  wrote:
> > 
> > On 10/11/18 13:35, Ulrich Mueller wrote:
> > > > > > > > On Thu, 11 Oct 2018, Alec Warner wrote:
> > > > My reading of ulm's proposal is that it is allowed.
> > > > Ebuilds "shall" use the simple attribution, not that they
> > > > "must" use it.
> > > > To me that implies the simple attribution should be the
> > > > default, but the
> > > > complex attribution is acceptable in the ::gentoo repo.
> > > > Maybe I'm misunderstanding the proposal?
> > > No, you've understood it exactly how it was meant.
> > Especially given the audience, "should" would convey that intent
> > more
> > clearly than "shall". [1]
> > [1] https://www.ietf.org/rfc/rfc2119.txt
> > 3. SHOULD   This word, or the adjective "RECOMMENDED", mean that
> > there
> >    may exist valid reasons in particular circumstances to ignore a
> >    particular item, but the full implications must be understood
> > and
> >    carefully weighed before choosing a different course.
> 
> LGTM, especially the part that the implications must be carefully
> weighed before ignoring the policy.

If this is something to vote on in the meeting, lets have something we
can actually vote on before the meeting, please.
Can you come up with a wording of all this then that we can confidently
vote on, worded suitable for such, with the intentions clear in regards
to MUST/SHALL/SHOULD/MAY and whatnot? Maybe without referencing an
outside RFC to define what English words mean (or worse - using its
definitions without referencing it).


Mart

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1024 bytes --]

>>>>> On Sun, 14 Oct 2018, Mart Raudsepp wrote:

> If this is something to vote on in the meeting, lets have something we
> can actually vote on before the meeting, please.
> Can you come up with a wording of all this then that we can confidently
> vote on, worded suitable for such, with the intentions clear in regards
> to MUST/SHALL/SHOULD/MAY and whatnot? Maybe without referencing an
> outside RFC to define what English words mean (or worse - using its
> definitions without referencing it).

How about this motion:

The simplified form of the copyright attribution according to
GLEP 76 [1], i.e., "Copyright YEARS Gentoo Authors", should be used
for ebuilds and profile files in the Gentoo repository.

Exceptionally, files carrying the long form of the copyright attribution
("Copyright YEARS MAIN-CONTRIBUTOR [OTHER-CONTRIBUTOR]... [and others]")
can also be accepted, if there are valid reasons why the simplified
attribution cannot be used.

[1] https://www.gentoo.org/glep/glep-0076.html#simplified-attribution

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1268 bytes --]

On Sun, Oct 14, 2018 at 05:53:03PM +0200, Ulrich Mueller wrote:
> >>>>> On Sun, 14 Oct 2018, Mart Raudsepp wrote:
> 
> > If this is something to vote on in the meeting, lets have something we
> > can actually vote on before the meeting, please.
> > Can you come up with a wording of all this then that we can confidently
> > vote on, worded suitable for such, with the intentions clear in regards
> > to MUST/SHALL/SHOULD/MAY and whatnot? Maybe without referencing an
> > outside RFC to define what English words mean (or worse - using its
> > definitions without referencing it).
> 
> How about this motion:
> 
> The simplified form of the copyright attribution according to
> GLEP 76 [1], i.e., "Copyright YEARS Gentoo Authors", should be used
> for ebuilds and profile files in the Gentoo repository.

s/should be used/is preferred, but not required/

> Exceptionally, files carrying the long form of the copyright attribution
> ("Copyright YEARS MAIN-CONTRIBUTOR [OTHER-CONTRIBUTOR]... [and others]")
> can also be accepted, if there are valid reasons why the simplified
> attribution cannot be used.
 
 Remove this entire paragraph.

As rich0 said, there is no legal reason to mandate anything about the
copyright header.

William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1043 bytes --]

>>>>> On Sun, 14 Oct 2018, William Hubbs wrote:

> On Sun, Oct 14, 2018 at 05:53:03PM +0200, Ulrich Mueller wrote:
>> The simplified form of the copyright attribution according to
>> GLEP 76 [1], i.e., "Copyright YEARS Gentoo Authors", should be used
>> for ebuilds and profile files in the Gentoo repository.

> s/should be used/is preferred, but not required/

No, that won't catch the intention at all.

>> Exceptionally, files carrying the long form of the copyright attribution
>> ("Copyright YEARS MAIN-CONTRIBUTOR [OTHER-CONTRIBUTOR]... [and others]")
>> can also be accepted, if there are valid reasons why the simplified
>> attribution cannot be used.
 
> Remove this entire paragraph.

> As rich0 said, there is no legal reason to mandate anything about the
> copyright header.

This also implies that there is no legal reason to put anything else
than "Gentoo Authors" there. Very good.

Really, the proposed policy isn't motivated by any legal reasons, but
entirely by practical considerations.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 3186 bytes --]

>>>>> On Thu, 11 Oct 2018, Andrew Savchenko wrote:

> On Wed, 10 Oct 2018 09:43:52 +0200 Ulrich Mueller wrote:
>> The new copyright policy (GLEP 76) leaves it to projects to decide
>> whether they use the long form or the simplified form of the copyright
>> attribution. I would like to ask the council to decide that the
>> simplified attribution [1] shall be used for ebuilds in the Gentoo
>> repository.

> I'd like to voice strongly against this motion.

> Rationale:

> - We have out of the Gentoo repository ebuilds which may be
> incorporated in the main repository and are licensed properly but
> an author requires his copyright in the first line to be preserved.

The author's copyright will be preserved, regardless if he is listed in
a copyright line or not. It would even be preserved if there wasn't any
copyright notice at all.

The sole purpose of having a copyright notice is to protect us against
an "innocent infringement" defense under U.S. law. It really doesn't
matter much who is listed there (so we can list "Gentoo Authors" which
isn't even a legal entity), as long as we have a notice at all.

> GPL-2 allows us to use such ebuilds, but our past copyright policy
> mandating "Gentoo Foundation" doesn't, as well as proposed motion
> which mandates "Gentoo Authors" instead of the list of authors
> including main author if they require so.

It is virtually impossible to account for all authors of an ebuild,
and listing "Gentoo Authors" is only done because of practical
considerations (as I had outlined in the rationale). Also, please don't
confuse the copyright notice with an attribution of authorship.
The latter is achieved by the Git (or another VCS) commit information.
Again, this is already outlined in GLEP 76: "Projects using this scheme
[namely, 'Gentoo Authors'] must track authorship in a VCS".

> - GLEP 76 already did significant harm to our community by
> outlawing current anonymous or pseudonymous contributions. Moreover
> we have people who want to join community, but keep their identity
> hidden. This is understandable, especially for security or privacy
> oriented software. The harm should go no further. We have a lot of
> talks how we need more developers, but what we are doing in many
> steps including GLEP 76 is exactly the opposite: we are creating
> additional barriers due to vague and bureaucratic reasons.

How is that relevant for the proposal at hand?

> Of course if authors wants to use "Gentoo Authors" this should be
> allowed, especially for automatic migration from the "Gentoo
> Foundation" line. But we must preserve the right to use explicit
> list of authors (including "and others" if necessary) if a
> maintainer wants so.

Exactly. The aim of the "simplified attribution" policy is to simplify
modification of ebuilds, because contributors (whether Gentoo developers
or users) shouldn't have to think about the copyright line.

The purpose of the proposal explicitly is *not* to stop anybody from
adding an ebuild with a preexisting copyright notice. However, we should
make it clear that we strongly prefer the simplified form for ebuilds in
the Gentoo repository, entirely for practical reasons.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 4631 bytes --]

On Thu, 11 Oct 2018 19:29:57 +0200 Ulrich Mueller wrote:
> >>>>> On Thu, 11 Oct 2018, Andrew Savchenko wrote:
> 
> > On Wed, 10 Oct 2018 09:43:52 +0200 Ulrich Mueller wrote:
> >> The new copyright policy (GLEP 76) leaves it to projects to decide
> >> whether they use the long form or the simplified form of the copyright
> >> attribution. I would like to ask the council to decide that the
> >> simplified attribution [1] shall be used for ebuilds in the Gentoo
> >> repository.
> 
> > I'd like to voice strongly against this motion.
> 
> > Rationale:
> 
> > - We have out of the Gentoo repository ebuilds which may be
> > incorporated in the main repository and are licensed properly but
> > an author requires his copyright in the first line to be preserved.
> 
> The author's copyright will be preserved, regardless if he is listed in
> a copyright line or not. It would even be preserved if there wasn't any
> copyright notice at all.

Okay, I'll rephrase more precise: author has
"Copyright years John Doe"
as the first line and demands this to be preserved.

I had cases like this years ago (e.g. I was unable to use ebuilds
from an overlay in the main tree because the author refused the
first line to be changed to "Gentoo Foundation"). And this problem
is present now with other people.

> The sole purpose of having a copyright notice is to protect us against
> an "innocent infringement" defense under U.S. law. It really doesn't
> matter much who is listed there (so we can list "Gentoo Authors" which
> isn't even a legal entity), as long as we have a notice at all.

It does matter, at least in some other countries (non-US). Anyway I
doubt that even in US committer has right to change copyright
notice without author's approval.

> > GPL-2 allows us to use such ebuilds, but our past copyright policy
> > mandating "Gentoo Foundation" doesn't, as well as proposed motion
> > which mandates "Gentoo Authors" instead of the list of authors
> > including main author if they require so.
> 
> It is virtually impossible to account for all authors of an ebuild,

Why? We have git log. And we have "and others" clause to account
for trivial changes, e.g. if person making some mass-package
trivial change, this may go to "and others".

> and listing "Gentoo Authors" is only done because of practical
> considerations (as I had outlined in the rationale). Also, please don't
> confuse the copyright notice with an attribution of authorship.
> The latter is achieved by the Git (or another VCS) commit information.
> Again, this is already outlined in GLEP 76: "Projects using this scheme
> [namely, 'Gentoo Authors'] must track authorship in a VCS".

You are correct, but this doesn't give the right for commiter to
remove explicit "Copyright years John Doe" line. If you are
confident it does, please cite an appropriate law.

> > - GLEP 76 already did significant harm to our community by
> > outlawing current anonymous or pseudonymous contributions. Moreover
> > we have people who want to join community, but keep their identity
> > hidden. This is understandable, especially for security or privacy
> > oriented software. The harm should go no further. We have a lot of
> > talks how we need more developers, but what we are doing in many
> > steps including GLEP 76 is exactly the opposite: we are creating
> > additional barriers due to vague and bureaucratic reasons.
> 
> How is that relevant for the proposal at hand?

Because situation is bad now and the motion makes it even worse.

> > Of course if authors wants to use "Gentoo Authors" this should be
> > allowed, especially for automatic migration from the "Gentoo
> > Foundation" line. But we must preserve the right to use explicit
> > list of authors (including "and others" if necessary) if a
> > maintainer wants so.
> 
> Exactly. The aim of the "simplified attribution" policy is to simplify
> modification of ebuilds, because contributors (whether Gentoo developers
> or users) shouldn't have to think about the copyright line.
> 
> The purpose of the proposal explicitly is *not* to stop anybody from
> adding an ebuild with a preexisting copyright notice. However, we should
> make it clear that we strongly prefer the simplified form for ebuilds in
> the Gentoo repository, entirely for practical reasons.

The way I read it it moves back to the old "Gentoo Foundation"
policy with "Gentoo Foundation" replaced by "Gentoo Authors", which
will not allow to commit ebuilds without "Gentoo Authors" in the
first line.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Rich Freeman]

On Thu, Oct 11, 2018 at 5:09 PM Andrew Savchenko <bircoph@gentoo.org> wrote:
>
> It does matter, at least in some other countries (non-US). Anyway I
> doubt that even in US committer has right to change copyright
> notice without author's approval.
>

I actually couldn't find any law that explicitly forbids swapping
names in a copyright notice in the US.  It is illegal if you do it to
conceal copyright infringement, but if you have a license to modify
the work and redistribute it, and you respect all the licenses/etc,
then I think the previous author would be hard-pressed to collect
damages simply for changing a copyright notice in the source code.

They might very well be ticked off about it and create a bunch of bad
press of course.  They certainly could sue you anyway, and since there
isn't any case law I'm aware of I'm not certain how it would turn out.
Evidently we live in a world where APIs can be copyrighted, so
anything is possible.

My thinking with the policy was to allow us to preserve these kinds of
notices to avoid the issue, but the intent wasn't to keep grafting
names onto them.

As far as I can tell the Linux source code doesn't have any kind of
consistent copyright notice use - it seems like whoever first
contributes any random file picks whatever notice they want and it
tends to not get touched after that.

IMO copyright notices are somewhat overrated.  I always viewed our
copyrights as being more defensive in nature, though we certainly
could pursue violators.  As such, the notice doesn't really get you a
whole lot.

-- 
Rich

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Sarah White]

[-- Attachment #1.1: Type: text/plain, Size: 8052 bytes --]

On 10/11/2018 05:28 PM, Rich Freeman wrote:
> On Thu, Oct 11, 2018 at 5:09 PM Andrew Savchenko <bircoph@gentoo.org> wrote:
>>
>> It does matter, at least in some other countries (non-US). Anyway I
>> doubt that even in US committer has right to change copyright
>> notice without author's approval.
>>
> 
> I actually couldn't find any law that explicitly forbids swapping
> names in a copyright notice in the US.  It is illegal if you do it to
> conceal copyright infringement, but if you have a license to modify
> the work and redistribute it, and you respect all the licenses/etc,

[...]

> 
> My thinking with the policy was to allow us to preserve these kinds of
> notices to avoid the issue, but the intent wasn't to keep grafting
> names onto them.
> 
> As far as I can tell the Linux source code doesn't have any kind of
> consistent copyright notice use - it seems like whoever first
> contributes any random file picks whatever notice they want and it
> tends to not get touched after that.

[...]

>> It is virtually impossible to account for all authors of an ebuild,

> Why? We have git log. And we have "and others" clause to
> account > for trivial changes, e.g. if person making some
> mass-package trivial change, this may go to "and others".

--- end quotes ---

assuming "commit authors are copyright holders" shouldn't be
trusted blindly (the git log doesn't "solve everything")

~ moving on:

There are valid ways to track copyrightable changes over the
course of many years. I see no reason why a sensible format
can't be adopted and used, rather than debating "what about"
situations and other hypothetical issues to justify...

"Simplified Attribution" - I've not seen case law on this.

Does this mean "gentoo authors" will appear in court when
there's infringement? This is not a rhetorical question.

---

Using linux kernel as an example, MuQSS scheduler:

{tree:4.18-ck} /linux/kernel/sched/MuQSS.c

// SPDX-License-Identifier: GPL-2.0
/*
 *  kernel/sched/MuQSS.c, was kernel/sched.c
 *
 *  Kernel scheduler and related syscalls
 *
 *  Copyright (C) 1991-2002  Linus Torvalds
 *
 *  1996-12-23  Modified by Dave Grothe to fix bugs in semaphores and
 *		make semaphores SMP safe
 *  1998-11-19	Implemented schedule_timeout() and related stuff
 *		by Andrea Arcangeli
 *  2002-01-04	New ultra-scalable O(1) scheduler by Ingo Molnar:
 *		hybrid priority-list and round-robin design with
 *		an array-switch method of distributing timeslices
 *		and per-CPU runqueues.  Cleanups and useful suggestions
 *		by Davide Libenzi, preemptible kernel bits by Robert Love.
 *  2003-09-03	Interactivity tuning by Con Kolivas.
 *  2004-04-02	Scheduler domains code by Nick Piggin
 *  2007-04-15  Work begun on replacing all interactivity tuning with a
 *              fair scheduling design by Con Kolivas.
 *  2007-05-05  Load balancing (smp-nice) and other improvements
 *              by Peter Williams
 *  2007-05-06  Interactivity improvements to CFS by Mike Galbraith
 *  2007-07-01  Group scheduling enhancements by Srivatsa Vaddagiri
 *  2007-11-29  RT balancing improvements by Steven Rostedt, Gregory
Haskins,
 *              Thomas Gleixner, Mike Kravetz
 *  2009-08-13	Brainfuck deadline scheduling policy by Con Kolivas deletes
 *              a whole lot of those previous things.
 *  2016-10-01  Multiple Queue Skiplist Scheduler scalable evolution of BFS
 * 		scheduler by Con Kolivas.
 */

This is a very useful notice, because if someone has a snapshot
tarball, or other non-git copy of particular source files, the
lack of a proper notice is a legal problem (see below)

This has been mentioned - it's technically true
(to some extent, at least in most jurisdictions)

["copyright notices are not required for
a copyright holder to have a copyright"]

- This ignores the purpose: copyright notices are to make
sure when someone gets "free code", they don't assume it's
free for any/all purposes with zero restrictions:

the infringer could say the copyright status (copyleft
uses copyright law for enforcement) wasn't apparent due
to the lack of a clearly formatted copyright notice...

... so something generic like "gentoo authors" can be
difficult to enforce - I've not seen case law on this.

---

I believe licensing is the reason for GCO, not copyright
attribution. Language about committer, acked or signed-off,
and copyright holder VS licenses and GCO, all within the
same GLEP (#76) adds a lot of confusion because copyright
is barely mentioned, and not in a clearly defined way.

Copyright should be treated as a separate issue from GCO.

---

US law was mentioned. Source code copyrights are under:

17 USC § 401 - Notice of copyright: Visually perceptible copies

...

["the name of the owner of copyright in the work, or an
abbreviation by which the name can be recognized, or a
generally known alternative designation of the owner"]

...

["If a notice of copyright in the form and position
specified by this section appears on the published copy
or copies to which a defendant in a copyright infringement
suit had access, then no weight shall be given to such a
defendant’s interposition of a defense based on innocent
infringement in mitigation of actual or statutory damages,
except as provided in the last sentence of section 504(c)(2)."]

^ This is important. More non-rhetorical questions:

Do "gentoo authors" file a lawsuit when there's infringement?

How does jurisdiction work when the only thing which can
be known for certain is: "someone claimed the commit they
wrote was FOSS/Libre & they signed-off with a GCO line"

Does this mean GCO sign-off lines obligate the contributors
to respond whenever FOSS/Libre legal issues come up?

---

Most, if not all SPDX-style headers (which lists the specific
names of specific copyright holders) are in a format which
resembles what US copyrights law needs. it's wrong to claim:

["a generally known alternative designation of the owner"]

... is <legal name> generally know as: "gentoo authors" ?

(<legal name> is more likely to have a unique trade name,
and the uniqueness of it is what makes it legal. stripping
valid copyright notices and putting in something vague in
its place - that idea needs a proper legal review)

If there was a FLA policy in place, and gentoo formally held
itself out to protect (as a fiduciary) any FOSS/Libre interests
of the contributors; gentoo needs to hold the copyright, and
more importantly: invest in policy and planning to legally
protect FOSS/Libre interests when any infringement occurs.

the protection should be proper: a real entity. changing
the language from foundation to authors and treating it
like it's still a copyright assignment is pointless
unless the simplified attribution still assigns the
copyright to the gentoo foundation hold copyright.

~ this is unclear ~

If the gentoo foundation IS NOT the copyright holder...

the generic (simplified) attribution as: "gentoo authors"

["...in the form and position specified by this section"]

^ 17 USC § 401 generally expects a real entity (which can
be a natural person or legal entity / organization) to
hold copyright.

["the name of the owner of copyright in the work, or an
abbreviation by which the name can be recognized, or a
generally known alternative designation of the owner"]

~ "gentoo authors" (contributors) deserve peace of mind.

---

TL;DR

GLEP 76 shouldn't try to be an umbrella for multiple things.

~ as bircoph said: ["... creating additional barriers due to
vague and bureaucratic reasons."] - (it's a great quote)

---

{ apology for mixing / summarizing multiple quotes, I tried
my best, but inline replies are too confusing to proofread,
especially when multiple authors are being quoted. this is
actually my 10th draft I've been working on this for hours,
and it's still pretty rough. I tried. }


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Rich Freeman]

On Thu, Oct 11, 2018 at 9:25 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>
> assuming "commit authors are copyright holders" shouldn't be
> trusted blindly (the git log doesn't "solve everything")
>

Sure, but neither can any other conceivable log, and anything that
could be put in such a log could also be put in a commit annotation,
which IMO will track it a heck of a lot better than a random text
file.

>
> Does this mean "gentoo authors" will appear in court when
> there's infringement? This is not a rhetorical question.
>

Simply being named in a copyright notice creates no particular
obligation to appear in a court.

If there is some kind of copyright lawsuit, then presumably those most
associated with the code in question could be called as witnesses,
assuming whoever is doing the suing can be bothered to track them
down.

Ultimately though if Gentoo gets sued by somebody, the burden of proof
is actually on them to prove that THEY owned the copyright.  Gentoo's
burden would probably be to show that reasonable care was exercised
over accepting code, and that infractions were dealt with in a
reasonable manner when brought to our attention.

Really though, that is about the best we can do anyway.  If we want to
suppose that somebody can make us do more than what is "reasonable"
then we might as well give up on FOSS.

>
> This is a very useful notice, because if someone has a snapshot
> tarball, or other non-git copy of particular source files, the
> lack of a proper notice is a legal problem (see below)

Just stick it in git.  If somebody wants to know the history, they can
look it up in git.  If somebody wants to go redistributing snippets of
the file, then complying with the law is their problem, not ours.

>
> - This ignores the purpose: copyright notices are to make
> sure when someone gets "free code", they don't assume it's
> free for any/all purposes with zero restrictions:
>

Our notices already make this clear, regardless of whose name is listed.

> the infringer could say the copyright status (copyleft
> uses copyright law for enforcement) wasn't apparent due
> to the lack of a clearly formatted copyright notice...

The required format of a copyright noticed under US law is explictly stated:

(b)Form of Notice.—If a notice appears on the copies, it shall consist
of the following three elements:
(1)the symbol © (the letter C in a circle), or the word “Copyright”,
or the abbreviation “Copr.”; and
(2)the year of first publication of the work; in the case of
compilations, or derivative works incorporating previously published
material, the year date of first publication of the compilation or
derivative work is sufficient. The year date may be omitted where a
pictorial, graphic, or sculptural work, with accompanying text matter,
if any, is reproduced in or on greeting cards, postcards, stationery,
jewelry, dolls, toys, or any useful articles; and
(3)the name of the owner of copyright in the work, or an abbreviation
by which the name can be recognized, or a generally known alternative
designation of the owner.

> ... so something generic like "gentoo authors" can be
> difficult to enforce - I've not seen case law on this.

Our copyright would be completely enforceable even if we had no notice at all.

However, if Gentoo sued somebody for infringement, then the defendant
could attempt to claim that the infringement was innocent (ie they did
not know the work was copyrighted).  IMO that would be an uphill
battle.  If the court decides our notice complies, then they are
required by law to not give any credence to such an argument.  If they
decide that it doesn't completely comply, then they would still weigh
the argument, and how plausible is it that a court will buy that you
didn't know it was copyrighted when Copyright 2018 Gentoo Authors is
on the first line of the file?

And none of this will ever matter at all unless Gentoo files a
lawsuit.  Right now we can't seem to file our taxes.  How likely do we
think it is that Gentoo will be filing a lawsuit as the plaintiff?
The notice doesn't matter at all if somebody sues us.

>
> I believe licensing is the reason for GCO, not copyright
> attribution. Language about committer, acked or signed-off,
> and copyright holder VS licenses and GCO, all within the
> same

Sure, that is completely true. The GCO/DCO/etc has nothing to do with
attribution.

> GLEP (#76) adds a lot of confusion because copyright
> is barely mentioned, and not in a clearly defined way.

What is unclear about it?

It used to be much more prescriptive.  However, that was considered to
be too inflexible, and other prominent projects (like Linux) don't
seem to require this.  The importance of a very specific notice also
did not really seem to be sufficient to create controversies when
contributors felt they could not comply with a very specific
requirement.

> Copyright should be treated as a separate issue from GCO.

Well, both deal with copyright, but I agree that the notice is
separate from the GCO, and they are in fact mentioned separately.

>
> Do "gentoo authors" file a lawsuit when there's infringement?

You do not need to be listed in a copyright notice to file a lawsuit.
You merely need to have authorship.

> How does jurisdiction work when the only thing which can
> be known for certain is: "someone claimed the commit they
> wrote was FOSS/Libre & they signed-off with a GCO line"

Ultimately anybody wanting to file a lawsuit has to prove the
underlying facts.  If you want to sue somebody for copyright
infringement you have to demonstrate to the court that you wrote
whatever you're suing over.

If we were in the business of selling software and were more likely to
be suing people regularly, then I'd certainly agree that a lot more
rigor could be used to capture proof of ownership.  This would
presumably pay for itself as a cost of doing business.  However, that
isn't the kind of organization we are in.  Mostly we just want to show
reasonable care, and to be responsible in general.  That helps keep us
from getting sued.  I'm skeptical that Gentoo would ever sue anybody.

> Does this mean GCO sign-off lines obligate the contributors
> to respond whenever FOSS/Libre legal issues come up?

No.  Your obligation to respond to a court is established in your
local laws.  In many places you can be called as a witness against
your will if you have knowledge of a case, whether you sign anything
or not.  I don't think that is particularly likely to happen here, and
it is especially unlikely outside of your local jurisdiction, and most
courts do have rules to avoid placing unreasonable burdens on
witnesses.

IMO signing the DCO/GCO/etc probably reduces the likelihood of being
called to testify simply because your testimony is already a matter of
public record (well, maybe aside form some notarized statement
affirming that you signed it).

> If there was a FLA policy in place, and gentoo formally held
> itself out to protect (as a fiduciary) any FOSS/Libre interests
> of the contributors; gentoo needs to hold the copyright, and
> more importantly: invest in policy and planning to legally
> protect FOSS/Libre interests when any infringement occurs.

Actually, the FLA as written by the FSFe explicitly does NOT assign copyright.

> the protection should be proper: a real entity. changing
> the language from foundation to authors and treating it
> like it's still a copyright assignment is pointless
> unless the simplified attribution still assigns the
> copyright to the gentoo foundation hold copyright.

The intent is not to require assignment of copyright.  We were
actually considering rolling out the FLA in parallel (voluntarily),
but this was felt to be making the GLEP even more complex.

> GLEP 76 shouldn't try to be an umbrella for multiple things.

I guess we should consider that when we approve it.  Oh wait, it is
already approved.  I guess when you author the next one you can take
that into account.  :)

It isn't perfect.  IMO it belongs together.  However, others might
disagree.  It only took about half a decade to finish.  I'm sure
somebody willing to put enough time into it will surpass it.  Then
they can go on to real challenges like filing the Foundation's taxes.

In any case, I'm not convinced that copyright notice is really worth
THAT much fighting over.  I wasn't a huge fan of "Gentoo Authors"
either, but in the end I realized that notices are fairly overrated.
I think that the GLEP accomplishes what it ought to on this front.
Any requirement you add to it is just going to create another group of
devs who feel they cannot comply with it.  Heck, the current policy
basically allows almost any notice that complies with US law and there
is still some concern.

-- 
Rich

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Sarah White]

On 10/11/2018 09:59 PM, Rich Freeman wrote:
> On Thu, Oct 11, 2018 at 9:25 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>>
>> assuming "commit authors are copyright holders" shouldn't be
>> trusted blindly (the git log doesn't "solve everything")
>>
> 
> Sure, but neither can any other conceivable log, and anything that
> could be put in such a log could also be put in a commit annotation,
> which IMO will track it a heck of a lot better than a random text
> file.
> 
>>
>> Does this mean "gentoo authors" will appear in court when
>> there's infringement? This is not a rhetorical question.
>>
> 
> Simply being named in a copyright notice creates no particular
> obligation to appear in a court.
> 
> If there is some kind of copyright lawsuit, then presumably those most
> associated with the code in question could be called as witnesses,
> assuming whoever is doing the suing can be bothered to track them
> down.
> 
> Ultimately though if Gentoo gets sued by somebody, the burden of proof
> is actually on them to prove that THEY owned the copyright.  Gentoo's
> burden would probably be to show that reasonable care was exercised
> over accepting code, and that infractions were dealt with in a
> reasonable manner when brought to our attention.
> 
> Really though, that is about the best we can do anyway.  If we want to
> suppose that somebody can make us do more than what is "reasonable"
> then we might as well give up on FOSS.
> 
>>
>> This is a very useful notice, because if someone has a snapshot
>> tarball, or other non-git copy of particular source files, the
>> lack of a proper notice is a legal problem (see below)
> 
> Just stick it in git.  If somebody wants to know the history, they can
> look it up in git.  If somebody wants to go redistributing snippets of
> the file, then complying with the law is their problem, not ours.
> 
>>
>> - This ignores the purpose: copyright notices are to make
>> sure when someone gets "free code", they don't assume it's
>> free for any/all purposes with zero restrictions:
>>
> 
> Our notices already make this clear, regardless of whose name is listed.
> 
>> the infringer could say the copyright status (copyleft
>> uses copyright law for enforcement) wasn't apparent due
>> to the lack of a clearly formatted copyright notice...
> 
> The required format of a copyright noticed under US law is explictly stated:
> 
> (b)Form of Notice.—If a notice appears on the copies, it shall consist
> of the following three elements:
> (1)the symbol © (the letter C in a circle), or the word “Copyright”,
> or the abbreviation “Copr.”; and
> (2)the year of first publication of the work; in the case of
> compilations, or derivative works incorporating previously published
> material, the year date of first publication of the compilation or
> derivative work is sufficient. The year date may be omitted where a
> pictorial, graphic, or sculptural work, with accompanying text matter,
> if any, is reproduced in or on greeting cards, postcards, stationery,
> jewelry, dolls, toys, or any useful articles; and
> (3)the name of the owner of copyright in the work, or an abbreviation
> by which the name can be recognized, or a generally known alternative
> designation of the owner.
> 
>> ... so something generic like "gentoo authors" can be
>> difficult to enforce - I've not seen case law on this.
> 
> Our copyright would be completely enforceable even if we had no notice at all.
> 
> However, if Gentoo sued somebody for infringement, then the defendant
> could attempt to claim that the infringement was innocent (ie they did
> not know the work was copyrighted).  IMO that would be an uphill
> battle.  If the court decides our notice complies, then they are
> required by law to not give any credence to such an argument.  If they
> decide that it doesn't completely comply, then they would still weigh
> the argument, and how plausible is it that a court will buy that you
> didn't know it was copyrighted when Copyright 2018 Gentoo Authors is
> on the first line of the file?
> 
> And none of this will ever matter at all unless Gentoo files a
> lawsuit.  Right now we can't seem to file our taxes.  How likely do we
> think it is that Gentoo will be filing a lawsuit as the plaintiff?
> The notice doesn't matter at all if somebody sues us.
> 
>>
>> I believe licensing is the reason for GCO, not copyright
>> attribution. Language about committer, acked or signed-off,
>> and copyright holder VS licenses and GCO, all within the
>> same
> 
> Sure, that is completely true. The GCO/DCO/etc has nothing to do with
> attribution.
> 
>> GLEP (#76) adds a lot of confusion because copyright
>> is barely mentioned, and not in a clearly defined way.
> 
> What is unclear about it?
> 
> It used to be much more prescriptive.  However, that was considered to
> be too inflexible, and other prominent projects (like Linux) don't
> seem to require this.  The importance of a very specific notice also
> did not really seem to be sufficient to create controversies when
> contributors felt they could not comply with a very specific
> requirement.
> 
>> Copyright should be treated as a separate issue from GCO.
> 
> Well, both deal with copyright, but I agree that the notice is
> separate from the GCO, and they are in fact mentioned separately.
> 
>>
>> Do "gentoo authors" file a lawsuit when there's infringement?
> 
> You do not need to be listed in a copyright notice to file a lawsuit.
> You merely need to have authorship.
> 
>> How does jurisdiction work when the only thing which can
>> be known for certain is: "someone claimed the commit they
>> wrote was FOSS/Libre & they signed-off with a GCO line"
> 
> Ultimately anybody wanting to file a lawsuit has to prove the
> underlying facts.  If you want to sue somebody for copyright
> infringement you have to demonstrate to the court that you wrote
> whatever you're suing over.
> 
> If we were in the business of selling software and were more likely to
> be suing people regularly, then I'd certainly agree that a lot more
> rigor could be used to capture proof of ownership.  This would
> presumably pay for itself as a cost of doing business.  However, that
> isn't the kind of organization we are in.  Mostly we just want to show
> reasonable care, and to be responsible in general.  That helps keep us
> from getting sued.  I'm skeptical that Gentoo would ever sue anybody.
> 
>> Does this mean GCO sign-off lines obligate the contributors
>> to respond whenever FOSS/Libre legal issues come up?
> 
> No.  Your obligation to respond to a court is established in your
> local laws.  In many places you can be called as a witness against
> your will if you have knowledge of a case, whether you sign anything
> or not.  I don't think that is particularly likely to happen here, and
> it is especially unlikely outside of your local jurisdiction, and most
> courts do have rules to avoid placing unreasonable burdens on
> witnesses.
> 
> IMO signing the DCO/GCO/etc probably reduces the likelihood of being
> called to testify simply because your testimony is already a matter of
> public record (well, maybe aside form some notarized statement
> affirming that you signed it).
> 
>> If there was a FLA policy in place, and gentoo formally held
>> itself out to protect (as a fiduciary) any FOSS/Libre interests
>> of the contributors; gentoo needs to hold the copyright, and
>> more importantly: invest in policy and planning to legally
>> protect FOSS/Libre interests when any infringement occurs.
> 
> Actually, the FLA as written by the FSFe explicitly does NOT assign copyright.
> 
>> the protection should be proper: a real entity. changing
>> the language from foundation to authors and treating it
>> like it's still a copyright assignment is pointless
>> unless the simplified attribution still assigns the
>> copyright to the gentoo foundation hold copyright.
> 
> The intent is not to require assignment of copyright.  We were
> actually considering rolling out the FLA in parallel (voluntarily),
> but this was felt to be making the GLEP even more complex.
> 
>> GLEP 76 shouldn't try to be an umbrella for multiple things.
> 
> I guess we should consider that when we approve it.  Oh wait, it is
> already approved.  I guess when you author the next one you can take
> that into account.  :)
> 
> It isn't perfect.  IMO it belongs together.  However, others might
> disagree.  It only took about half a decade to finish.  I'm sure
> somebody willing to put enough time into it will surpass it.  Then
> they can go on to real challenges like filing the Foundation's taxes.
> 
> In any case, I'm not convinced that copyright notice is really worth
> THAT much fighting over.  I wasn't a huge fan of "Gentoo Authors"
> either, but in the end I realized that notices are fairly overrated.
> I think that the GLEP accomplishes what it ought to on this front.
> Any requirement you add to it is just going to create another group of
> devs who feel they cannot comply with it.  Heck, the current policy
> basically allows almost any notice that complies with US law and there
> is still some concern.
> 

Many of those inline replies are redundant, and seem to be
referring to what I wasn't talking about:

I think the confusion / misunderstanding here is evidence
of exactly what I was referring to. Copyright Notices are
notices that a copyright is held, and GLEP 76 is titled:

"Copyright Policy", and only mentions copyright notices.

To me, that's overly vague for one reason - when I see a
copyright notice, I assume it's valid, because I know what
a copyright notice is: the copyright holder saying:

"this is mine and I will protect it"

The infringement occurs when the copyright holder (the
legal entity / person listed in the notice) has their
copyrighted work misused in some way. In the case of
copyleft, the license is traditionally mentioned in the
same section as the copyright notice, with the (implied)
intent being: "if you violate this license, you've done
something with my copyrighted work, and I must protect my
copyright interests by enforcing my license"

To clarify what I meant:

Do "gentoo authors" file a lawsuit when there's infringement?

That was the main / only thing I was referring to.

"this is mine and I will protect it" - copyright holder

One of the things I pointed out wasn't really addressed:

["copyright notices are not required for
a copyright holder to have a copyright"]

^ as referenced here:

>
>>
>> Does this mean "gentoo authors" will appear in court when
>> there's infringement? This is not a rhetorical question.
>>
>

[...]

>
> Ultimately though if Gentoo gets sued by somebody, the burden of proof
> is actually on them to prove that THEY owned the copyright.  Gentoo's
> burden would probably be to show that reasonable care was exercised
> over accepting code, and that infractions were dealt with in a
> reasonable manner when brought to our attention.
>

[...]

^ The copyright holder (the legal entity or person in the
copyright notice) would be the one to file lawsuit(s) when
there's infringement.

I'm specifically / directly asking:

Is the gentoo foundation the copyright holder?

> Our notices already make this clear, regardless of whose name is listed.

That's not clear. A lot of people see: "this is free, and
the source code is available", and then make assumptions
about what that means:

There's very little documentation about gentoo's procedure
when FOSS/Libre work (copyleft / copyrightable portions of
gentoo OS and related tools) is mistreated, and a copyright
action is needed in order to enforce the licesnse (copyleft
style: because that's why there's copyright notices)

The notion: "GLEP 76 implies what happens in that case"...

... must've been in some other document.

My point was / still is:

What is gentoo's policy when infringement happens?
(when "gentoo authors" are the copyright holder)

If a business entity's name is listed as the copyright
holder, their copyright notice means (at least it should)
that they'll be the ones who show up in court when the
time comes to protect against copyleft infringement:

>
> And none of this will ever matter at all unless Gentoo files a
> lawsuit.  Right now we can't seem to file our taxes.  How likely do we
> think it is that Gentoo will be filing a lawsuit as the plaintiff?
> The notice doesn't matter at all if somebody sues us.
>

An infringement suit is when the copyright holder ("gentoo
authors", and I'm questioning how "gentoo authors" hold
a copyright if listed as the "entity" which holds the
copyright) SUES the infringer, not the other way around.

Copyright notice serves a specific legal purpose.

Not sure what you mean about: "file our taxes".

Was that a joke?

To me, the (main) point of GLEP 76 is to let entities who
are willing/able to file a copyright lawsuit have the
option to do so, partly because gentoo doesn't seem to have
a policy in please for protecting copyleft / copyright.

Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Rich Freeman]

On Fri, Oct 12, 2018 at 7:34 AM Sarah White <kuzetsa@poindexter.ovh> wrote:
>
> On 10/11/2018 09:59 PM, Rich Freeman wrote:
>
> I think the confusion / misunderstanding here is evidence
> of exactly what I was referring to. Copyright Notices are
> notices that a copyright is held, and GLEP 76 is titled:
>
> "Copyright Policy", and only mentions copyright notices.

It also includes the GCO/DCO, which is verification of the right to
redistribute and accuracy of the license, which is copyright-related.
It originally included an FLA as well, but this was removed.

>
> Do "gentoo authors" file a lawsuit when there's infringement?
>
> That was the main / only thing I was referring to.

And I answered this in the part you didn't quote inline.  "Gentoo
authors" would not file a lawsuit.  Any copyright holder can file a
lawsuit at any time if they wish, and no copyright notice changes
that.

> "this is mine and I will protect it" - copyright holder

Again if you don't have a notice at all you can still sue somebody if
you want to if they copy your work outside of fair use.  A notice just
eliminates the possibility of one of many types of defenses they could
argue.  IMO the notice we have is sufficient, but really I'm not that
concerned if it isn't.

> >>
> >> Does this mean "gentoo authors" will appear in court when
> >> there's infringement? This is not a rhetorical question.
> >>
> >
>
> [...]

Do you want me to copy the same response again, despite already being
accused of redundancy?

Fine:

"Gentoo authors" would not file a lawsuit.  Any copyright holder can
file a lawsuit at any time if they wish, and no copyright notice
changes that.

>
> >
> > Ultimately though if Gentoo gets sued by somebody, the burden of proof
> > is actually on them to prove that THEY owned the copyright.  Gentoo's
> > burden would probably be to show that reasonable care was exercised
> > over accepting code, and that infractions were dealt with in a
> > reasonable manner when brought to our attention.
> >
>
> ^ The copyright holder (the legal entity or person in the
> copyright notice) would be the one to file lawsuit(s) when
> there's infringement.

Sure, and if somebody sues Gentoo they would be claiming to be the
copyright holder.

Now, if Gentoo wanted to sue somebody then Gentoo would need to
establish ownership of copyright.  IMO that is pretty unlikely to
happen.

>
> I'm specifically / directly asking:
>
> Is the gentoo foundation the copyright holder?

IMO there is no benefit to the Foundation to take a position on this
issue.  The GLEP does not require assignment to Gentoo.  Whether past
contributions were assigned might be debated by some.

IMO we could argue all day long about that, but there is no benefit in
doing so.  First, the situation is somewhat vague.  Second, I have no
idea whether it would ever be important to establish Gentoo ownership
of past contributions in a court, but if it were important then the
best argument the other side could make would be pointing to
Trustees/Officers/etc making statements that hurt its case.  So,
making statements on the past doesn't help us, and it might hurt us.
So, why do it?

The GLEP was designed to improve things going forward.

Long-term I think there is more interest in using a mechanism like the
FLA than doing copyright assignment.  IMO that has all of the upside
of assignment and none of the downside.

>
> > Our notices already make this clear, regardless of whose name is listed.
>
> That's not clear. A lot of people see: "this is free, and
> the source code is available", and then make assumptions
> about what that means:

Those quoted words appear nowhere in the GLEP.

What our files ACTUALLY say is something like "Copyright 2018 Gentoo
Authors".  Then we have a license to allow redistribution.  If people
don't want to read the license that is on them.  If people read
"Copyright 2018" and assume that this means that it must be free to
copy without any restrictions that is on them also.

> There's very little documentation about gentoo's procedure
> when FOSS/Libre work (copyleft / copyrightable portions of
> gentoo OS and related tools) is mistreated, and a copyright
> action is needed in order to enforce the licesnse (copyleft
> style: because that's why there's copyright notices)

Correct.

Committing copyrighted stuff to Gentoo is routine.  Gentoo suing
people for copyright infringement is not routine.  It really doesn't
make sense to have a standardized GLEP for something we've never done,
and might never do.  Why constrain ourselves to that degree in the
event we were ever to decide to do such a thing?

> What is gentoo's policy when infringement happens?

Gentoo has no documented policy I'm aware of.

> (when "gentoo authors" are the copyright holder)

Ask the Gentoo authors.  When I'm the Gentoo author I don't
necessarily have any plans to go suing anybody anytime soon, but I
reserve the right to do so, and if I do so it would be at my own sole
discretion at the time.

> If a business entity's name is listed as the copyright
> holder, their copyright notice means (at least it should)
> that they'll be the ones who show up in court when the
> time comes to protect against copyleft infringement:

Legally a copyright notice does not have to list the entity who will
file a lawsuit.

> An infringement suit is when the copyright holder ("gentoo
> authors", and I'm questioning how "gentoo authors" hold
> a copyright if listed as the "entity" which holds the
> copyright) SUES the infringer, not the other way around.

You're assuming "Gentoo authors" is a single entity.  The policy makes
no claim for/against that.

> To me, the (main) point of GLEP 76 is to let entities who
> are willing/able to file a copyright lawsuit have the
> option to do so, partly because gentoo doesn't seem to have
> a policy in please for protecting copyleft / copyright.

GLEP 76 mostly serves to protect Gentoo against others suing us by
demonstrating reasonable care.

To the degree that it mentions notice, it is mainly because OTHERS got
upset about Gentoo changing THEIR copyright notices, because our
previous policy required all ebuilds to name the Gentoo Foundation
exclusively.

However, the policy still preserves our rights to sue others if
necessary, IMO.  If we wanted to optimize to be more efficient at
suing people we'd probably do more to prepare for this.  However, that
really isn't the organizations primary purpose.

-- 
Rich