[gentoo-project] rfc: copyright attribution clarifications

[gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 2300 bytes --]

All,

I need to ask the community a couple of questions about copyright
attribution that came up this past couple of weeks around bug 670702 [1].

My first question is about the "Gentoo Authors" string. My understanding
of this is that this string is to be only used in the simplified
form of attribution and is not a generic catch-all that can be used in
the traditional form. Does everyone agree with this? If so, this is
somewhat problematic for traditional attribution, but I'll talk about
that below.

Since we do not do copyright assignment any more and the glep allows for
traditional attribution, if some entity
(company, person etc) has a desire for a copyright notice in
their work, the case for not allowing this is very weak at best, so we will
end up with more and more ebuilds that want to use traditional copyright
attribution, and once an ebuild is switched over, it is problematic to
switch back.

Some in the council seem to want a tree policy that requires
traditional attribution to be one and only one line at the top of ebuilds,  e.g.

# Copyright <years> [contributor1,] [contributor2,] [contributor3,] ...  [contributorn] and others

As you can see from my example, line length will quickly become
problematic in this format because all lines in in-tree ebuilds are
supposed to be under 80 characters.

It is also problematic because the relationship between the years and
contributors becomes unclear unless we allow ranges and single years in
the copyright notice, which would lead to something like this:

# Copyright <years1>, <years2>, <years3>, ... <yearsn+1>  [contributor1,] [contributor2,] [contributor3,] ...  [contributorn] and others

This is going to have the same maintenance issues as traditional multiline
attribution, but it is going to be very painful to maintain since it is
all on one line. Multiple-lines would be much easier to maintain, and
there is no cost performance wise for them.

# Copyright <years1> <contributor1>
# Copyright <years2> <contributor2>
# Copyright <years3> <contributor3>
# ...
# Copyright <yearsn+1> others (or some catch-all like it)

This seems to be a pretty compelling case for multiline traditional
attribution. What do folks think?

William

[1] https://bugs.gentoo.org/670702
[2] https://www.gentoo.org/glep/glep-0076.html

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[M. J. Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 2626 bytes --]

On 13/11/18 18:32, William Hubbs wrote:
> All,
>
> I need to ask the community a couple of questions about copyright
> attribution that came up this past couple of weeks around bug 670702 [1].
>
> My first question is about the "Gentoo Authors" string. My understanding
> of this is that this string is to be only used in the simplified
> form of attribution and is not a generic catch-all that can be used in
> the traditional form. Does everyone agree with this? If so, this is
> somewhat problematic for traditional attribution, but I'll talk about
> that below.
>
> Since we do not do copyright assignment any more and the glep allows for
> traditional attribution, if some entity
> (company, person etc) has a desire for a copyright notice in
> their work, the case for not allowing this is very weak at best, so we will
> end up with more and more ebuilds that want to use traditional copyright
> attribution, and once an ebuild is switched over, it is problematic to
> switch back.
>
> Some in the council seem to want a tree policy that requires
> traditional attribution to be one and only one line at the top of ebuilds,  e.g.
>
> # Copyright <years> [contributor1,] [contributor2,] [contributor3,] ...  [contributorn] and others
>
> As you can see from my example, line length will quickly become
> problematic in this format because all lines in in-tree ebuilds are
> supposed to be under 80 characters.
>
> It is also problematic because the relationship between the years and
> contributors becomes unclear unless we allow ranges and single years in
> the copyright notice, which would lead to something like this:
>
> # Copyright <years1>, <years2>, <years3>, ... <yearsn+1>  [contributor1,] [contributor2,] [contributor3,] ...  [contributorn] and others
>
> This is going to have the same maintenance issues as traditional multiline
> attribution, but it is going to be very painful to maintain since it is
> all on one line. Multiple-lines would be much easier to maintain, and
> there is no cost performance wise for them.
>
> # Copyright <years1> <contributor1>
> # Copyright <years2> <contributor2>
> # Copyright <years3> <contributor3>
> # ...
> # Copyright <yearsn+1> others (or some catch-all like it)
>
> This seems to be a pretty compelling case for multiline traditional
> attribution. What do folks think?
>
> William
>
> [1] https://bugs.gentoo.org/670702
> [2] https://www.gentoo.org/glep/glep-0076.html
Surely that's a no-brainer? (to make copyrights multi-line, like every
other source out there in the wild already ...

#thegentooway


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Tue, Nov 13, 2018 at 10:32 AM William Hubbs <williamh@gentoo.org> wrote:
>
> Since we do not do copyright assignment any more and the glep allows for
> traditional attribution, if some entity
> (company, person etc) has a desire for a copyright notice in
> their work, the case for not allowing this is very weak at best, so we will
> end up with more and more ebuilds that want to use traditional copyright
> attribution, and once an ebuild is switched over, it is problematic to
> switch back.

So, the purpose of allowing specific copyright holders to be named was
to cover cases where we're forking foreign code, not to basically
introduce a variant on the BSD advertising clause.  IMO people who are
only willing to contribute FOSS if their name gets put in a prominent
location might do better to contribute elsewhere.

>
> As you can see from my example, line length will quickly become
> problematic in this format because all lines in in-tree ebuilds are
> supposed to be under 80 characters.

Indeed, this is tone of he problems with allowing people to spam the
copyright notice.  It is basically the advertising clause in a
different place.

>
> It is also problematic because the relationship between the years and
> contributors becomes unclear unless we allow ranges and single years in
> the copyright notice, which would lead to something like this:
>
> # Copyright <years1>, <years2>, <years3>, ... <yearsn+1>  [contributor1,] [contributor2,] [contributor3,] ...  [contributorn] and others

The purpose of a copyright notice is to declare that the file is
copyrighted, and that is it.

It isn't a comprehensive list of everybody who holds a copyright on the file.

It isn't a revision history.

There is no need to list various mixes of years and authors.  Just
list the first and last year, and whatever copyright holders are
necessary.

> Multiple-lines would be much easier to maintain, and
> there is no cost performance wise for them.

Except for spam in our files.

Heck, repoman complains if you stick two newlines in a row in the
file, and now we basically want to add a revision history to the file?

Just say no.  Fit it on one line.

But, if you had to have multiple lines, then just wrap the existing
notice.  Don't turn it into some kind of revision history.  Just list
one year range and whatever list of entities you feel compelled to
list.  That is the proper way to do a notice.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 3146 bytes --]

On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:
> On Tue, Nov 13, 2018 at 10:32 AM William Hubbs <williamh@gentoo.org> wrote:
> >
> > Since we do not do copyright assignment any more and the glep allows for
> > traditional attribution, if some entity
> > (company, person etc) has a desire for a copyright notice in
> > their work, the case for not allowing this is very weak at best, so we will
> > end up with more and more ebuilds that want to use traditional copyright
> > attribution, and once an ebuild is switched over, it is problematic to
> > switch back.
> 
> So, the purpose of allowing specific copyright holders to be named was
> to cover cases where we're forking foreign code, not to basically
> introduce a variant on the BSD advertising clause.  IMO people who are
> only willing to contribute FOSS if their name gets put in a prominent
> location might do better to contribute elsewhere.

Do you feel this way about corporations as well? Do you think the Linux
kernel maintainers should go and rip out all copyright notices other
than Linus Torvalds and maybe the Linux Foundation?

> 
> >
> > As you can see from my example, line length will quickly become
> > problematic in this format because all lines in in-tree ebuilds are
> > supposed to be under 80 characters.
> 
> Indeed, this is tone of he problems with allowing people to spam the
> copyright notice.  It is basically the advertising clause in a
> different place.
> 
> >
> > It is also problematic because the relationship between the years and
> > contributors becomes unclear unless we allow ranges and single years in
> > the copyright notice, which would lead to something like this:
> >
> > # Copyright <years1>, <years2>, <years3>, ... <yearsn+1>  [contributor1,] [contributor2,] [contributor3,] ...  [contributorn] and others
> 
> The purpose of a copyright notice is to declare that the file is
> copyrighted, and that is it.
> 
> It isn't a comprehensive list of everybody who holds a copyright on the file.
> 
> It isn't a revision history.
> 
> There is no need to list various mixes of years and authors.  Just
> list the first and last year, and whatever copyright holders are
> necessary.
> 
> > Multiple-lines would be much easier to maintain, and
> > there is no cost performance wise for them.
> 
> Except for spam in our files.

And how does that affect performance?

> Heck, repoman complains if you stick two newlines in a row in the
> file, and now we basically want to add a revision history to the file?

No, a revision history comes from vcs.

> 
> Just say no.  Fit it on one line.
> 
> But, if you had to have multiple lines, then just wrap the existing
> notice.  Don't turn it into some kind of revision history.  Just list
> one year range and whatever list of entities you feel compelled to
> list.  That is the proper way to do a notice.

No sir, it isn't.

Look anywhere outside the Gentoo tree. For that matter, take the Linux
kernel, or even in the systemd source, there are several places with
multiple copyright notices in them.

William

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Sarah White]

[-- Attachment #1.1.1: Type: text/plain, Size: 4803 bytes --]

On 11/13/2018 09:46 PM, William Hubbs wrote:
> On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:
>> On Tue, Nov 13, 2018 at 10:32 AM William Hubbs <williamh@gentoo.org> wrote:
>>>
>>> Since we do not do copyright assignment any more and the glep allows for
>>> traditional attribution, if some entity
>>> (company, person etc) has a desire for a copyright notice in
>>> their work, the case for not allowing this is very weak at best, so we will
>>> end up with more and more ebuilds that want to use traditional copyright
>>> attribution, and once an ebuild is switched over, it is problematic to
>>> switch back.
>>
>> So, the purpose of allowing specific copyright holders to be named was
>> to cover cases where we're forking foreign code, not to basically
>> introduce a variant on the BSD advertising clause.  IMO people who are
>> only willing to contribute FOSS if their name gets put in a prominent
>> location might do better to contribute elsewhere.
> 
> Do you feel this way about corporations as well? Do you think the Linux
> kernel maintainers should go and rip out all copyright notices other
> than Linus Torvalds and maybe the Linux Foundation?
> 

perceived similarity to any version of the BSD advertising clause is a
misunderstanding. copyright is not a license or license restriction:
licensing is not copyright. holding a copyright, and/or having a
copyright notice doesn't bring back the controversial 4-clause BSD
license, which itself is an artifact from the 90s

multiline (standard form) copyright attribution doesn't have anything to
do with licensing, and only serves to strengthen copyleft due to the
presence of additional copyright notices which clearly lay out a list of
entities / people with a stake in protecting the interests of an
opensource project remaining FOSS/Libre. gentoo's license policy already
requires FOSS/Libre licenses and correctly using copyright law for
copyleft purposes makes everything work correctly when it's used correctly.

SPDX-style license blocks have a well-defined layout
(I'm a fan / several linux kernel developers are too)

... and SPDX displays the copyright notice in a way which is
fully compatible with, and improves transparency for copyleft

>>
>>>
>>> As you can see from my example, line length will quickly become
>>> problematic in this format because all lines in in-tree ebuilds are
>>> supposed to be under 80 characters.
>>
>> Indeed, this is tone of he problems with allowing people to spam the
>> copyright notice.  It is basically the advertising clause in a
>> different place.
>>
>>>
>>> It is also problematic because the relationship between the years and
>>> contributors becomes unclear unless we allow ranges and single years in
>>> the copyright notice, which would lead to something like this:
>>>
>>> # Copyright <years1>, <years2>, <years3>, ... <yearsn+1>  [contributor1,] [contributor2,] [contributor3,] ...  [contributorn] and others
>>
>> The purpose of a copyright notice is to declare that the file is
>> copyrighted, and that is it.
>>
>> It isn't a comprehensive list of everybody who holds a copyright on the file.
>>
>> It isn't a revision history.
>>
>> There is no need to list various mixes of years and authors.  Just
>> list the first and last year, and whatever copyright holders are
>> necessary.
>>
>>> Multiple-lines would be much easier to maintain, and
>>> there is no cost performance wise for them.
>>
>> Except for spam in our files.
> 
> And how does that affect performance?
> 

it shouldn't. most interpreted languages have sensible handling for
comments / JIT compilation, and for compiled languages there's normally
zero runtime penalty for comment blocks of any kind.

even if a QA tool has a bottleneck when scanning comments, there's no
reason to believe this is a mission-critical failure and the performance
bottleneck will slow down development.

>> Heck, repoman complains if you stick two newlines in a row in the
>> file, and now we basically want to add a revision history to the file?
> 
> No, a revision history comes from vcs.
> 

yep

>>
>> Just say no.  Fit it on one line.
>>
>> But, if you had to have multiple lines, then just wrap the existing
>> notice.  Don't turn it into some kind of revision history.  Just list
>> one year range and whatever list of entities you feel compelled to
>> list.  That is the proper way to do a notice.
> 
> No sir, it isn't.
> 
> Look anywhere outside the Gentoo tree. For that matter, take the Linux
> kernel, or even in the systemd source, there are several places with
> multiple copyright notices in them.

indeed. it's done in a sensible way too (see comments above)

> William
> 

-- kuza

[-- Attachment #1.1.2: 0xBE4D4EFD05297C67.asc --]
[-- Type: application/pgp-keys, Size: 30819 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Tue, Nov 13, 2018 at 11:18 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>
> On 11/13/2018 09:46 PM, William Hubbs wrote:
> > On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:
> >> On Tue, Nov 13, 2018 at 10:32 AM William Hubbs <williamh@gentoo.org> wrote:
> >>>
>
> multiline (standard form) copyright attribution doesn't have anything to
> do with licensing, and only serves to strengthen copyleft due to the
> presence of additional copyright notices which clearly lay out a list of
> entities / people with a stake in protecting the interests of an
> opensource project remaining FOSS/Libre.

First, git already does this.

Second, please cite an example of a copyright lawsuit that was won
because multiple notices were listed, or a law that provides
protection if multiple notices are provided.  Your claim that doing
this "strengthen[s] copyleft" is baseless as far as I can tell.

The presence of any copyright notice in the form given in US law
already defeats the innocent infringement defense, even if it doesn't
mention you.  Beyond that copyright law applies whether there is any
notice at all.

> gentoo's license policy already
> requires FOSS/Libre licenses and correctly using copyright law for
> copyleft purposes makes everything work correctly when it's used correctly.

Indeed, and for this reason I don't actually see any reason under US
copyright law that we couldn't strip out additional copyright notices
in code as a result.  US law explicitly makes this illegal only if it
is done to hide infringement, and we don't infringe copyright.  I can
only imagine the wails of the copyright pro-spam crowd if we actually
tried that (not that I'm suggesting it)...

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Patrick McLean]

On Wed, 14 Nov 2018 07:58:08 -0800
Rich Freeman <rich0@gentoo.org> wrote:

> On Tue, Nov 13, 2018 at 11:18 PM Sarah White <kuzetsa@poindexter.ovh>
> wrote:
> >
> > On 11/13/2018 09:46 PM, William Hubbs wrote:  
> > > On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:  
> > >> On Tue, Nov 13, 2018 at 10:32 AM William Hubbs
> > >> <williamh@gentoo.org> wrote:  
> > >>>  
> >
> > multiline (standard form) copyright attribution doesn't have
> > anything to do with licensing, and only serves to strengthen
> > copyleft due to the presence of additional copyright notices which
> > clearly lay out a list of entities / people with a stake in
> > protecting the interests of an opensource project remaining
> > FOSS/Libre.  
> 
> First, git already does this.

It does not, it lists authors, not copyright holders which are not the
same thing.

> Second, please cite an example of a copyright lawsuit that was won
> because multiple notices were listed, or a law that provides
> protection if multiple notices are provided.  Your claim that doing
> this "strengthen[s] copyleft" is baseless as far as I can tell.

I don't think it's about citing cases, the GPL has never gotten to
trial AFAIK, so under that metric, the GPL is useless.

> The presence of any copyright notice in the form given in US law
> already defeats the innocent infringement defense, even if it doesn't
> mention you.  Beyond that copyright law applies whether there is any
> notice at all.
> 
> > gentoo's license policy already
> > requires FOSS/Libre licenses and correctly using copyright law for
> > copyleft purposes makes everything work correctly when it's used
> > correctly.  
> 
> Indeed, and for this reason I don't actually see any reason under US
> copyright law that we couldn't strip out additional copyright notices
> in code as a result.  US law explicitly makes this illegal only if it
> is done to hide infringement, and we don't infringe copyright.  I can
> only imagine the wails of the copyright pro-spam crowd if we actually
> tried that (not that I'm suggesting it)...

Are you suggesting that stripping out copyright headers is permissable?
I would talk to a copyright lawyer before making any such assumptions.
That would imply that chromeos could stip out all the Gentoo
copyrights and replace them with chrome project ones. Other Gentoo
derivatives could do the same thing, as long as it retains the GPL, all
is permitted.

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Wed, Nov 14, 2018 at 11:38 AM Patrick McLean <chutzpah@gentoo.org> wrote:
>
> On Wed, 14 Nov 2018 07:58:08 -0800
> Rich Freeman <rich0@gentoo.org> wrote:
>
> > On Tue, Nov 13, 2018 at 11:18 PM Sarah White <kuzetsa@poindexter.ovh>
> > wrote:
> > >
> > >
> > > multiline (standard form) copyright attribution doesn't have
> > > anything to do with licensing, and only serves to strengthen
> > > copyleft due to the presence of additional copyright notices which
> > > clearly lay out a list of entities / people with a stake in
> > > protecting the interests of an opensource project remaining
> > > FOSS/Libre.
> >
> > First, git already does this.
>
> It does not, it lists authors, not copyright holders which are not the
> same thing.

Nothing prevents us from adding copyright info to commit messages, and
companies that feel strongly about documenting their copyright over
their contributions would probably be best off doing it in git where
it is less likely to get lost/deleted/etc over time.  It would also be
out of the way for those not looking for this info.

>
> > Second, please cite an example of a copyright lawsuit that was won
> > because multiple notices were listed, or a law that provides
> > protection if multiple notices are provided.  Your claim that doing
> > this "strengthen[s] copyleft" is baseless as far as I can tell.
>
> I don't think it's about citing cases, the GPL has never gotten to
> trial AFAIK, so under that metric, the GPL is useless.

I suggested that you could cite laws as well.  GPL is well-grounded in
copyright law (the law says basically that users of software have no
rights to copy it, and then GPL grants a few extra rights).  The law
takes away, and the GPL gives the user more freedom than they would
have otherwise under the law.

Laundry lists of copyright notices have no particular basis in law, in
particular because copyright law is already incredibly strong without
it.  A notice that names any copyright holder defeats an innocent
infringement defense (which is already a pretty weak defense to begin
with).  Adding more names to the copyright line doesn't do anything
else.

In any case, the claim was made that this "strengthens copyright" and
it is up to those making a claim to back it up with some kind of law
(statutory or case law), not just argue that more text must be better.

If you hold a copyright on something, you can sue somebody for
infringement even if you aren't named directly in the copyright
notice, or even if you aren't named indirectly (Gentoo authors), or
even if there isn't any notice at all.

>
> > The presence of any copyright notice in the form given in US law
> > already defeats the innocent infringement defense, even if it doesn't
> > mention you.  Beyond that copyright law applies whether there is any
> > notice at all.
> >
> > > gentoo's license policy already
> > > requires FOSS/Libre licenses and correctly using copyright law for
> > > copyleft purposes makes everything work correctly when it's used
> > > correctly.
> >
> > Indeed, and for this reason I don't actually see any reason under US
> > copyright law that we couldn't strip out additional copyright notices
> > in code as a result.  US law explicitly makes this illegal only if it
> > is done to hide infringement, and we don't infringe copyright.  I can
> > only imagine the wails of the copyright pro-spam crowd if we actually
> > tried that (not that I'm suggesting it)...
>
> Are you suggesting that stripping out copyright headers is permissable?
> I would talk to a copyright lawyer before making any such assumptions.

Please do.

And again, please cite actual laws or case law, not make hand-waving arguments.

All things are permissible barring a law that says otherwise.  There
is no law in the US at least that forbids removing a copyright notice,
except for the purpose of concealing infringement.

In any case, as I already said I'm not suggesting that we should do
this.  My point is just that copyright notices aren't nearly as
sacrosanct as some people seem to think they are.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Patrick McLean]

On Wed, 14 Nov 2018 15:23:56 -0800
Rich Freeman <rich0@gentoo.org> wrote:

> On Wed, Nov 14, 2018 at 11:38 AM Patrick McLean <chutzpah@gentoo.org>
> wrote:
> >
> > On Wed, 14 Nov 2018 07:58:08 -0800
> > Rich Freeman <rich0@gentoo.org> wrote:
> >  
> > > On Tue, Nov 13, 2018 at 11:18 PM Sarah White
> > > <kuzetsa@poindexter.ovh> wrote:  
> > > >
> > > >
> > > > multiline (standard form) copyright attribution doesn't have
> > > > anything to do with licensing, and only serves to strengthen
> > > > copyleft due to the presence of additional copyright notices
> > > > which clearly lay out a list of entities / people with a stake
> > > > in protecting the interests of an opensource project remaining
> > > > FOSS/Libre.  
> > >
> > > First, git already does this.  
> >
> > It does not, it lists authors, not copyright holders which are not
> > the same thing.  
> 
> Nothing prevents us from adding copyright info to commit messages, and
> companies that feel strongly about documenting their copyright over
> their contributions would probably be best off doing it in git where
> it is less likely to get lost/deleted/etc over time.  It would also be
> out of the way for those not looking for this info.

I don't object to adding the copyright notice to the commit message
rather than the ebuild, the only caveat is that the copyright should be
propigated to the rsync tree as well (since most users use rsync rather
than git). Perhaps the "fattening" step could do it, even just a
top-level file listing packages and copyright owners, should not be
overly hard to generate, maybe with a post-push hook that updates it
when a copyright tag is detected in the push.

> > > Second, please cite an example of a copyright lawsuit that was won
> > > because multiple notices were listed, or a law that provides
> > > protection if multiple notices are provided.  Your claim that
> > > doing this "strengthen[s] copyleft" is baseless as far as I can
> > > tell.  
> >
> > I don't think it's about citing cases, the GPL has never gotten to
> > trial AFAIK, so under that metric, the GPL is useless.  
> 
> I suggested that you could cite laws as well.  GPL is well-grounded in
> copyright law (the law says basically that users of software have no
> rights to copy it, and then GPL grants a few extra rights).  The law
> takes away, and the GPL gives the user more freedom than they would
> have otherwise under the law.
> 
> Laundry lists of copyright notices have no particular basis in law, in
> particular because copyright law is already incredibly strong without
> it.  A notice that names any copyright holder defeats an innocent
> infringement defense (which is already a pretty weak defense to begin
> with).  Adding more names to the copyright line doesn't do anything
> else.

IANAL nor do I pretend to be one. A lawyer did instruct me to add the
copyright notices to ebuilds that I work on during work hours.

> In any case, the claim was made that this "strengthens copyright" and
> it is up to those making a claim to back it up with some kind of law
> (statutory or case law), not just argue that more text must be better.

AFAIK no one on this list/thread is a lawyer, so much if this is not
particularly valuable. Personally, I don't see why there is a strong
objection to a practice that is quite common in open source code.

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Wed, Nov 14, 2018 at 4:00 PM Patrick McLean <chutzpah@gentoo.org> wrote:
>
> I don't object to adding the copyright notice to the commit message
> rather than the ebuild, the only caveat is that the copyright should be
> propigated to the rsync tree as well (since most users use rsync rather
> than git). Perhaps the "fattening" step could do it, even just a
> top-level file listing packages and copyright owners, should not be
> overly hard to generate, maybe with a post-push hook that updates it
> when a copyright tag is detected in the push.

IMO documenting copyright data in git would be a value-add, and could
potentially be assisted by repoman just as signed-off-by tags are.

Whether it gets propagated to rsync I'll leave to others who care
more.  Personally I don't get why we propagate anything other than the
ebuilds to rsync, but if rsync users want to punish themselves who am
I to argue with them?  :)

>
> IANAL nor do I pretend to be one. A lawyer did instruct me to add the
> copyright notices to ebuilds that I work on during work hours.

In my experience corporate lawyers have a lot of incentive to do this
sort of thing.

First, it costs them nothing to direct people to do this.  It doesn't
really cost the company much either, so there won't be push-back
internally.

It is also easy to explain a policy like this to a pointy-haired boss
type.  It gets seen as "doing something" to protect the company as
well.  Whether it actually is making a difference is another matter,
but it isn't like anybody is going to ever look into that.  It isn't
adding any risk.

At work I've seen far more costly policies than this established by
lawyers that are of dubious value to the company, but since the lawyer
doesn't get paid less if the policy is expensive, but they might lose
their job if anything bad happens, they have a lot of incentive to
enact every possible rule so that they can be seen as being innocent
if anything goes wrong.

I think a lot of it just happens without any malicious intent.  Lawyer
is asked for opinion, lawyer gives opinion.  Everybody is happy.  :)

>
> AFAIK no one on this list/thread is a lawyer, so much if this is not
> particularly valuable.

Well, if somebody who is a lawyer wants to add perspective I'm all
ears, but this is a community-based FOSS projects and decisions are
generally made based on arguments debated in public, and not "a friend
of a friend talked to a lawyer and got some free advice so we better
follow it."  A lot of pros and cons have been presented for this
change, and those in charge can weigh them, but I've never really been
a fan of arguments that deference must be made to arguments that
aren't even presented simply due to somebody holding a credential.

> Personally, I don't see why there is a strong objection to a practice that is quite common in open source code.

I suspect that some of this is due to the nature of ebuilds themselves
and our workflow.

If you have some file full of 2000 lines of source code, you're going
to spend all your time buried in whatever function you're refactoring
and you're not really looking at the boilerplate at the start of the
file.  You might spend days looking at the file and your editor
remembers where you left off.  You never even look at the copyright
notices and a few more lines isn't a big deal.  You don't even look at
the other functions in the file you're editing but trust them to honor
their APIs.

On the other hand Gentoo ebuilds might only be 10-20 lines long, and a
lot of the stuff that people are often looking at (keywords, iuse,
my_foo, etc) are right at the top.  Often this stuff is "above the
fold" as they say.  Sticking another half a dozen lines of cruft at
the top means that you're hunting more to find the stuff you care
about, and the copyright boilerplate could become half the file
contents in a file that is mostly boilerplate already.

Maybe a compromise would be to stick all the copyright cruft at the
end of the file, but IMO it is better stored in git, preferably in
some standardized format that could be parsed by tools.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1624 bytes --]

On Thu, Nov 15, 2018 at 07:03:11AM -0800, Rich Freeman wrote:
> On Wed, Nov 14, 2018 at 4:00 PM Patrick McLean <chutzpah@gentoo.org> wrote:
> > Personally, I don't see why there is a strong objection to a practice that is quite common in open source code.
> 
> I suspect that some of this is due to the nature of ebuilds themselves
> and our workflow.
> 
> If you have some file full of 2000 lines of source code, you're going
> to spend all your time buried in whatever function you're refactoring
> and you're not really looking at the boilerplate at the start of the
> file.  You might spend days looking at the file and your editor
> remembers where you left off.  You never even look at the copyright
> notices and a few more lines isn't a big deal.  You don't even look at
> the other functions in the file you're editing but trust them to honor
> their APIs.
> 
> On the other hand Gentoo ebuilds might only be 10-20 lines long, and a
> lot of the stuff that people are often looking at (keywords, iuse,
> my_foo, etc) are right at the top.  Often this stuff is "above the
> fold" as they say.  Sticking another half a dozen lines of cruft at
> the top means that you're hunting more to find the stuff you care
> about, and the copyright boilerplate could become half the file
> contents in a file that is mostly boilerplate already.

You can use searches in your editor to get to where you need to go quickly,
so the size of the file really shouldn't matter too much.

I believe there are also plugins that can hide things like this from you
visually so you don't see them.

William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Ian Stakenvicius]

[-- Attachment #1.1: Type: text/plain, Size: 7160 bytes --]

On 2018-11-15 10:03 a.m., Rich Freeman wrote:
> On Wed, Nov 14, 2018 at 4:00 PM Patrick McLean <chutzpah@gentoo.org> wrote:
>>
>> I don't object to adding the copyright notice to the commit message
>> rather than the ebuild, the only caveat is that the copyright should be
>> propigated to the rsync tree as well (since most users use rsync rather
>> than git). Perhaps the "fattening" step could do it, even just a
>> top-level file listing packages and copyright owners, should not be
>> overly hard to generate, maybe with a post-push hook that updates it
>> when a copyright tag is detected in the push.
> 
> IMO documenting copyright data in git would be a value-add, and could
> potentially be assisted by repoman just as signed-off-by tags are.
> 
> Whether it gets propagated to rsync I'll leave to others who care
> more.  Personally I don't get why we propagate anything other than the
> ebuilds to rsync, but if rsync users want to punish themselves who am
> I to argue with them?  :)
> 
>>
>> IANAL nor do I pretend to be one. A lawyer did instruct me to add the
>> copyright notices to ebuilds that I work on during work hours.
> 
> In my experience corporate lawyers have a lot of incentive to do this
> sort of thing.
> 
> First, it costs them nothing to direct people to do this.  It doesn't
> really cost the company much either, so there won't be push-back
> internally.
> 
> It is also easy to explain a policy like this to a pointy-haired boss
> type.  It gets seen as "doing something" to protect the company as
> well.  Whether it actually is making a difference is another matter,
> but it isn't like anybody is going to ever look into that.  It isn't
> adding any risk.
> 
> At work I've seen far more costly policies than this established by
> lawyers that are of dubious value to the company, but since the lawyer
> doesn't get paid less if the policy is expensive, but they might lose
> their job if anything bad happens, they have a lot of incentive to
> enact every possible rule so that they can be seen as being innocent
> if anything goes wrong.
> 
> I think a lot of it just happens without any malicious intent.  Lawyer
> is asked for opinion, lawyer gives opinion.  Everybody is happy.  :)
> 
>>
>> AFAIK no one on this list/thread is a lawyer, so much if this is not
>> particularly valuable.
> 
> Well, if somebody who is a lawyer wants to add perspective I'm all
> ears, but this is a community-based FOSS projects and decisions are
> generally made based on arguments debated in public, and not "a friend
> of a friend talked to a lawyer and got some free advice so we better
> follow it."  A lot of pros and cons have been presented for this
> change, and those in charge can weigh them, but I've never really been
> a fan of arguments that deference must be made to arguments that
> aren't even presented simply due to somebody holding a credential.
> 
>> Personally, I don't see why there is a strong objection to a practice that is quite common in open source code.
> 
> I suspect that some of this is due to the nature of ebuilds themselves
> and our workflow.
> 
> If you have some file full of 2000 lines of source code, you're going
> to spend all your time buried in whatever function you're refactoring
> and you're not really looking at the boilerplate at the start of the
> file.  You might spend days looking at the file and your editor
> remembers where you left off.  You never even look at the copyright
> notices and a few more lines isn't a big deal.  You don't even look at
> the other functions in the file you're editing but trust them to honor
> their APIs.
> 
> On the other hand Gentoo ebuilds might only be 10-20 lines long, and a
> lot of the stuff that people are often looking at (keywords, iuse,
> my_foo, etc) are right at the top.  Often this stuff is "above the
> fold" as they say.  Sticking another half a dozen lines of cruft at
> the top means that you're hunting more to find the stuff you care
> about, and the copyright boilerplate could become half the file
> contents in a file that is mostly boilerplate already.
> 
> Maybe a compromise would be to stick all the copyright cruft at the
> end of the file, but IMO it is better stored in git, preferably in
> some standardized format that could be parsed by tools.
> 


Quoting everything because I'm not sure exactly how to trim it, sorry.

So it's still rather important to differentiate I think authorship and
copyright notice; a big deal with the simplified copyright attribution
is the fact that authorship (and therefore each author's individual
copyright) *is* to be stored and accessed in git, or via an AUTHORS
file if no VCS is present to store and track it (iirc).  Therefore,
yes, if an author's work submitted to git is copyright their employer
it makes sense to me they should absolutely flag that in the commit
itself.  Is there a Copyright: tag in git to do that with?  I don't
think overriding 'Author:' to i.e. SIE would be a good idea...

Similarly, robbat2's comment 31 in bug 670702 about needing an AUTHORS
export from VCS will help with this as well -- rsync'ers could
absolutely mask away that file (same as most did for the ChangeLog of
old) but at least it'd be there as reference for legal purposes as
necessary.

-----

As to SIE specifically, first off it doesn't matter what they were ok
with in the past nor what reasons they have for requiring what they
are right now -- the fact is their legal department right now DOES
require this.  It would be great if someone from the Foundation could
talk to someone at SIE legal and work out a compromise on this
copyright-notice issue so we can make it go away (ie convince them the
notice is entirely not needed and their copyright is fully intact and
enforced without it), but right now this is the world we live in so we
gotta deal with it.  Also there's no telling what another corporate
entity might decide to do tomorrow, so one way or another I think we
do have to set a hard policy and stick with it and accept said
consequences (whichever way that goes).  All of that to say, I don't
think this is a futile bikeshed but we need to make it productively
create something.

----

This is a bit of a tangent but I think it's an important one in
general to talk about.  Also, it's possible a copyright lawyer might
need to chime in on this stuff:

How does i.e. SIE's copyright-notice rule work for patches contributed
to b.g.o?  And how does a copyright notice on a patch relate to the
work that the patch will be applied to?  I can see the patch itself
carrying a copyright notice since that patch is the actual work that
was authored, but when that patch is applied the *copyright notice* on
that patch doesn't automatically get transferred, does it?

By extension, technically, a commit that modifies lines in an existing
file is equivalent to a patch that's submitted by other means and then
applied, right?  And that's technically what git does except that
entire process internal and automatic,correct?



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 2813 bytes --]

>>>>> On Wed, 14 Nov 2018, William Hubbs wrote:

> On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:
>> So, the purpose of allowing specific copyright holders to be named
>> was to cover cases where we're forking foreign code, not to basically
>> introduce a variant on the BSD advertising clause. IMO people who are
>> only willing to contribute FOSS if their name gets put in a prominent
>> location might do better to contribute elsewhere.

+1000

Maybe the policy for the Gentoo repository should just say that, namely
that traditional copyright notices are only allowed for imported foreign
code. Anything committed directly to the repository and any update of an
existing file would be required to carry the simplified "Gentoo Authors"
copyright notice, without any exceptions allowed.

Can someone come up with a good wording for this?

> Do you feel this way about corporations as well? Do you think the
> Linux kernel maintainers should go and rip out all copyright notices
> other than Linus Torvalds and maybe the Linux Foundation?

Why would corporations be different from individual authors? Under the
legislation here, corporations cannot even hold copyright (or rather,
Urheberrecht) of a work.

>> The purpose of a copyright notice is to declare that the file is
>> copyrighted, and that is it.

Exactly.

>> It isn't a comprehensive list of everybody who holds a copyright on
>> the file.
>> 
>> It isn't a revision history.
>> 
>> There is no need to list various mixes of years and authors.  Just
>> list the first and last year, and whatever copyright holders are
>> necessary.
>>
>> [...]
>> 
>> But, if you had to have multiple lines, then just wrap the existing
>> notice.  Don't turn it into some kind of revision history.  Just list
>> one year range and whatever list of entities you feel compelled to
>> list.  That is the proper way to do a notice.

> No sir, it isn't.

> Look anywhere outside the Gentoo tree. For that matter, take the Linux
> kernel, or even in the systemd source, there are several places with
> multiple copyright notices in them.

Are these the only arguments you have?

To say it again, ebuilds have a copyright notice for exactly two
reasons:

- to protect us against the "innocent infringement" defense under
U.S. law, and

- because the GPL-2 requires in section 1 to "appropriately publish
on each copy an appropriate copyright notice".

For both of these, it is irrelevant what the precise contents of the
notice is. If you made a significant contribution to the file, then you
can claim copyright for it, even if there is no copyright notice at all,
of if you aren't mentioned in it.

IANAL, but I think the case for being listed there explicitly is very
weak.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Raymond Jennings]

[-- Attachment #1: Type: text/plain, Size: 3062 bytes --]

On Wed, Nov 14, 2018 at 12:24 AM Ulrich Mueller <ulm@gentoo.org> wrote:

> >>>>> On Wed, 14 Nov 2018, William Hubbs wrote:
>
> > On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:
> >> So, the purpose of allowing specific copyright holders to be named
> >> was to cover cases where we're forking foreign code, not to basically
> >> introduce a variant on the BSD advertising clause. IMO people who are
> >> only willing to contribute FOSS if their name gets put in a prominent
> >> location might do better to contribute elsewhere.
>
> +1000
>
> Maybe the policy for the Gentoo repository should just say that, namely
> that traditional copyright notices are only allowed for imported foreign
> code. Anything committed directly to the repository and any update of an
> existing file would be required to carry the simplified "Gentoo Authors"
> copyright notice, without any exceptions allowed.
>
> Can someone come up with a good wording for this?


In my opinion the best wording belongs in python as a check in repoman and
the qa scripts monitoring PRs on github ;).


> > Do you feel this way about corporations as well? Do you think the
> > Linux kernel maintainers should go and rip out all copyright notices
> > other than Linus Torvalds and maybe the Linux Foundation?
>
> Why would corporations be different from individual authors? Under the
> legislation here, corporations cannot even hold copyright (or rather,
> Urheberrecht) of a work.
>
> >> The purpose of a copyright notice is to declare that the file is
> >> copyrighted, and that is it.
>
> Exactly.
>
> >> It isn't a comprehensive list of everybody who holds a copyright on
> >> the file.
> >>
> >> It isn't a revision history.
> >>
> >> There is no need to list various mixes of years and authors.  Just
> >> list the first and last year, and whatever copyright holders are
> >> necessary.
> >>
> >> [...]
> >>
> >> But, if you had to have multiple lines, then just wrap the existing
> >> notice.  Don't turn it into some kind of revision history.  Just list
> >> one year range and whatever list of entities you feel compelled to
> >> list.  That is the proper way to do a notice.
>
> > No sir, it isn't.
>
> > Look anywhere outside the Gentoo tree. For that matter, take the Linux
> > kernel, or even in the systemd source, there are several places with
> > multiple copyright notices in them.
>
> Are these the only arguments you have?
>
> To say it again, ebuilds have a copyright notice for exactly two
> reasons:
>
> - to protect us against the "innocent infringement" defense under
> U.S. law, and
>
> - because the GPL-2 requires in section 1 to "appropriately publish
> on each copy an appropriate copyright notice".
>
> For both of these, it is irrelevant what the precise contents of the
> notice is. If you made a significant contribution to the file, then you
> can claim copyright for it, even if there is no copyright notice at all,
> of if you aren't mentioned in it.
>
> IANAL, but I think the case for being listed there explicitly is very
> weak.
>
> Ulrich
>

[-- Attachment #2: Type: text/html, Size: 3907 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Patrick McLean]

On Wed, 14 Nov 2018 09:24:08 +0100
Ulrich Mueller <ulm@gentoo.org> wrote:

> >>>>> On Wed, 14 Nov 2018, William Hubbs wrote:  
> 
> > On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:  
> >> So, the purpose of allowing specific copyright holders to be named
> >> was to cover cases where we're forking foreign code, not to
> >> basically introduce a variant on the BSD advertising clause. IMO
> >> people who are only willing to contribute FOSS if their name gets
> >> put in a prominent location might do better to contribute
> >> elsewhere.  
> 
> +1000
> 
> Maybe the policy for the Gentoo repository should just say that,
> namely that traditional copyright notices are only allowed for
> imported foreign code. Anything committed directly to the repository
> and any update of an existing file would be required to carry the
> simplified "Gentoo Authors" copyright notice, without any exceptions
> allowed.

So if SIE employees set up an official overlay, publish there first and
then "import" them to the tree it would pass that metric. That seems
like a silly extra step.

> 
> > Do you feel this way about corporations as well? Do you think the
> > Linux kernel maintainers should go and rip out all copyright notices
> > other than Linus Torvalds and maybe the Linux Foundation?  
> 
> Why would corporations be different from individual authors? Under the
> legislation here, corporations cannot even hold copyright (or rather,
> Urheberrecht) of a work.

AFAIK that is not common in legal systems, certainly in the US (where
the Gentoo Foundation is based) copyrights can be held by any legal
entity, including a corporation or a nonprofit.

> >> The purpose of a copyright notice is to declare that the file is
> >> copyrighted, and that is it.  

It is also to declare who owns the copyright, if it is to declare
simply that is is copyrighted, then one could add packages with the
text "Copyright 1999-2018" without any owner at all.

> >> It isn't a comprehensive list of everybody who holds a copyright on
> >> the file.
> >> 

No it's not meant to be, it's a list of entities who hold copyright on
a file and want to be listed, this is different. I am not aware of any
open source project with a policy against copyright headers, or
different headers other than ones with copyright attribution. If you
are aware of such a project, please link the policy.

> >> It isn't a revision history.

And it is not meant to be.

> >> But, if you had to have multiple lines, then just wrap the existing
> >> notice.  Don't turn it into some kind of revision history.  Just
> >> list one year range and whatever list of entities you feel
> >> compelled to list.  That is the proper way to do a notice.  
> 
> > No sir, it isn't.  
> 
> > Look anywhere outside the Gentoo tree. For that matter, take the
> > Linux kernel, or even in the systemd source, there are several
> > places with multiple copyright notices in them.  
> 
> Are these the only arguments you have?
> 
> To say it again, ebuilds have a copyright notice for exactly two
> reasons:
> 
> - to protect us against the "innocent infringement" defense under
> U.S. law, and
> 
> - because the GPL-2 requires in section 1 to "appropriately publish
> on each copy an appropriate copyright notice".
> 
> For both of these, it is irrelevant what the precise contents of the
> notice is. If you made a significant contribution to the file, then
> you can claim copyright for it, even if there is no copyright notice
> at all, of if you aren't mentioned in it.
>
> IANAL, but I think the case for being listed there explicitly is very
> weak.

Is accepting contributions form entities that require it a good
argument? Is this really worth losing valuable contributions over?

Please explain why this is a major issue worth this level of
discussion? Are a few lines at the top of the ebuild that can be easily
ignored or hidden by editors such a huge issue that you do not want to
accept any contributions that include it? Is this worth losing
developers and contributions over?

Re: [gentoo-project] rfc: copyright attribution clarifications

[Patrick McLean]

On Wed, 14 Nov 2018 11:47:39 -0800
Patrick McLean <chutzpah@gentoo.org> wrote:

> On Wed, 14 Nov 2018 09:24:08 +0100
> Ulrich Mueller <ulm@gentoo.org> wrote:
> 
> > >>>>> On Wed, 14 Nov 2018, William Hubbs wrote:    
> >   
> > > On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:    
> > >> So, the purpose of allowing specific copyright holders to be
> > >> named was to cover cases where we're forking foreign code, not to
> > >> basically introduce a variant on the BSD advertising clause. IMO
> > >> people who are only willing to contribute FOSS if their name gets
> > >> put in a prominent location might do better to contribute
> > >> elsewhere.    
> > 
> > +1000
> > 
> > Maybe the policy for the Gentoo repository should just say that,
> > namely that traditional copyright notices are only allowed for
> > imported foreign code. Anything committed directly to the repository
> > and any update of an existing file would be required to carry the
> > simplified "Gentoo Authors" copyright notice, without any exceptions
> > allowed.  
> 
> So if SIE employees set up an official overlay, publish there first
> and then "import" them to the tree it would pass that metric. That
> seems like a silly extra step.
> 
> >   
> > > Do you feel this way about corporations as well? Do you think the
> > > Linux kernel maintainers should go and rip out all copyright
> > > notices other than Linus Torvalds and maybe the Linux
> > > Foundation?    
> > 
> > Why would corporations be different from individual authors? Under
> > the legislation here, corporations cannot even hold copyright (or
> > rather, Urheberrecht) of a work.  
> 
> AFAIK that is not common in legal systems, certainly in the US (where
> the Gentoo Foundation is based) copyrights can be held by any legal
> entity, including a corporation or a nonprofit.
> 
> > >> The purpose of a copyright notice is to declare that the file is
> > >> copyrighted, and that is it.    
> 
> It is also to declare who owns the copyright, if it is to declare
> simply that is is copyrighted, then one could add packages with the
> text "Copyright 1999-2018" without any owner at all.
> 
> > >> It isn't a comprehensive list of everybody who holds a copyright
> > >> on the file.
> > >>   
> 
> No it's not meant to be, it's a list of entities who hold copyright on
> a file and want to be listed, this is different. I am not aware of any
> open source project with a policy against copyright headers, or
> different headers other than ones with copyright attribution. If you
> are aware of such a project, please link the policy.
> 
> > >> It isn't a revision history.  
> 
> And it is not meant to be.
> 
> > >> But, if you had to have multiple lines, then just wrap the
> > >> existing notice.  Don't turn it into some kind of revision
> > >> history.  Just list one year range and whatever list of entities
> > >> you feel compelled to list.  That is the proper way to do a
> > >> notice.    
> >   
> > > No sir, it isn't.    
> >   
> > > Look anywhere outside the Gentoo tree. For that matter, take the
> > > Linux kernel, or even in the systemd source, there are several
> > > places with multiple copyright notices in them.    
> > 
> > Are these the only arguments you have?
> > 
> > To say it again, ebuilds have a copyright notice for exactly two
> > reasons:
> > 
> > - to protect us against the "innocent infringement" defense under
> > U.S. law, and
> > 
> > - because the GPL-2 requires in section 1 to "appropriately publish
> > on each copy an appropriate copyright notice".
> > 
> > For both of these, it is irrelevant what the precise contents of the
> > notice is. If you made a significant contribution to the file, then
> > you can claim copyright for it, even if there is no copyright notice
> > at all, of if you aren't mentioned in it.
> >
> > IANAL, but I think the case for being listed there explicitly is
> > very weak.  
> 
> Is accepting contributions form entities that require it a good
> argument? Is this really worth losing valuable contributions over?
> 
> Please explain why this is a major issue worth this level of
> discussion? Are a few lines at the top of the ebuild that can be
> easily ignored or hidden by editors such a huge issue that you do not
> want to accept any contributions that include it? Is this worth losing
> developers and contributions over?

I think one of the fundamental questions we have to ask ourselves is
whether we want to encourage or discourage companies from allowing
their employees to contribute to Gentoo on work time.

A lot of developers have left the project because they no longer had
the free time to contribute, having paid contributors can help
drastically with this, I don't understand why we would want to
discourage this. Is avoiding a few extra lines (or characters in
existing lines) in some small percentage of ebuilds worth losing the
contributions from developers working on Gentoo on work time?

Re: [gentoo-project] rfc: copyright attribution clarifications

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 1651 bytes --]

Hi,

I don't like playing the "work" card. I guess most of us are somehow
employed -- saying we need this *change* or we would risk to discourage
companies from allowing their employees to contribute to Gentoo on work
time must feel like a slap in the face:

Nobody had a problem with that before.

There's just *one* contributor at the moment, SIE, who wants to change
things ("taking the opportunity to revise previous permission to enforce
something new").

I disagree saying that this is general problem and we are discourage
companies from contributing to Gentoo due to that.

I agree with Rich saying

> IMO people who are only willing to contribute FOSS if their name gets
> put in a prominent location might do better to contribute elsewhere.

...and even if you are unemployed or just contributing in your free time
your contribution has a value -- the same value like contributing during
work time! So if we start allowing copyright attribution we would have
to do that for *everyone*. Something I don't really want:

Ebuilds aren't like normal program code. Ebuilds are changing very
often. It will become a nightmare to track copyright to be able to
remove a line when this contributed code is no longer present and
therefore copyright attribution is no longer necessary nor correct.

It is also a question on its own if you can ever claim copyright for
things like ~1-10 lines of bash code (I guess we will never know because
nobody will ever go to court for 1-10 lines of bash code)...


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1810 bytes --]

On 11/15/18 2:38 PM, Thomas Deutschmann wrote:
> Hi,
> 
> I don't like playing the "work" card. I guess most of us are somehow
> employed -- saying we need this *change* or we would risk to discourage
> companies from allowing their employees to contribute to Gentoo on work
> time must feel like a slap in the face:
> 
> Nobody had a problem with that before.
> 
> There's just *one* contributor at the moment, SIE, who wants to change
> things ("taking the opportunity to revise previous permission to enforce
> something new").
> 
> I disagree saying that this is general problem and we are discourage
> companies from contributing to Gentoo due to that.
> 
> I agree with Rich saying
> 
>> IMO people who are only willing to contribute FOSS if their name gets
>> put in a prominent location might do better to contribute elsewhere.
> 
> ...and even if you are unemployed or just contributing in your free time
> your contribution has a value -- the same value like contributing during
> work time! So if we start allowing copyright attribution we would have
> to do that for *everyone*. Something I don't really want:
> 
> Ebuilds aren't like normal program code. Ebuilds are changing very
> often. It will become a nightmare to track copyright to be able to
> remove a line when this contributed code is no longer present and
> therefore copyright attribution is no longer necessary nor correct.
> 
> It is also a question on its own if you can ever claim copyright for
> things like ~1-10 lines of bash code (I guess we will never know because
> nobody will ever go to court for 1-10 lines of bash code)...
> 
> 

+1

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1216 bytes --]

>>>>> On Wed, 14 Nov 2018, Patrick McLean wrote:

> On Wed, 14 Nov 2018 09:24:08 +0100
> Ulrich Mueller <ulm@gentoo.org> wrote:

>> To say it again, ebuilds have a copyright notice for exactly two
>> reasons:
>> 
>> - to protect us against the "innocent infringement" defense under
>> U.S. law, and
>> 
>> - because the GPL-2 requires in section 1 to "appropriately publish
>> on each copy an appropriate copyright notice".
>> 
>> For both of these, it is irrelevant what the precise contents of the
>> notice is. If you made a significant contribution to the file, then
>> you can claim copyright for it, even if there is no copyright notice
>> at all, of if you aren't mentioned in it.
>> 
>> IANAL, but I think the case for being listed there explicitly is very
>> weak.

> Is accepting contributions form entities that require it a good
> argument? Is this really worth losing valuable contributions over?

*Why* would they require it? Is there any legal reason that I've
missed? In what way would an explicit copyright line help in a legal
dispute?

Also I still don't understand why "Gentoo Foundation" has worked for
you for many years, but "Gentoo Authors" does not.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1336 bytes --]

On Thu, Nov 15, 2018 at 07:49:37AM +0100, Ulrich Mueller wrote:
> >>>>> On Wed, 14 Nov 2018, Patrick McLean wrote:
> 
> > On Wed, 14 Nov 2018 09:24:08 +0100
> > Ulrich Mueller <ulm@gentoo.org> wrote:
> 
> >> To say it again, ebuilds have a copyright notice for exactly two
> >> reasons:
> >> 
> >> - to protect us against the "innocent infringement" defense under
> >> U.S. law, and
> >> 
> >> - because the GPL-2 requires in section 1 to "appropriately publish
> >> on each copy an appropriate copyright notice".
> >> 
> >> For both of these, it is irrelevant what the precise contents of the
> >> notice is. If you made a significant contribution to the file, then
> >> you can claim copyright for it, even if there is no copyright notice
> >> at all, of if you aren't mentioned in it.
> >> 
> >> IANAL, but I think the case for being listed there explicitly is very
> >> weak.
> 
> > Is accepting contributions form entities that require it a good
> > argument? Is this really worth losing valuable contributions over?
> 
> *Why* would they require it? Is there any legal reason that I've
> missed? In what way would an explicit copyright line help in a legal
> dispute?
 
Here is what the copyright office has to say about copyright notices:

https://www.copyright.gov/circs/circ03.pdf

William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 3211 bytes --]

>>>>> On Thu, 15 Nov 2018, William Hubbs wrote:

>> > On Wed, 14 Nov 2018 09:24:08 +0100
>> > Ulrich Mueller <ulm@gentoo.org> wrote:
>> 
>> >> To say it again, ebuilds have a copyright notice for exactly two
>> >> reasons:
>> >> 
>> >> - to protect us against the "innocent infringement" defense under
>> >> U.S. law, and
>> >> 
>> >> - because the GPL-2 requires in section 1 to "appropriately publish
>> >> on each copy an appropriate copyright notice".
>> >> 
>> >> For both of these, it is irrelevant what the precise contents of the
>> >> notice is. If you made a significant contribution to the file, then
>> >> you can claim copyright for it, even if there is no copyright notice
>> >> at all, of if you aren't mentioned in it.
>> >> 
>> >> IANAL, but I think the case for being listed there explicitly is very
>> >> weak.
 
> Here is what the copyright office has to say about copyright notices:

> https://www.copyright.gov/circs/circ03.pdf

In fact, I was already aware of that document.

| Copyright notice is optional for unpublished works, foreign works,
| or works published on or after March 1, 1989. When notice is optional,
| copyright owners can use any form of notice they wish.

All ebuilds have been published after 1989-03-01, so the copyright
notice is optional.

| Advantages to Using a Copyright Notice
| Although notice is optional for unpublished works, foreign works, or
| works published on or after March 1, 1989, using a copyright notice
| carries the following benefits:
| * Notice makes potential users aware that copyright is claimed in the
|   work.
| * In the case of a published work, a notice may prevent a defendant in
|   a copyright infringement action from attempting to limit his or her
|   liability for damages or injunctive relief based on an innocent
|   infringement defense.

That is basically what I've said in my first item above. The precise
contents of the notice is irrelevant for this, the only important point
is having any notice at all.

| * Notice identifies the copyright owner at the time the work was first
|   published for parties seeking permission to use the work.
| * Notice identifies the year of first publication, which may be used
|   to determine the term of copyright protection in the case of an
|   anonymous work, a pseudonymous work, or a work made for hire.
| * Notice may prevent the work from becoming an orphan work by
|   identifying the copyright owner and specifying the term of the
|   copyright.

For "indentifying the copyright owner" nothing short of a complete list
will suffice. Especially, a notice like the following (which mentions
only "Gentoo Authors" and "Sony Interactive Entertainment Inc.") does
not help with that at all (i.e., it is no better than the simplified
notice):
https://gitweb.gentoo.org/repo/gentoo.git/tree/sys-cluster/ceph/ceph-13.2.2-r2.ebuild?id=5f77c21f23bf1c4cfb9e68be7aa27669c8146e8e#n1

Besides, these last three items are pretty much moot for a work released
under the GPL-2 (which grants "permission to use"), and I think that
even you aren't suggesting that we should go for a complete list of
contributors.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1684 bytes --]

On Thu, Nov 15, 2018 at 06:50:52PM +0100, Ulrich Mueller wrote:
> | * Notice identifies the copyright owner at the time the work was first
> |   published for parties seeking permission to use the work.
> | * Notice identifies the year of first publication, which may be used
> |   to determine the term of copyright protection in the case of an
> |   anonymous work, a pseudonymous work, or a work made for hire.
> | * Notice may prevent the work from becoming an orphan work by
> |   identifying the copyright owner and specifying the term of the
> |   copyright.
> 
> For "indentifying the copyright owner" nothing short of a complete list
> will suffice. Especially, a notice like the following (which mentions
> only "Gentoo Authors" and "Sony Interactive Entertainment Inc.") does
> not help with that at all (i.e., it is no better than the simplified
> notice):
> https://gitweb.gentoo.org/repo/gentoo.git/tree/sys-cluster/ceph/ceph-13.2.2-r2.ebuild?id=5f77c21f23bf1c4cfb9e68be7aa27669c8146e8e#n1

Remember that in the US, SIE is a legal entity, so it can  hold
copyrights, just like a person can. It is like "Gentoo Foundation, Inc."

So, there would be two contributors in that ebuild: "Gentoo Authors"
and SIE.

> Besides, these last three items are pretty much moot for a work released
> under the GPL-2 (which grants "permission to use"), and I think that
> even you aren't suggesting that we should go for a complete list of
> contributors.

You are right, I'm not advocating for a complete list of contributors.
I'm just advocating for flexability where contributors want it, and SIE
is one of those contributors that wants it.

William

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[M. J. Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 1875 bytes --]

On 15/11/18 18:50, William Hubbs wrote:
> On Thu, Nov 15, 2018 at 06:50:52PM +0100, Ulrich Mueller wrote:
>> | * Notice identifies the copyright owner at the time the work was first
>> |   published for parties seeking permission to use the work.
>> | * Notice identifies the year of first publication, which may be used
>> |   to determine the term of copyright protection in the case of an
>> |   anonymous work, a pseudonymous work, or a work made for hire.
>> | * Notice may prevent the work from becoming an orphan work by
>> |   identifying the copyright owner and specifying the term of the
>> |   copyright.
>>
>> For "indentifying the copyright owner" nothing short of a complete list
>> will suffice. Especially, a notice like the following (which mentions
>> only "Gentoo Authors" and "Sony Interactive Entertainment Inc.") does
>> not help with that at all (i.e., it is no better than the simplified
>> notice):
>> https://gitweb.gentoo.org/repo/gentoo.git/tree/sys-cluster/ceph/ceph-13.2.2-r2.ebuild?id=5f77c21f23bf1c4cfb9e68be7aa27669c8146e8e#n1
> Remember that in the US, SIE is a legal entity, so it can  hold
> copyrights, just like a person can. It is like "Gentoo Foundation, Inc."
>
> So, there would be two contributors in that ebuild: "Gentoo Authors"
> and SIE.
>
>> Besides, these last three items are pretty much moot for a work released
>> under the GPL-2 (which grants "permission to use"), and I think that
>> even you aren't suggesting that we should go for a complete list of
>> contributors.
> You are right, I'm not advocating for a complete list of contributors.
> I'm just advocating for flexability where contributors want it, and SIE
> is one of those contributors that wants it.
>
> William
Could we not simply move copyright notices into the metadata.xml, and not
worry about the ebuild text itself?!


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 2356 bytes --]

On Thu, 15 Nov 2018 21:31:21 +0000 M. J. Everitt wrote:
> On 15/11/18 18:50, William Hubbs wrote:
> > On Thu, Nov 15, 2018 at 06:50:52PM +0100, Ulrich Mueller wrote:
> >> | * Notice identifies the copyright owner at the time the work was first
> >> |   published for parties seeking permission to use the work.
> >> | * Notice identifies the year of first publication, which may be used
> >> |   to determine the term of copyright protection in the case of an
> >> |   anonymous work, a pseudonymous work, or a work made for hire.
> >> | * Notice may prevent the work from becoming an orphan work by
> >> |   identifying the copyright owner and specifying the term of the
> >> |   copyright.
> >>
> >> For "indentifying the copyright owner" nothing short of a complete list
> >> will suffice. Especially, a notice like the following (which mentions
> >> only "Gentoo Authors" and "Sony Interactive Entertainment Inc.") does
> >> not help with that at all (i.e., it is no better than the simplified
> >> notice):
> >> https://gitweb.gentoo.org/repo/gentoo.git/tree/sys-cluster/ceph/ceph-13.2.2-r2.ebuild?id=5f77c21f23bf1c4cfb9e68be7aa27669c8146e8e#n1
> > Remember that in the US, SIE is a legal entity, so it can  hold
> > copyrights, just like a person can. It is like "Gentoo Foundation, Inc."
> >
> > So, there would be two contributors in that ebuild: "Gentoo Authors"
> > and SIE.
> >
> >> Besides, these last three items are pretty much moot for a work released
> >> under the GPL-2 (which grants "permission to use"), and I think that
> >> even you aren't suggesting that we should go for a complete list of
> >> contributors.
> > You are right, I'm not advocating for a complete list of contributors.
> > I'm just advocating for flexability where contributors want it, and SIE
> > is one of those contributors that wants it.
> >
> > William
> Could we not simply move copyright notices into the metadata.xml, and not
> worry about the ebuild text itself?!

No, because Gentoo is used worldwide. Just for example: in Russia
file without copyright notices is considered proprietary (not
public domain! project wide license may help though in some cases)
and removal of copyright notices without author's agreement is a
felony except for court decision or expiration reasons.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 2077 bytes --]

>>>>> On Thu, 15 Nov 2018, William Hubbs wrote:

> On Thu, Nov 15, 2018 at 06:50:52PM +0100, Ulrich Mueller wrote:
>> | * Notice identifies the copyright owner at the time the work was
>> |   first published for parties seeking permission to use the work.
>> | * Notice identifies the year of first publication, which may be
>> |   used to determine the term of copyright protection in the case of
>> |   an anonymous work, a pseudonymous work, or a work made for hire.
>> | * Notice may prevent the work from becoming an orphan work by
>> |   identifying the copyright owner and specifying the term of the
>> |   copyright.
>> 
>> For "indentifying the copyright owner" nothing short of a complete
>> list will suffice. Especially, a notice like the following (which
>> mentions only "Gentoo Authors" and "Sony Interactive Entertainment
>> Inc.") does not help with that at all (i.e., it is no better than the
>> simplified notice):
>> https://gitweb.gentoo.org/repo/gentoo.git/tree/sys-cluster/ceph/ceph-13.2.2-r2.ebuild?id=5f77c21f23bf1c4cfb9e68be7aa27669c8146e8e#n1

> Remember that in the US, SIE is a legal entity, so it can  hold
> copyrights, just like a person can. It is like "Gentoo Foundation,
> Inc."

> So, there would be two contributors in that ebuild: "Gentoo Authors"
> and SIE.

There are many more contributors that aren't listed. Therefore
indentifying the copyright owners is not possible without looking into
the git log. And in practice identifying them won't help much, because
you'd still need their contact information which may be difficult to
obtain. (For example, if we wanted to relicense the tree to GPL-2
*or later*, I'd expect that contacting all contributors or their heirs
would be close to impossible.)

However, I don't say that we should even aim for the above three items
from the copyright office's document. The point is that "Gentoo Authors"
alone is sufficient to protect against the "innocent infringement"
defense, and mentioning any contributor in addition does not add any
value.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Tue, Nov 13, 2018 at 6:46 PM William Hubbs <williamh@gentoo.org> wrote:
>
> On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:
> > On Tue, Nov 13, 2018 at 10:32 AM William Hubbs <williamh@gentoo.org> wrote:
> > >
> > > Since we do not do copyright assignment any more and the glep allows for
> > > traditional attribution, if some entity
> > > (company, person etc) has a desire for a copyright notice in
> > > their work, the case for not allowing this is very weak at best, so we will
> > > end up with more and more ebuilds that want to use traditional copyright
> > > attribution, and once an ebuild is switched over, it is problematic to
> > > switch back.
> >
> > So, the purpose of allowing specific copyright holders to be named was
> > to cover cases where we're forking foreign code, not to basically
> > introduce a variant on the BSD advertising clause.  IMO people who are
> > only willing to contribute FOSS if their name gets put in a prominent
> > location might do better to contribute elsewhere.
>
> Do you feel this way about corporations as well? Do you think the Linux
> kernel maintainers should go and rip out all copyright notices other
> than Linus Torvalds and maybe the Linux Foundation?

Give me an example of a Linux kernel source file that contains a
multiline table of years and copyright holders.  At best you'll find
random notices scattered around files in my experience, mostly because
of how the code was pulled in from outside.

> >
> > > Multiple-lines would be much easier to maintain, and
> > > there is no cost performance wise for them.
> >
> > Except for spam in our files.
>
> And how does that affect performance?

I never claimed it did.  It is visual clutter.  Eyeballs willing to
maintain our ebuilds are far more scarce than CPU cycles.

And if we don't care about visual clutter, then why do we have repoman
warn about extraneous whitespace (as we should)?

>
> Look anywhere outside the Gentoo tree. For that matter, take the Linux
> kernel, or even in the systemd source, there are several places with
> multiple copyright notices in them.

Find me any project that organizes these into tables with years and
copyright holders at the top of the file consistently as a matter of
policy.  As far as I can tell the Linux project has no consistent
policy on this front, and systemd inherited numerous outside source
trees as its scope expanded.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 2559 bytes --]

On Wed, 14 Nov 2018 07:50:48 -0800 Rich Freeman wrote:
> On Tue, Nov 13, 2018 at 6:46 PM William Hubbs <williamh@gentoo.org> wrote:
> >
> > On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:
> > > On Tue, Nov 13, 2018 at 10:32 AM William Hubbs <williamh@gentoo.org> wrote:
> > > >
> > > > Since we do not do copyright assignment any more and the glep allows for
> > > > traditional attribution, if some entity
> > > > (company, person etc) has a desire for a copyright notice in
> > > > their work, the case for not allowing this is very weak at best, so we will
> > > > end up with more and more ebuilds that want to use traditional copyright
> > > > attribution, and once an ebuild is switched over, it is problematic to
> > > > switch back.
> > >
> > > So, the purpose of allowing specific copyright holders to be named was
> > > to cover cases where we're forking foreign code, not to basically
> > > introduce a variant on the BSD advertising clause.  IMO people who are
> > > only willing to contribute FOSS if their name gets put in a prominent
> > > location might do better to contribute elsewhere.
> >
> > Do you feel this way about corporations as well? Do you think the Linux
> > kernel maintainers should go and rip out all copyright notices other
> > than Linus Torvalds and maybe the Linux Foundation?
> 
> Give me an example of a Linux kernel source file that contains a
> multiline table of years and copyright holders.  At best you'll find
> random notices scattered around files in my experience, mostly because
> of how the code was pulled in from outside.

Sure, from line 4 to line 10:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/char/random.c

Multiline table with copyright holders and separate years for each
one.

> > Look anywhere outside the Gentoo tree. For that matter, take the Linux
> > kernel, or even in the systemd source, there are several places with
> > multiple copyright notices in them.
> 
> Find me any project that organizes these into tables with years and
> copyright holders at the top of the file consistently as a matter of
> policy.  As far as I can tell the Linux project has no consistent
> policy on this front, and systemd inherited numerous outside source
> trees as its scope expanded.

We are not talking about demanding multiline headers for each
ebuild, we are talking about a policy allowing such headers if
necessary. This is the essentially same as Linux kernel does.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Wed, Nov 14, 2018 at 6:45 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
>
> On Wed, 14 Nov 2018 07:50:48 -0800 Rich Freeman wrote:
> > On Tue, Nov 13, 2018 at 6:46 PM William Hubbs <williamh@gentoo.org> wrote:
> > >
> > > On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:
> > > > On Tue, Nov 13, 2018 at 10:32 AM William Hubbs <williamh@gentoo.org> wrote:
> > > > >
> >
> > Give me an example of a Linux kernel source file that contains a
> > multiline table of years and copyright holders.  At best you'll find
> > random notices scattered around files in my experience, mostly because
> > of how the code was pulled in from outside.
>
> Sure, from line 4 to line 10:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/char/random.c
>
> Multiline table with copyright holders and separate years for each
> one.

Sure, now look at the very next file in the same directory:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/char/raw.c

No copyright notice at all.

As I said, you'll find random notices scattered at various places.
Sometimes they are more consecutive than others, probably more due to
wherever they were borrowed from.

>
> > > Look anywhere outside the Gentoo tree. For that matter, take the Linux
> > > kernel, or even in the systemd source, there are several places with
> > > multiple copyright notices in them.
> >
> > Find me any project that organizes these into tables with years and
> > copyright holders at the top of the file consistently as a matter of
> > policy.  As far as I can tell the Linux project has no consistent
> > policy on this front, and systemd inherited numerous outside source
> > trees as its scope expanded.
>
> We are not talking about demanding multiline headers for each
> ebuild, we are talking about a policy allowing such headers if
> necessary. This is the essentially same as Linux kernel does.

The Linux kernel has no policy at all regarding copyright notices.
So, they allow anything and everything as far as I can tell.  Or, if
they apply any filters it is just at the individual committer level as
code trickles its way up.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 2630 bytes --]

On Wed, 14 Nov 2018 07:24:28 -0800 Rich Freeman wrote:
> On Wed, Nov 14, 2018 at 6:45 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
> >
> > On Wed, 14 Nov 2018 07:50:48 -0800 Rich Freeman wrote:
> > > On Tue, Nov 13, 2018 at 6:46 PM William Hubbs <williamh@gentoo.org> wrote:
> > > >
> > > > On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:
> > > > > On Tue, Nov 13, 2018 at 10:32 AM William Hubbs <williamh@gentoo.org> wrote:
> > > > > >
> > >
> > > Give me an example of a Linux kernel source file that contains a
> > > multiline table of years and copyright holders.  At best you'll find
> > > random notices scattered around files in my experience, mostly because
> > > of how the code was pulled in from outside.
> >
> > Sure, from line 4 to line 10:
> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/char/random.c
> >
> > Multiline table with copyright holders and separate years for each
> > one.
> 
> Sure, now look at the very next file in the same directory:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/char/raw.c
> 
> No copyright notice at all.

And there is nothing wrong with this. The point of my link was to
prove that multiline copyright notices are used in well known
projects.

> > > > Look anywhere outside the Gentoo tree. For that matter, take the Linux
> > > > kernel, or even in the systemd source, there are several places with
> > > > multiple copyright notices in them.
> > >
> > > Find me any project that organizes these into tables with years and
> > > copyright holders at the top of the file consistently as a matter of
> > > policy.  As far as I can tell the Linux project has no consistent
> > > policy on this front, and systemd inherited numerous outside source
> > > trees as its scope expanded.
> >
> > We are not talking about demanding multiline headers for each
> > ebuild, we are talking about a policy allowing such headers if
> > necessary. This is the essentially same as Linux kernel does.
> 
> The Linux kernel has no policy at all regarding copyright notices.
> So, they allow anything and everything as far as I can tell.  Or, if
> they apply any filters it is just at the individual committer level as
> code trickles its way up.

It doesn't matter if they have a written policy or not. It is
matter that such headers are allowed.

And please show me the FOSS project other than Gentoo or its
derivatives which requires single line copyright header and
explicitly forbids multiline copyright notices.


Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Sarah White]

[-- Attachment #1.1: Type: text/plain, Size: 3291 bytes --]

On 11/14/18 10:53 AM, Andrew Savchenko wrote:
> On Wed, 14 Nov 2018 07:24:28 -0800 Rich Freeman wrote:
>> On Wed, Nov 14, 2018 at 6:45 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
>>>
>>> On Wed, 14 Nov 2018 07:50:48 -0800 Rich Freeman wrote:
>>>> On Tue, Nov 13, 2018 at 6:46 PM William Hubbs <williamh@gentoo.org> wrote:
>>>>>
>>>>> On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:
>>>>>> On Tue, Nov 13, 2018 at 10:32 AM William Hubbs <williamh@gentoo.org> wrote:
>>>>>>>
>>>>
>>>> Give me an example of a Linux kernel source file that contains a
>>>> multiline table of years and copyright holders.  At best you'll find
>>>> random notices scattered around files in my experience, mostly because
>>>> of how the code was pulled in from outside.
>>>
>>> Sure, from line 4 to line 10:
>>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/char/random.c
>>>
>>> Multiline table with copyright holders and separate years for each
>>> one.
>>
>> Sure, now look at the very next file in the same directory:
>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/char/raw.c
>>
>> No copyright notice at all.
> 
> And there is nothing wrong with this. The point of my link was to
> prove that multiline copyright notices are used in well known
> projects.
> 
>>>>> Look anywhere outside the Gentoo tree. For that matter, take the Linux
>>>>> kernel, or even in the systemd source, there are several places with
>>>>> multiple copyright notices in them.
>>>>
>>>> Find me any project that organizes these into tables with years and
>>>> copyright holders at the top of the file consistently as a matter of
>>>> policy.  As far as I can tell the Linux project has no consistent
>>>> policy on this front, and systemd inherited numerous outside source
>>>> trees as its scope expanded.
>>>
>>> We are not talking about demanding multiline headers for each
>>> ebuild, we are talking about a policy allowing such headers if
>>> necessary. This is the essentially same as Linux kernel does.
>>
>> The Linux kernel has no policy at all regarding copyright notices.
>> So, they allow anything and everything as far as I can tell.  Or, if
>> they apply any filters it is just at the individual committer level as
>> code trickles its way up.
> 
> It doesn't matter if they have a written policy or not. It is
> matter that such headers are allowed.
> 
> And please show me the FOSS project other than Gentoo or its
> derivatives which requires single line copyright header and
> explicitly forbids multiline copyright notices.
> 
> 
> Best regards,
> Andrew Savchenko
> 

I can't name any explicitly forbid multiline copyright.

for FOSS/Libre projects, I think it's a gentoo-ism, but
that's specifically in FOSS/Libre. for proprietary and
"work for hire" where the development is done under the
direction of a formal entity [business?], it's far more
common, and I think it wouldn't take 5 minutes to find
examples of those policies (but only corporate stuff)

it comes down to, I think - does gentoo wish to own
everything and hold copyright? that's much easier to
accept if the contributors are under contract and are
employed by gentoo.

-- kuza


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Fri, Nov 23, 2018 at 2:21 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>
> it comes down to, I think - does gentoo wish to own
> everything and hold copyright? that's much easier to
> accept if the contributors are under contract and are
> employed by gentoo.
>

Nobody is suggesting that multiple copyright owners shouldn't be
allowed.  Merely that multiple copyright owners shouldn't be named in
the copyright notice.

A proper copyright notice must name one or more owners, but you don't
have to list all the owners in a proper notice, and you don't have to
be listed in a notice to own a copyright on something.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Sarah White]

On 11/23/18 2:46 PM, Rich Freeman wrote:
> On Fri, Nov 23, 2018 at 2:21 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>>
>> it comes down to, I think - does gentoo wish to own
>> everything and hold copyright? that's much easier to
>> accept if the contributors are under contract and are
>> employed by gentoo.
>>
> 
> Nobody is suggesting that multiple copyright owners shouldn't be
> allowed.  Merely that multiple copyright owners shouldn't be named in
> the copyright notice.

The interest in removing or discouraging a more verbose,
explicit copyright notice would suggest the only legitimate
interest should be assumed to be in "gentoo authors", and
for no other entity(s) or person(s) need have any stake
in having a well-structured copyright notice (any format)

> A proper copyright notice must name one or more owners, but you don't
> have to list all the owners in a proper notice, and you don't have to
> be listed in a notice to own a copyright on something.
> 

It depends. It is not proper to remove an otherwise valid
copyright notice (though it's likely proper / "good enough"
if a simplified attribution of the form "gentoo authors"
is used instead - that's fine on an opt-in basis)

Either way: multiline copyright notices are legally valid,
or is that meant to be disputed? I'm not clear on the
intent for this comment:

["...don't have to be listed in a notice"]

-- kuza

Re: [gentoo-project] rfc: copyright attribution clarifications

[Ian Stakenvicius]

[-- Attachment #1.1: Type: text/plain, Size: 295 bytes --]

On 2018-11-23 3:23 p.m., Sarah White wrote:

> 
> Either way: multiline copyright notices are legally valid,
> or is that meant to be disputed? I'm not clear on the
> intent for this comment:
> 
> ["...don't have to be listed in a notice"]
> 

legal validity != legal requirement



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Sarah White]

[-- Attachment #1.1: Type: text/plain, Size: 1110 bytes --]

On 11/23/18 3:25 PM, Ian Stakenvicius wrote:
> On 2018-11-23 3:23 p.m., Sarah White wrote:
> 
>>
>> Either way: multiline copyright notices are legally valid,
>> or is that meant to be disputed? I'm not clear on the
>> intent for this comment:
>>
>> ["...don't have to be listed in a notice"]
>>
> 
> legal validity != legal requirement
> 
> 

Sure. You're not wrong.

You've left out the other section which starts:

["The interest in removing or discouraging..."]

What's the purpose of removing or discouraging
something which doesn't harm gentoo, but rather,
helps get more support from: ["contributors who
are in a situation where a contract may require a
copyright notice for anything done on-the-clock"]

... and/or other harmless reasons.

The intent / reasoning for removal or prohibition
of a multiline copyright notice has tenuous footing,
and worries me that nobody in this thread has made
a stronger argument than: ["we're not required by any
law to allow a different copyright notice, so we'll
require it to be a gentoo authors copyright notice."]

-- kuza


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1609 bytes --]

On Fri, Nov 23, 2018 at 03:40:01PM -0500, Sarah White wrote:
> On 11/23/18 3:25 PM, Ian Stakenvicius wrote:
> > On 2018-11-23 3:23 p.m., Sarah White wrote:
> > 
> >>
> >> Either way: multiline copyright notices are legally valid,
> >> or is that meant to be disputed? I'm not clear on the
> >> intent for this comment:
> >>
> >> ["...don't have to be listed in a notice"]
> >>
> > 
> > legal validity != legal requirement
> > 
> > 
> 
> Sure. You're not wrong.
> 
> You've left out the other section which starts:
> 
> ["The interest in removing or discouraging..."]
> 
> What's the purpose of removing or discouraging
> something which doesn't harm gentoo, but rather,
> helps get more support from: ["contributors who
> are in a situation where a contract may require a
> copyright notice for anything done on-the-clock"]
> 
> ... and/or other harmless reasons.
> 
> The intent / reasoning for removal or prohibition
> of a multiline copyright notice has tenuous footing,
> and worries me that nobody in this thread has made
> a stronger argument than: ["we're not required by any
> law to allow a different copyright notice, so we'll
> require it to be a gentoo authors copyright notice."]

This is  what concerns me as well. All of the folks in this thread who
want to forbid multiline copyright notices have yet to convince me that
there is a technical argument for doing so. If there is one, I'm willing
to be convinced, but that's not what I'm hearing.

For example, If there are really performance reasons, let's see the benchmarks
proving it.

William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Sarah White]

On 11/24/18 12:47 PM, William Hubbs wrote:
> On Fri, Nov 23, 2018 at 03:40:01PM -0500, Sarah White wrote:
>> On 11/23/18 3:25 PM, Ian Stakenvicius wrote:
>>> On 2018-11-23 3:23 p.m., Sarah White wrote:
>>>
>>>>
>>>> Either way: multiline copyright notices are legally valid,
>>>> or is that meant to be disputed? I'm not clear on the
>>>> intent for this comment:
>>>>
>>>> ["...don't have to be listed in a notice"]
>>>>
>>>
>>> legal validity != legal requirement
>>>
>>>
>>
>> Sure. You're not wrong.
>>
>> You've left out the other section which starts:
>>
>> ["The interest in removing or discouraging..."]
>>
>> What's the purpose of removing or discouraging
>> something which doesn't harm gentoo, but rather,
>> helps get more support from: ["contributors who
>> are in a situation where a contract may require a
>> copyright notice for anything done on-the-clock"]
>>
>> ... and/or other harmless reasons.
>>
>> The intent / reasoning for removal or prohibition
>> of a multiline copyright notice has tenuous footing,
>> and worries me that nobody in this thread has made
>> a stronger argument than: ["we're not required by any
>> law to allow a different copyright notice, so we'll
>> require it to be a gentoo authors copyright notice."]
> 
> This is  what concerns me as well. All of the folks in this thread who
> want to forbid multiline copyright notices have yet to convince me that
> there is a technical argument for doing so. If there is one, I'm willing
> to be convinced, but that's not what I'm hearing.
> 
> For example, If there are really performance reasons, let's see the benchmarks
> proving it.
> 
> William
> 

Yeah, pretty much. The technical details are "simple, but not
neccessarily obvious", or something like that (not even sure I can
describe the issue concisely, so I'll try to move on with my point)

I figure this is a problem enough organizations have faced, by now
there's a few minds sharper than mine coming up with a way to implement
such things (re: layout for copyright / license metadata) like SPDX.

If anything, migrating to tooling / utilities / libraries which can
verify SPDX wasn't malformed could even save development time on the
gentoo side. It could be as simple as providing a set of example
templates for valid SPDX which has a "Gentoo Authors" copyright notice
(and any other required metadata - probably more or less is needed
depending on the project or license)

This way, anything which is valid SPDX and meets the technical
requirements shouldn't be difficult to parse, and the burden of
documenting and providing tools to validate the layout of a copyright
notice and license metadata is "free", in terms of development churn.

-- kuza

Re: [gentoo-project] rfc: copyright attribution clarifications

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 2940 bytes --]

On Sat, Nov 24, 2018 at 12:47 PM William Hubbs <williamh@gentoo.org> wrote:

> On Fri, Nov 23, 2018 at 03:40:01PM -0500, Sarah White wrote:
> > On 11/23/18 3:25 PM, Ian Stakenvicius wrote:
> > > On 2018-11-23 3:23 p.m., Sarah White wrote:
> > >
> > >>
> > >> Either way: multiline copyright notices are legally valid,
> > >> or is that meant to be disputed? I'm not clear on the
> > >> intent for this comment:
> > >>
> > >> ["...don't have to be listed in a notice"]
> > >>
> > >
> > > legal validity != legal requirement
> > >
> > >
> >
> > Sure. You're not wrong.
> >
> > You've left out the other section which starts:
> >
> > ["The interest in removing or discouraging..."]
> >
> > What's the purpose of removing or discouraging
> > something which doesn't harm gentoo, but rather,
> > helps get more support from: ["contributors who
> > are in a situation where a contract may require a
> > copyright notice for anything done on-the-clock"]
> >
> > ... and/or other harmless reasons.
> >
> > The intent / reasoning for removal or prohibition
> > of a multiline copyright notice has tenuous footing,
> > and worries me that nobody in this thread has made
> > a stronger argument than: ["we're not required by any
> > law to allow a different copyright notice, so we'll
> > require it to be a gentoo authors copyright notice."]
>
> This is  what concerns me as well. All of the folks in this thread who
> want to forbid multiline copyright notices have yet to convince me that
> there is a technical argument for doing so. If there is one, I'm willing
> to be convinced, but that's not what I'm hearing.


I don't believe the technical arguments have much basis; instead the
argument is about community and humanpower.

 - There is an argument (non technical) that files in the ebuild repository
should carry a copyright notice to signal that the content has a copyright.
 - A GLEP was written (glep76) to standardize what this should be. One of
the (unstated) goals of the GLEP is to avoid spending time managing the
copyright declarations; so it was decided to have 2 forms, the short form
("Gentoo Authors") and the traditional form (for when we import code and
cannot remove notices.)

The crux of the argument is about the maintenance of these copyright
notices; not about the bytes they occupy or the CPU time spend reading them.

 - When is it allowed to add extra notices?
 - When is it allowed to remove extra notices?

This is ultimately the problem I think we see with the SEI attribution. We
don't understand *why* Sony wants the notice there and because of that we
don't understand the answers to the above. What I want to avoid happening
is getting sued by Sony because the notices were added and then later
removed; but we have not received guidance on this and I think it blocks us
moving forward.

-A


>
> For example, If there are really performance reasons, let's see the
> benchmarks
> proving it.
>

> William
>
>

[-- Attachment #2: Type: text/html, Size: 4019 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Sat, Nov 24, 2018 at 2:41 PM Alec Warner <antarus@gentoo.org> wrote:
>
> On Sat, Nov 24, 2018 at 12:47 PM William Hubbs <williamh@gentoo.org> wrote:
>>
>> This is  what concerns me as well. All of the folks in this thread who
>> want to forbid multiline copyright notices have yet to convince me that
>> there is a technical argument for doing so.
>
> I don't believe the technical arguments have much basis; instead the argument is about community and humanpower.

I've yet to see any technical arguments.  I certainly haven't made any.

There is no technical reason to allow multi-line notices, and there is
no technical reason to forbid them.  This is entirely a non-technical
issue.

I think they should be forbidden for a number of non-technical reasons:

1.  They add clutter to ebuilds.  At the very least they should be put
at the bottom of ebuilds and not at the top, and anybody editing an
ebuild should be free to move a multiline notice to the bottom if they
see it at the top.

2.  It strikes me as being fairly anti-community.  Basically the
companies that give us the most trouble get to stick their names all
over ebuilds, while freely benefitting from hundreds of other ebuilds
that others have contributed without any care for sticking their names
on stuff.  Sony should be contributing because they want to
contribute, not to stick their names on things.  Or if they want to
sponsor us they should do so under the normal terms for doing so,
which generally involve more than contributing a couple of lines of
ebuild boilerplate.

3.  It opens up a slippery slope.  Once you say one person can stick
their names on something, how long until everybody and their uncle
starts doing it and an ebuild with a long history like glibc has three
pages of contributor names at the top (and IMO glibc is one of those
few ebuilds that actually seems non-trival)?

4.  The people digging in to try to force this policy have no interest
in participating in the Gentoo community, or actually advocating for
their position.  It seems that they simply consider their position
undebatable and expect us to just accept it because heaven forbid one
developer not be allowed to contribute during business hours, despite
many others having no issues with this at all since their employers
are more reasonable.

IMO Gentoo (and the members of its community) should be using this as
an opportunity to tarnish Sony's reputation, not bend over backwards
to cater to a random request of a company lawyer who seemingly isn't
interested in actually discussing their policy.  This isn't Sony
contributing to open source, this is Sony interfering with what has
basically been routine practice in the community for 15-20 years.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 5047 bytes --]

On Sat, Nov 24, 2018 at 3:12 PM Rich Freeman <rich0@gentoo.org> wrote:

> On Sat, Nov 24, 2018 at 2:41 PM Alec Warner <antarus@gentoo.org> wrote:
> >
> > On Sat, Nov 24, 2018 at 12:47 PM William Hubbs <williamh@gentoo.org>
> wrote:
> >>
> >> This is  what concerns me as well. All of the folks in this thread who
> >> want to forbid multiline copyright notices have yet to convince me that
> >> there is a technical argument for doing so.
> >
> > I don't believe the technical arguments have much basis; instead the
> argument is about community and humanpower.
>
> I've yet to see any technical arguments.  I certainly haven't made any.
>

There were definitely some made earlier in the discussion.


>
> There is no technical reason to allow multi-line notices, and there is
> no technical reason to forbid them.  This is entirely a non-technical
> issue.
>
> I think they should be forbidden for a number of non-technical reasons:
>
> 1.  They add clutter to ebuilds.  At the very least they should be put
> at the bottom of ebuilds and not at the top, and anybody editing an
> ebuild should be free to move a multiline notice to the bottom if they
> see it at the top.
>

So now you don't if the notices exist, as long as they are at the bottom of
the file? It seems inconsistent with the rest of your position ;)


>
> 2.  It strikes me as being fairly anti-community.  Basically the
> companies that give us the most trouble get to stick their names all
> over ebuilds, while freely benefitting from hundreds of other ebuilds
> that others have contributed without any care for sticking their names
> on stuff.  Sony should be contributing because they want to
> contribute, not to stick their names on things.  Or if they want to
> sponsor us they should do so under the normal terms for doing so,
> which generally involve more than contributing a couple of lines of
> ebuild boilerplate.
>

So this argument is basically; we don't understand why Sony wants to put
their name on the notice. In lieu of any facts, we will tell our own
narrative; anyone that causes trouble is a baddie; Sony is causing trouble,
therefore, Sony is 'anti-community', or 'name-grabbing' or whatever.


> 3.  It opens up a slippery slope.  Once you say one person can stick
> their names on something, how long until everybody and their uncle
> starts doing it and an ebuild with a long history like glibc has three
> pages of contributor names at the top (and IMO glibc is one of those
> few ebuilds that actually seems non-trival)?
>

I think you can easily look at other projects that let anyone stick their
name on anything to see what happens...I'm not sure this is a strong
argument against. These other projects seem fine and are not overflowing
with copyright notices.


>
> 4.  The people digging in to try to force this policy have no interest
> in participating in the Gentoo community, or actually advocating for
> their position.  It seems that they simply consider their position
> undebatable and expect us to just accept it because heaven forbid one
> developer not be allowed to contribute during business hours, despite
> many others having no issues with this at all since their employers
> are more reasonable.
>

I assert that you don't know anything about their reasons, their rationale,
their reasonableness or anything really. "People who have conflicts are
unreasonable" is really what I hear from this kind of speech and its not
really a great message to send.


>
> IMO Gentoo (and the members of its community) should be using this as
> an opportunity to tarnish Sony's reputation, not bend over backwards
> to cater to a random request of a company lawyer who seemingly isn't
> interested in actually discussing their policy.  This isn't Sony
> contributing to open source, this is Sony interfering with what has
> basically been routine practice in the community for 15-20 years.
>

I'm going to tell you the same thing I told Whissi on #-council

I think it is an entirely reasonable position to do the following:
 - Not accept the SEI notices because we do not understand the grounds on
which they are added.
 - Ask SEI for a rationale for what the notices are meant to convey, so we
can decide if we can support whatever that use case is; maybe its something
we didn't consider in the GLEP.

I don't think its reasonable to say they are mean shitheads; because the
fact is we don't know what they want to accomplish with the notices. My
concern is that they may later provide a reasonable use case for the
notices and the council will just say 'well that use case is stupid because
Sony is stupid'; because that is the message many members of the council
are currently communicating. Why would Sony even bother if the narrative is
the Council won't listen anyway? It looks like a waste of their time.

I think the above proposal puts the ball clearly in SEI's court; if they
want the notices accepted they can provide a memo detailing why. If they
don't care, they can drop the notices or stop committing.

-A


> --
> Rich
>
>

[-- Attachment #2: Type: text/html, Size: 6756 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Sat, Nov 24, 2018 at 3:32 PM Alec Warner <antarus@gentoo.org> wrote:
>
> On Sat, Nov 24, 2018 at 3:12 PM Rich Freeman <rich0@gentoo.org> wrote:
>>
>> 1.  They add clutter to ebuilds.  At the very least they should be put
>> at the bottom of ebuilds and not at the top, and anybody editing an
>> ebuild should be free to move a multiline notice to the bottom if they
>> see it at the top.
>
> So now you don't if the notices exist, as long as they are at the bottom of the file? It seems inconsistent with the rest of your position ;)

"At the very least" doesn't mean that I don't care.  It means that if
we can't live without this at least get them out of the way.
All-or-nothing is not the only way to have a reasonable discussion.

And as I go on, there are other reasons that have nothing to do with clutter.

>>
>> 2.  It strikes me as being fairly anti-community.  Basically the
>> companies that give us the most trouble get to stick their names all
>> over ebuilds, while freely benefitting from hundreds of other ebuilds
>> that others have contributed without any care for sticking their names
>> on stuff.  Sony should be contributing because they want to
>> contribute, not to stick their names on things.  Or if they want to
>> sponsor us they should do so under the normal terms for doing so,
>> which generally involve more than contributing a couple of lines of
>> ebuild boilerplate.
>
>
> So this argument is basically; we don't understand why Sony wants to put their name on the notice. In lieu of any facts, we will tell our own narrative; anyone that causes trouble is a baddie; Sony is causing trouble, therefore, Sony is 'anti-community', or 'name-grabbing' or whatever.

I didn't say that "Sony is anti-community" here (I do imply it more
later on).  I said that this policy is.  An organization can have a
policy that says that donations conditional on public acknowledgement
are not accepted, and that is not making a statement about the donors
themselves.  It is just a policy.

>>
>> 3.  It opens up a slippery slope.  Once you say one person can stick
>> their names on something, how long until everybody and their uncle
>> starts doing it and an ebuild with a long history like glibc has three
>> pages of contributor names at the top (and IMO glibc is one of those
>> few ebuilds that actually seems non-trival)?
>
> I think you can easily look at other projects that let anyone stick their name on anything to see what happens...I'm not sure this is a strong argument against. These other projects seem fine and are not overflowing with copyright notices.

Sure, but most projects have files containing thousands of lines of
code.  Sticking a few more lines in a header isn't as impactful there,
as I elaborated on in an earlier email.

A typical C file opens up with a stack of #include and #ifdef
statements, which isn't terribly important.  They're just more verbose
by their nature, and if you're looking at a C source file you're
probably looking in the middle of it.
A typical ebuild opens up with stuff like EAPI, KEYWORDS, IUSE,
SRC_URI, HOMEPAGE, which are some of the most important metadata in
the file.  Having this be easily readable is far more useful than a
page of preprocessor directives, IMO.  Most people looking at ebuilds
are pretty likely to be interested in the stuff at the very top more
than just about anything else.

>>
>> 4.  The people digging in to try to force this policy have no interest
>> in participating in the Gentoo community, or actually advocating for
>> their position.  It seems that they simply consider their position
>> undebatable and expect us to just accept it because heaven forbid one
>> developer not be allowed to contribute during business hours, despite
>> many others having no issues with this at all since their employers
>> are more reasonable.
>
> I assert that you don't know anything about their reasons, their rationale, their reasonableness or anything really. "People who have conflicts are unreasonable" is really what I hear from this kind of speech and its not really a great message to send.

I said they aren't interested in participating in the Gentoo
community. The fact that the lawyer who came up with this policy in
the first place isn't on the list tends to speak to that.  Granted,
they could be merely unaware that their request has made a stir.

I don't really have a problem with sending messages that companies
that want to set blanket policies without dialogue aren't very welcome
around here.  Having them refuse to participate would create less
churn.

>> IMO Gentoo (and the members of its community) should be using this as
>> an opportunity to tarnish Sony's reputation, not bend over backwards
>> to cater to a random request of a company lawyer who seemingly isn't
>> interested in actually discussing their policy.  This isn't Sony
>> contributing to open source, this is Sony interfering with what has
>> basically been routine practice in the community for 15-20 years.
>
> I think it is an entirely reasonable position to do the following:
>  - Not accept the SEI notices because we do not understand the grounds on which they are added.
>  - Ask SEI for a rationale for what the notices are meant to convey, so we can decide if we can support whatever that use case is; maybe its something we didn't consider in the GLEP.

That is reasonable.  Certainly it makes sense to consider rationales
if they're willing to supply them, though they should also be willing
to engage in dialogue with those who disagree in the hope of reaching
a compromise if necessary.

> I don't think its reasonable to say they are mean shitheads;

Then don't.  That doesn't prevent others from doing so.  If their goal
is to get positive PR by having their name in their contributions then
they should consider how they go about it, and so should their
representatives.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1598 bytes --]

>>>>> On Sat, 24 Nov 2018, Alec Warner wrote:

> I think it is an entirely reasonable position to do the following:
>  - Not accept the SEI notices because we do not understand the grounds on
> which they are added.
>  - Ask SEI for a rationale for what the notices are meant to convey, so we
> can decide if we can support whatever that use case is; maybe its something
> we didn't consider in the GLEP.

Hm, shall we make this an agenda item for the next Council meeting?

> I don't think its reasonable to say they are mean shitheads; because the
> fact is we don't know what they want to accomplish with the notices.
> My concern is that they may later provide a reasonable use case for the
> notices and the council will just say 'well that use case is stupid because
> Sony is stupid'; because that is the message many members of the council
> are currently communicating. Why would Sony even bother if the narrative is
> the Council won't listen anyway? It looks like a waste of their time.

In the first place, they should have raised their concerns while GLEP 76
was in the making, not after it went through the approval process with
Council and Trustees. Our proposed policy was posted on the mailing list
for review, even with several iterations. Plus, they were happy with a
single line notice before, so not accepting it any longer looks like an
arbitrary move.

> I think the above proposal puts the ball clearly in SEI's court; if they
> want the notices accepted they can provide a memo detailing why. If they
> don't care, they can drop the notices or stop committing.

+1

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 3016 bytes --]

On Mon, Nov 26, 2018 at 7:02 AM Ulrich Mueller <ulm@gentoo.org> wrote:

> >>>>> On Sat, 24 Nov 2018, Alec Warner wrote:
>
> > I think it is an entirely reasonable position to do the following:
> >  - Not accept the SEI notices because we do not understand the grounds on
> > which they are added.
> >  - Ask SEI for a rationale for what the notices are meant to convey, so
> we
> > can decide if we can support whatever that use case is; maybe its
> something
> > we didn't consider in the GLEP.
>
> Hm, shall we make this an agenda item for the next Council meeting?
>

I think if you will do nothing, developers will continue to add SEI
notices. If you don't want them to do that (and my understanding from
talking to the council is many do not want the notices) then I believe
action is necessary to block the notices[0]. I'm happy to add something to
the agenda.


>
> > I don't think its reasonable to say they are mean shitheads; because the
> > fact is we don't know what they want to accomplish with the notices.
> > My concern is that they may later provide a reasonable use case for the
> > notices and the council will just say 'well that use case is stupid
> because
> > Sony is stupid'; because that is the message many members of the council
> > are currently communicating. Why would Sony even bother if the narrative
> is
> > the Council won't listen anyway? It looks like a waste of their time.
>
> In the first place, they should have raised their concerns while GLEP 76
> was in the making, not after it went through the approval process with
> Council and Trustees. Our proposed policy was posted on the mailing list
> for review, even with several iterations. Plus, they were happy with a
> single line notice before, so not accepting it any longer looks like an
> arbitrary move.
>

I agree that having the company participate earlier in the process would
have improved things and this is something we should encourage. I'm not
sure its necessary to present the GLEP as some kind of immutable entity
though; we have a process to amend it and whatnot. However, I also want to
give the GLEP authors a break (I know many of you have been working on this
GLEP for more than a year) and this is why my intent is to put us in a
position where its up to Sony (and other companies) to drive the changes
they want. I think blocking the contributions is the stick to make that
happen.

-A

[0] There was another argument raised that we could accept the ebuilds with
the SEI Copyright notice at the top, then replace it later with "Gentoo
Authors and others" once edited by a non SEI employee. This wasn't
something I was keen on as a board member; but I think it comes back to
"Why exactly does Sony want the notices and can we meet those obligations
some other way."


> > I think the above proposal puts the ball clearly in SEI's court; if they
> > want the notices accepted they can provide a memo detailing why. If they
> > don't care, they can drop the notices or stop committing.
>
+1
>
> Ulrich
>

[-- Attachment #2: Type: text/html, Size: 3975 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Matt Turner]

On Sat, Nov 24, 2018 at 12:12 PM Rich Freeman <rich0@gentoo.org> wrote:
> IMO Gentoo (and the members of its community) should be using this as
> an opportunity to tarnish Sony's reputation, not bend over backwards
> to cater to a random request of a company lawyer who seemingly isn't
> interested in actually discussing their policy.  This isn't Sony
> contributing to open source, this is Sony interfering with what has
> basically been routine practice in the community for 15-20 years.

Absolutely unbelievable.

Sony is paying people to work on Gentoo. We should not use this as an
opportunity to tarnish their reputation or anyone else's for that
matter. What an absurd thing to even suggest.

Perhaps you should remove yourself from this conversation.

Re: [gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1189 bytes --]

On Sun, Nov 25, 2018 at 12:36:16PM -0800, Matt Turner wrote:
> On Sat, Nov 24, 2018 at 12:12 PM Rich Freeman <rich0@gentoo.org> wrote:
> > IMO Gentoo (and the members of its community) should be using this as
> > an opportunity to tarnish Sony's reputation, not bend over backwards
> > to cater to a random request of a company lawyer who seemingly isn't
> > interested in actually discussing their policy.  This isn't Sony
> > contributing to open source, this is Sony interfering with what has
> > basically been routine practice in the community for 15-20 years.
> 
> Absolutely unbelievable.
> 
> Sony is paying people to work on Gentoo. We should not use this as an
> opportunity to tarnish their reputation or anyone else's for that
> matter. What an absurd thing to even suggest.
> 
> Perhaps you should remove yourself from this conversation.

Rich,

Regardless of anything that is said in this thread, I do not agree, as
a council member, with the idea of the Gentoo community actively
tarnishing anyone's reputation.

I have added the proctors to this email, because I think they should
determine whether your behavior is a CoC violation.
 
 William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Sun, Nov 25, 2018 at 3:52 PM William Hubbs <williamh@gentoo.org> wrote:
>
> Regardless of anything that is said in this thread, I do not agree, as
> a council member, with the idea of the Gentoo community actively
> tarnishing anyone's reputation.
>
> I have added the proctors to this email, because I think they should
> determine whether your behavior is a CoC violation.
>

The opinions below are my own.

IMO advocating for what Gentoo should or shouldn't do isn't a CoC
violation.  I certainly haven't said anything intended to tarnish
Sony's reputation in the email above.

I do think that antarus's suggestion of leaving the policy as-is for
now and seeking further clarification from Sony as to why they feel it
is necessary to change it would be more constructive.

That said, I don't like the idea that corporations can basically
dictate policy changes under the threat of withdrawing contributions.
This has created a lot of churn mostly involving the most senior
members of the community, and a moderate amount of division.  While
one developer getting to spend a few hours per week on company time on
Gentoo commits is certainly helpful, many other companies seem to be
able to provide this to Gentoo without requiring policy changes, and
far more hours get donated by volunteers without any demands for
concessions.

I'll admit that my post was a bit emotional, and as such perhaps not a
great example for a dev to set.  However, I'm not sure that passive
acceptance of a change like this is going to be any less harmful to
Gentoo than active defiance.  These two are of course not the only
alternatives, and we should seek a better way.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1987 bytes --]

>>>>> On Sat, 24 Nov 2018, Alec Warner wrote:

> I don't believe the technical arguments have much basis; instead the
> argument is about community and humanpower.

>  - There is an argument (non technical) that files in the ebuild
> repository should carry a copyright notice to signal that the content
> has a copyright.
>  - A GLEP was written (glep76) to standardize what this should be. One
> of the (unstated) goals of the GLEP is to avoid spending time managing
> the copyright declarations; so it was decided to have 2 forms, the
> short form ("Gentoo Authors") and the traditional form (for when we
> import code and cannot remove notices.)

Exactly.

> The crux of the argument is about the maintenance of these copyright
> notices; not about the bytes they occupy or the CPU time spend reading
> them.

>  - When is it allowed to add extra notices?
>  - When is it allowed to remove extra notices?

> This is ultimately the problem I think we see with the SEI
> attribution. We don't understand *why* Sony wants the notice there and
> because of that we don't understand the answers to the above.

We don't understand it because they refuse to give us an explanation.
Which is not our fault.

> What I want to avoid happening is getting sued by Sony because the
> notices were added and then later removed; but we have not received
> guidance on this and I think it blocks us moving forward.

I don't see anything in the GPL-2 that would prevent us from removing
redundant copyright notices.

For example, the FDL-1.3 requires in section 4.D. to "Preserve all the
copyright notices of the Document", and the CC-BY-SA licenses contain
similar wording. However, such a clause can neither be found in the
GPL-2 nor in the GPL-3. In fact, the GPL-3 clarifies in section 7 that
it can be *supplemented* with terms "requiring preservation of specified
reasonable legal notices or author attributions", but the license itself
doesn't require this.

Disclaimer: IANAL, TINLA.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Sarah White]

On 11/24/18 6:11 PM, Ulrich Mueller wrote:
>>>>>> On Sat, 24 Nov 2018, Alec Warner wrote:
> 
>> The crux of the argument is about the maintenance of these copyright
>> notices; not about the bytes they occupy or the CPU time spend reading
>> them.
> 
>>  - When is it allowed to add extra notices?
>>  - When is it allowed to remove extra notices?
> 
>> This is ultimately the problem I think we see with the SEI
>> attribution. We don't understand *why* Sony wants the notice there and
>> because of that we don't understand the answers to the above.
> 
> We don't understand it because they refuse to give us an explanation.
> Which is not our fault.
> 
>> What I want to avoid happening is getting sued by Sony because the
>> notices were added and then later removed; but we have not received
>> guidance on this and I think it blocks us moving forward.
> 
> I don't see anything in the GPL-2 that would prevent us from removing
> redundant copyright notices.
> 

The better question - why should things be copyrighted,
and then made available under a FOSS/Libre license, and
why is this different than public domain without any
copyright protection of any kind?

---

On the topic of copyleft / copyright, as outlined by
the free software foundation... dot dot dot

https://www.gnu.org/philosophy/categories.html#FSF-CopyrightedGNUSoftware

["The developers of GNU packages can transfer the copyright
to the FSF, or they can keep it. The choice is theirs."]

["If they have transferred the copyright to the FSF, the
program is FSF-copyrighted GNU software, and the FSF can
enforce its license. If they have kept the copyright,
enforcing the license is their responsibility."]

["The FSF does not accept copyright assignments of
software that is not an official GNU package, as a rule."]

---

Does gentoo have a legal team or policy in place to protect
copyleft-type legal interests against license infringers?

I'm not aware of anyone in this thread (or related ones)
who is claiming gentoo should have copyright assignment,
and a gentoo copyright notice will have teeth behind it,
and if anyone infringes on FOSS/Libre licenses on anything
which has a gentoo copyright, then there will be a legal
response from the committee / project / team in charge of
looking after the FOSS/Libre interests of anything under
the umbrella of gentoo's copyrights. Then again...

One could argue gentoo hasn't pledged to defend the license
for FOSS/Libre code, and could end up being less effective
than letting the contributing company/entity/person decide
for themselves if they'd rather maintain their own teeth.

Toothless copyleft / copyright is as weak as public domain.

I believe if sony is committing to release something under
a FOSS/Libre/copyleft-type license, they should be able
to thow their own legal team behind it. I don't represent
sony, but I know that's my own intent since I know what my
own intentions are when I attach a copyleft-type license
to my own work.

-- kuza

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Sat, Nov 24, 2018 at 8:09 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>
> On 11/24/18 6:11 PM, Ulrich Mueller wrote:
> >
> > I don't see anything in the GPL-2 that would prevent us from removing
> > redundant copyright notices.
> >
>
> The better question - why should things be copyrighted,
> and then made available under a FOSS/Libre license, and
> why is this different than public domain without any
> copyright protection of any kind?

Nobody is talking about anybody giving up copyright protection.  We're
just talking about using one valid form of a copyright notice vs
another valid form of a copyright notice.  Giving notice is not the
same as owning copyright.

> Does gentoo have a legal team or policy in place to protect
> copyleft-type legal interests against license infringers?

That isn't relevant unless Gentoo owns the copyright, or an FLA-like
interest in it.

> I'm not aware of anyone in this thread (or related ones)
> who is claiming gentoo should have copyright assignment

Nope.  This has nothing to do with copyright assignment.  The new GLEP
does not transfer copyrights to Gentoo.

> and a gentoo copyright notice will have teeth behind it,

The "Gentoo Authors" copyright notice will have just as much teeth
behind it as putting "Sony" in the notice, if Sony owns the copyright.
Sony can still sue infringers.  You don't have to be named in the
copyright notice to sue for copyright infringement, and you gain all
the protections of giving notice even if you aren't the one named in
the notice.

> I believe if sony is committing to release something under
> a FOSS/Libre/copyleft-type license, they should be able
> to thow their own legal team behind it.

And they can with the GLEP as it exists now.  They receive no legal
benefits at all by being named in the copyright notice, and lose no
benefits by not being named in the notice, as long as the notice is
valid.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Sarah White]

On 11/24/18 8:37 PM, Rich Freeman wrote:
> On Sat, Nov 24, 2018 at 8:09 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>>
>> On 11/24/18 6:11 PM, Ulrich Mueller wrote:
>>>
>>> I don't see anything in the GPL-2 that would prevent us from removing
>>> redundant copyright notices.
>>>
>>
>> The better question - why should things be copyrighted,
>> and then made available under a FOSS/Libre license, and
>> why is this different than public domain without any
>> copyright protection of any kind?
> 

{...}

> 
>> I believe if sony is committing to release something under
>> a FOSS/Libre/copyleft-type license, they should be able
>> to thow their own legal team behind it.
> 
> And they can with the GLEP as it exists now.  They receive no legal
> benefits at all by being named in the copyright notice, and lose no
> benefits by not being named in the notice, as long as the notice is
> valid.
> 

Perhaps just a misunderstanding then.

So if it isn't meant to say that gentoo will be looking
after the legal aspects of a FOSS/Libre-copyleft licensed
package or document or tool, then what's the purpose to
put gentoo's name on it?

There's some innuendo and/or implication that copyright
holders who have their own name listed in a copyright
notice are intending to do something other than participate
in FOSS/Libre work, or perhaps may not truly wish to
contribute in good faith.

I really hope that's a misunderstanding, and discussing
further can clarify. Does gentoo have a legitimate reason
to substitute a gentoo copyright notice in place of an
otherwise valid notice?

Is there an intent to create a sort of gatekeeper role
within the gentoo organization to request documentation
if a contributor uses a non-gentoo copyright notice?

-- kuza

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Sat, Nov 24, 2018 at 9:04 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>
> On 11/24/18 8:37 PM, Rich Freeman wrote:
>
> So if it isn't meant to say that gentoo will be looking
> after the legal aspects of a FOSS/Libre-copyleft licensed
> package or document or tool, then what's the purpose to
> put gentoo's name on it?

You have to put somebody's name in the notice, and it was felt that
"Gentoo Authors" gets the job done.  "Gentoo Authors" is not Gentoo.
They are the authors contributing to the ebuild.

> There's some innuendo and/or implication that copyright
> holders who have their own name listed in a copyright
> notice are intending to do something other than participate
> in FOSS/Libre work, or perhaps may not truly wish to
> contribute in good faith.

Not at all.  The issue is that accumulating names creates clutter, and
create some sense that people who are named are doing more than people
who aren't named, which may lead to more people wanting to be named.

This is also why the policy allows for an AUTHORS file or use of a
VCS.  The intent isn't to deny people credit.  It is to provide credit
in a more reasonable manner vs having it spammed on the first lines of
every file in the tree, and try to create a culture where we don't
equate copyright notice with credit or property.

> Does gentoo have a legitimate reason
> to substitute a gentoo copyright notice in place of an
> otherwise valid notice?

The GLEP already allows existing works that have a non-Gentoo notice
to keep their notice and add "and others" if there are further
additions if they are brought into Gentoo from outside.  This doesn't
mean that we keep adding names to things.  This was intended for
things like eudev where we took an entire mature code body and forked
it.  This doesn't make as much sense for somebody contributing a 10
line ebuild to a repository containing thousands of ebuilds.

> Is there an intent to create a sort of gatekeeper role
> within the gentoo organization to request documentation
> if a contributor uses a non-gentoo copyright notice?

As the GLEP stands developers are already gatekeepers by virtue of
being the only ones with commit access, and being required to sign off
on the DCO.  This requires them to be aware of the copyright status of
the works they are committing, but we do not require the accumulation
of documentation.  However, the GLEP does not provide for multi-line
notices and the intent isn't to keep accumulating them over time.  The
intent was to be able to bring outside stuff in as-is as long as the
notices are reasonable and then just freeze them in time with "and
others" or simplify them with Gentoo Authors if appropriate.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Sarah White]

[-- Attachment #1.1: Type: text/plain, Size: 5061 bytes --]

On 11/24/18 9:22 PM, Rich Freeman wrote:
> On Sat, Nov 24, 2018 at 9:04 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>>
>> On 11/24/18 8:37 PM, Rich Freeman wrote:
>>
>> So if it isn't meant to say that gentoo will be looking
>> after the legal aspects of a FOSS/Libre-copyleft licensed
>> package or document or tool, then what's the purpose to
>> put gentoo's name on it?
> 
> You have to put somebody's name in the notice, and it was felt that
> "Gentoo Authors" gets the job done.  "Gentoo Authors" is not Gentoo.
> They are the authors contributing to the ebuild.
> 
>> There's some innuendo and/or implication that copyright
>> holders who have their own name listed in a copyright
>> notice are intending to do something other than participate
>> in FOSS/Libre work, or perhaps may not truly wish to
>> contribute in good faith.
> 
> Not at all.  The issue is that accumulating names creates clutter, and
> create some sense that people who are named are doing more than people
> who aren't named, which may lead to more people wanting to be named.
> 
> This is also why the policy allows for an AUTHORS file or use of a
> VCS.  The intent isn't to deny people credit.  It is to provide credit
> in a more reasonable manner vs having it spammed on the first lines of
> every file in the tree, and try to create a culture where we don't
> equate copyright notice with credit or property.
> 
>> Does gentoo have a legitimate reason
>> to substitute a gentoo copyright notice in place of an
>> otherwise valid notice?
> 
> The GLEP already allows existing works that have a non-Gentoo notice
> to keep their notice and add "and others" if there are further
> additions if they are brought into Gentoo from outside.  This doesn't
> mean that we keep adding names to things.  This was intended for
> things like eudev where we took an entire mature code body and forked
> it.  This doesn't make as much sense for somebody contributing a 10
> line ebuild to a repository containing thousands of ebuilds.
> 
>> Is there an intent to create a sort of gatekeeper role
>> within the gentoo organization to request documentation
>> if a contributor uses a non-gentoo copyright notice?
> 
> As the GLEP stands developers are already gatekeepers by virtue of
> being the only ones with commit access, and being required to sign off
> on the DCO.  This requires them to be aware of the copyright status of
> the works they are committing, but we do not require the accumulation
> of documentation.  However, the GLEP does not provide for multi-line
> notices and the intent isn't to keep accumulating them over time.  The
> intent was to be able to bring outside stuff in as-is as long as the
> notices are reasonable and then just freeze them in time with "and
> others" or simplify them with Gentoo Authors if appropriate.
> 


Fair point. GLEP 76 even mentions commits in several places.

[1] From GLEP 76 itself:

["This policy documents how Gentoo contributors comply and
document copyright for any contributions made to Gentoo."]

Specifically the section: Copyright Attribution

["It must list the main copyright holder, who is usually
the original author, or the contributor holding copyright
to the largest portion of the file."]

But then the other section: Simplified Attribution

... which contains some guidance for an alternative form:

["Alternatively, projects are welcome to use a simplified
form of the copyright notice, which reads:"]

~ This word "alternatively", strongly implies that the
default form should be used unless there is an overly
complicated or long list of entities / people who hold
copyright ~ at that point I agree with what you said:

["... simplify them with Gentoo Authors if appropriate."]

From a quick glance at bug #670702, I'm noticing there was
some confusion about GLEP 76 layout conventions. [2]

I think the confusing may have partly come from people who
are experienced working with some of the better-known metadata
formatting styles (for copyright, license, etc.) which is used
in other organizations.

Debian uses some SPDX-styled copyright formatting, along
with some other (non-SPDX, possibly in-house) formats.
It's an interesting mix, but still well-documented. [3]

And as for SPDX itself, the full spec is far more exhaustive
than anything gentoo or debian is using. Even the one-page
summary for SPDX is well-written. Open standards exist, and
I'm a fan of this one in particular. [4]

This wording from GLEP 76 seems unambiguous to me:

Exceptional circumstances are required for simplified
attribution be more appropriate, compared to the default of
a proper copyright notice which lists the entity whom held
copyright when a contribution was made.

-- kuza

[1] https://www.gentoo.org/glep/glep-0076.html
[2] https://bugs.gentoo.org/670702
[3] https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
[4] https://spdx.org/sites/cpstandard/files/pages/files/spdx_onepager.pdf


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Joonas Niilola]

On 11/25/18 4:22 AM, Rich Freeman wrote:
> On Sat, Nov 24, 2018 at 9:04 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>> On 11/24/18 8:37 PM, Rich Freeman wrote:
>>
>> So if it isn't meant to say that gentoo will be looking
>> after the legal aspects of a FOSS/Libre-copyleft licensed
>> package or document or tool, then what's the purpose to
>> put gentoo's name on it?
> You have to put somebody's name in the notice, and it was felt that
> "Gentoo Authors" gets the job done.  "Gentoo Authors" is not Gentoo.
> They are the authors contributing to the ebuild.
>
>> There's some innuendo and/or implication that copyright
>> holders who have their own name listed in a copyright
>> notice are intending to do something other than participate
>> in FOSS/Libre work, or perhaps may not truly wish to
>> contribute in good faith.
> Not at all.  The issue is that accumulating names creates clutter, and
> create some sense that people who are named are doing more than people
> who aren't named, which may lead to more people wanting to be named.
>
> This is also why the policy allows for an AUTHORS file or use of a
> VCS.  The intent isn't to deny people credit.  It is to provide credit
> in a more reasonable manner vs having it spammed on the first lines of
> every file in the tree, and try to create a culture where we don't
> equate copyright notice with credit or property.
>

I've already patched repoman to add my name automatically on every 
ebuild that I commit, similarily to how it works with Foundation -> 
Authors now. I also intend to join amd64 & x86 stabilization teams. Then 
when I have my name on 10 000 ebuilds, I'm sure Google will hire me! :)

Re: [gentoo-project] rfc: copyright attribution clarifications

[Matt Turner]

On Sat, Nov 24, 2018 at 9:48 AM William Hubbs <williamh@gentoo.org> wrote:

The GLEP says about the "Simplified Attribution":

> Projects using this scheme must track authorship in a VCS, unless they list all authors of copyrightable contributions in an AUTHORS file.

Would it be acceptable on your side to be listed in the AUTHORS file
(which as far as I know has not been created yet)?

I'd be perfectly happy to ship an AUTHORS file in the ebuild repo that
contains the names and emails of everyone and every company that has
contributed to the repo.

Re: [gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1089 bytes --]

On Sat, Nov 24, 2018 at 06:04:00PM -0800, Matt Turner wrote:
> On Sat, Nov 24, 2018 at 9:48 AM William Hubbs <williamh@gentoo.org> wrote:
> 
> The GLEP says about the "Simplified Attribution":
> 
> > Projects using this scheme must track authorship in a VCS, unless they list all authors of copyrightable contributions in an AUTHORS file.
> 
> Would it be acceptable on your side to be listed in the AUTHORS file
> (which as far as I know has not been created yet)?

I will get this answer today once I get to the office.

There was also talk about adding a tag to commits that listed the
copyright holder for that commit but it never went anywhere. I would
propose something like:

Copyright: <copyright notice>

> I'd be perfectly happy to ship an AUTHORS file in the ebuild repo that
> contains the names and emails of everyone and every company that has
> contributed to the repo.

We probably should do this anyway and ship the AUTHORS file as part of
the rsync repository. You don't need it for the git repo since the
information is available via VCS.

> 

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1574 bytes --]

On Mon, Nov 26, 2018 at 09:20:52AM -0600, William Hubbs wrote:
> On Sat, Nov 24, 2018 at 06:04:00PM -0800, Matt Turner wrote:
> > On Sat, Nov 24, 2018 at 9:48 AM William Hubbs <williamh@gentoo.org> wrote:
> > 
> > The GLEP says about the "Simplified Attribution":
> > 
> > > Projects using this scheme must track authorship in a VCS, unless they list all authors of copyrightable contributions in an AUTHORS file.
> > 
> > Would it be acceptable on your side to be listed in the AUTHORS file
> > (which as far as I know has not been created yet)?
> 
> I will get this answer today once I get to the office.
> 
> There was also talk about adding a tag to commits that listed the
> copyright holder for that commit but it never went anywhere. I would
> propose something like:
> 
> Copyright: <copyright notice>
 
Putting the copyright notice in the commits might be the way to do this.
If that's what we want, I suggest something like my example above.

> > I'd be perfectly happy to ship an AUTHORS file in the ebuild repo that
> > contains the names and emails of everyone and every company that has
> > contributed to the repo.
> 
> We probably should do this anyway and ship the AUTHORS file as part of
> the rsync repository. You don't need it for the git repo since the
> information is available via VCS.

The AUTHORS file will contain AUTHORS, not copyright holders.  Usually
they are the same, but not always.

So, I guess the question becomes, what do we want to do for Copyright
holders in the the rsync repository?

William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Raymond Jennings]

[-- Attachment #1: Type: text/plain, Size: 1758 bytes --]

My personal opinion is that rsync should eventually be retired for the tree.

On Mon, Nov 26, 2018 at 3:12 PM William Hubbs <williamh@gentoo.org> wrote:

> On Mon, Nov 26, 2018 at 09:20:52AM -0600, William Hubbs wrote:
> > On Sat, Nov 24, 2018 at 06:04:00PM -0800, Matt Turner wrote:
> > > On Sat, Nov 24, 2018 at 9:48 AM William Hubbs <williamh@gentoo.org>
> wrote:
> > >
> > > The GLEP says about the "Simplified Attribution":
> > >
> > > > Projects using this scheme must track authorship in a VCS, unless
> they list all authors of copyrightable contributions in an AUTHORS file.
> > >
> > > Would it be acceptable on your side to be listed in the AUTHORS file
> > > (which as far as I know has not been created yet)?
> >
> > I will get this answer today once I get to the office.
> >
> > There was also talk about adding a tag to commits that listed the
> > copyright holder for that commit but it never went anywhere. I would
> > propose something like:
> >
> > Copyright: <copyright notice>
>
> Putting the copyright notice in the commits might be the way to do this.
> If that's what we want, I suggest something like my example above.
>
> > > I'd be perfectly happy to ship an AUTHORS file in the ebuild repo that
> > > contains the names and emails of everyone and every company that has
> > > contributed to the repo.
> >
> > We probably should do this anyway and ship the AUTHORS file as part of
> > the rsync repository. You don't need it for the git repo since the
> > information is available via VCS.
>
> The AUTHORS file will contain AUTHORS, not copyright holders.  Usually
> they are the same, but not always.
>
> So, I guess the question becomes, what do we want to do for Copyright
> holders in the the rsync repository?
>
> William
>
>

[-- Attachment #2: Type: text/html, Size: 2320 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Matt Turner]

On Mon, Nov 26, 2018 at 3:12 PM William Hubbs <williamh@gentoo.org> wrote:
>
> On Mon, Nov 26, 2018 at 09:20:52AM -0600, William Hubbs wrote:
> > On Sat, Nov 24, 2018 at 06:04:00PM -0800, Matt Turner wrote:
> > > On Sat, Nov 24, 2018 at 9:48 AM William Hubbs <williamh@gentoo.org> wrote:
> > >
> > > The GLEP says about the "Simplified Attribution":
> > >
> > > > Projects using this scheme must track authorship in a VCS, unless they list all authors of copyrightable contributions in an AUTHORS file.
> > >
> > > Would it be acceptable on your side to be listed in the AUTHORS file
> > > (which as far as I know has not been created yet)?
> >
> > I will get this answer today once I get to the office.
> >
> > There was also talk about adding a tag to commits that listed the
> > copyright holder for that commit but it never went anywhere. I would
> > propose something like:
> >
> > Copyright: <copyright notice>
>
> Putting the copyright notice in the commits might be the way to do this.
> If that's what we want, I suggest something like my example above.
>
> > > I'd be perfectly happy to ship an AUTHORS file in the ebuild repo that
> > > contains the names and emails of everyone and every company that has
> > > contributed to the repo.
> >
> > We probably should do this anyway and ship the AUTHORS file as part of
> > the rsync repository. You don't need it for the git repo since the
> > information is available via VCS.
>
> The AUTHORS file will contain AUTHORS, not copyright holders.  Usually
> they are the same, but not always.

Let me try to explain what I'm suggesting.

As I understand it, the Simplified Attribution, which looks like

| Copyright YEARS Gentoo Authors

is like a pointer to the AUTHORS file, indicating that those listed
hold copyright on things in this repo.

I'm suggesting that in lieu of listing copyright holders explicitly in
each file (which as we've discussed is a pain, inaccurate, and
requires tedious maintenance) that we list copyright holders in the
AUTHORS file and use the Simplified Attribution nearly exclusively.

Re: [gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 2562 bytes --]

On Mon, Nov 26, 2018 at 06:38:45PM -0800, Matt Turner wrote:
> On Mon, Nov 26, 2018 at 3:12 PM William Hubbs <williamh@gentoo.org> wrote:
> >
> > On Mon, Nov 26, 2018 at 09:20:52AM -0600, William Hubbs wrote:
> > > On Sat, Nov 24, 2018 at 06:04:00PM -0800, Matt Turner wrote:
> > > > On Sat, Nov 24, 2018 at 9:48 AM William Hubbs <williamh@gentoo.org> wrote:
> > > >
> > > > The GLEP says about the "Simplified Attribution":
> > > >
> > > > > Projects using this scheme must track authorship in a VCS, unless they list all authors of copyrightable contributions in an AUTHORS file.
> > > >
> > > > Would it be acceptable on your side to be listed in the AUTHORS file
> > > > (which as far as I know has not been created yet)?
> > >
> > > I will get this answer today once I get to the office.
> > >
> > > There was also talk about adding a tag to commits that listed the
> > > copyright holder for that commit but it never went anywhere. I would
> > > propose something like:
> > >
> > > Copyright: <copyright notice>
> >
> > Putting the copyright notice in the commits might be the way to do this.
> > If that's what we want, I suggest something like my example above.
> >
> > > > I'd be perfectly happy to ship an AUTHORS file in the ebuild repo that
> > > > contains the names and emails of everyone and every company that has
> > > > contributed to the repo.
> > >
> > > We probably should do this anyway and ship the AUTHORS file as part of
> > > the rsync repository. You don't need it for the git repo since the
> > > information is available via VCS.
> >
> > The AUTHORS file will contain AUTHORS, not copyright holders.  Usually
> > they are the same, but not always.
> 
> Let me try to explain what I'm suggesting.
> 
> As I understand it, the Simplified Attribution, which looks like
> 
> | Copyright YEARS Gentoo Authors
> 
> is like a pointer to the AUTHORS file, indicating that those listed
> hold copyright on things in this repo.
> 
> I'm suggesting that in lieu of listing copyright holders explicitly in
> each file (which as we've discussed is a pain, inaccurate, and
> requires tedious maintenance) that we list copyright holders in the
> AUTHORS file and use the Simplified Attribution nearly exclusively.

Do you mean the way it is suggested here without the discussion of the
CLA since we do not use a CLA?

https://opensource.google.com/docs/releasing/authors/

That would also mean we don't have to list everyone, just those
copyright holders who wish to be listed.

William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Matt Turner]

On Mon, Nov 26, 2018 at 8:51 PM William Hubbs <williamh@gentoo.org> wrote:
>
> On Mon, Nov 26, 2018 at 06:38:45PM -0800, Matt Turner wrote:
> > On Mon, Nov 26, 2018 at 3:12 PM William Hubbs <williamh@gentoo.org> wrote:
> > >
> > > On Mon, Nov 26, 2018 at 09:20:52AM -0600, William Hubbs wrote:
> > > > On Sat, Nov 24, 2018 at 06:04:00PM -0800, Matt Turner wrote:
> > > > > On Sat, Nov 24, 2018 at 9:48 AM William Hubbs <williamh@gentoo.org> wrote:
> > > > >
> > > > > The GLEP says about the "Simplified Attribution":
> > > > >
> > > > > > Projects using this scheme must track authorship in a VCS, unless they list all authors of copyrightable contributions in an AUTHORS file.
> > > > >
> > > > > Would it be acceptable on your side to be listed in the AUTHORS file
> > > > > (which as far as I know has not been created yet)?
> > > >
> > > > I will get this answer today once I get to the office.
> > > >
> > > > There was also talk about adding a tag to commits that listed the
> > > > copyright holder for that commit but it never went anywhere. I would
> > > > propose something like:
> > > >
> > > > Copyright: <copyright notice>
> > >
> > > Putting the copyright notice in the commits might be the way to do this.
> > > If that's what we want, I suggest something like my example above.
> > >
> > > > > I'd be perfectly happy to ship an AUTHORS file in the ebuild repo that
> > > > > contains the names and emails of everyone and every company that has
> > > > > contributed to the repo.
> > > >
> > > > We probably should do this anyway and ship the AUTHORS file as part of
> > > > the rsync repository. You don't need it for the git repo since the
> > > > information is available via VCS.
> > >
> > > The AUTHORS file will contain AUTHORS, not copyright holders.  Usually
> > > they are the same, but not always.
> >
> > Let me try to explain what I'm suggesting.
> >
> > As I understand it, the Simplified Attribution, which looks like
> >
> > | Copyright YEARS Gentoo Authors
> >
> > is like a pointer to the AUTHORS file, indicating that those listed
> > hold copyright on things in this repo.
> >
> > I'm suggesting that in lieu of listing copyright holders explicitly in
> > each file (which as we've discussed is a pain, inaccurate, and
> > requires tedious maintenance) that we list copyright holders in the
> > AUTHORS file and use the Simplified Attribution nearly exclusively.
>
> Do you mean the way it is suggested here without the discussion of the
> CLA since we do not use a CLA?
>
> https://opensource.google.com/docs/releasing/authors/
>
> That would also mean we don't have to list everyone, just those
> copyright holders who wish to be listed.

That's a great description. Yes, that's what I mean. Thanks for the link!

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Fri, Nov 23, 2018 at 3:23 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>
> On 11/23/18 2:46 PM, Rich Freeman wrote:
> > Nobody is suggesting that multiple copyright owners shouldn't be
> > allowed.  Merely that multiple copyright owners shouldn't be named in
> > the copyright notice.
>
> The interest in removing or discouraging a more verbose,
> explicit copyright notice would suggest the only legitimate
> interest should be assumed to be in "gentoo authors", and
> for no other entity(s) or person(s) need have any stake
> in having a well-structured copyright notice (any format)

I'm not sure what "well-structured" means.

The one-line format IS valid.  If persons A, B, C, and D all own
copyright on a file, as far as copyright law is concerned person D
receives the same benefit whether the notice lists them or not.  They
can sue for infringement even if they aren't listed on the notice, and
the innocent infringement defense is barred if they do, because the
file contains a valid notice.  US law does not require the person
listed in the notice to be the person filing the lawsuit to obtain the
benefit of there being a notice.

Now, arguably there might be non-legal benefits of having more lines
in the notice, such as documenting ownership, or in advertising
yourself.

In the case of documenting ownership IMO it would be FAR more
efficient to do this with some kind of standardized header in git,
ideally one that is both human- and machine-readable.

In the case of advertising...  If somebody is really contributing THAT
much to Gentoo they should probably just ask to be recognized as a
sponsor where you actually can stick logos on websites, advertise
services, get pagerank, and all that stuff.  Is a company name buried
in an ebuild really that important for this purpose?  And if it is
just an odd contributed ebuild, do we really want to turn our ebuilds
into advertising space?

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Sarah White]

On 11/23/18 3:42 PM, Rich Freeman wrote:
> On Fri, Nov 23, 2018 at 3:23 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>>
>> On 11/23/18 2:46 PM, Rich Freeman wrote:
>>> Nobody is suggesting that multiple copyright owners shouldn't be
>>> allowed.  Merely that multiple copyright owners shouldn't be named in
>>> the copyright notice.
>>
>> The interest in removing or discouraging a more verbose,
>> explicit copyright notice would suggest the only legitimate
>> interest should be assumed to be in "gentoo authors", and
>> for no other entity(s) or person(s) need have any stake
>> in having a well-structured copyright notice (any format)
> 
> I'm not sure what "well-structured" means.

SPDX is well-structured, and was previously given
as an example (I believe it was in this thread)

quoted / cited message:

-------- Forwarded Message --------
Subject: Re: [gentoo-project] rfc: copyright attribution clarifications
Date: Wed, 14 Nov 2018 02:18:35 -0500
From: Sarah White <kuzetsa@poindexter.ovh>
To: gentoo-project@lists.gentoo.org

On 11/13/2018 09:46 PM, William Hubbs wrote:
> On Tue, Nov 13, 2018 at 06:17:17PM -0800, Rich Freeman wrote:
>> On Tue, Nov 13, 2018 at 10:32 AM William Hubbs <williamh@gentoo.org>
wrote:
>>>
>>> Since we do not do copyright assignment any more and the glep allows for
>>> traditional attribution, if some entity
>>> (company, person etc) has a desire for a copyright notice in
>>> their work, the case for not allowing this is very weak at best, so

{{ snip }}

SPDX-style license blocks have a well-defined layout
(I'm a fan / several linux kernel developers are too)

... and SPDX displays the copyright notice in a way which is
fully compatible with, and improves transparency for copyleft

>>
>>>
>>> As you can see from my example, line length will quickly become
>>> problematic in this format because all lines in in-tree ebuilds are
>>> supposed to be under 80 characters.
>>

{{ snip }}

>>
>>> Multiple-lines would be much easier to maintain, and
>>> there is no cost performance wise for them.
>>
>> Except for spam in our files.
>
> And how does that affect performance?
>

it shouldn't. most interpreted languages have sensible handling for
comments / JIT compilation, and for compiled languages there's normally
zero runtime penalty for comment blocks of any kind.

even if a QA tool has a bottleneck when scanning comments, there's no
reason to believe this is a mission-critical failure and the performance
bottleneck will slow down development.

>> Heck, repoman complains if you stick two newlines in a row in the
>> file, and now we basically want to add a revision history to the file?
>
> No, a revision history comes from vcs.
>

yep

>>
>> Just say no.  Fit it on one line.
>>
>> But, if you had to have multiple lines, then just wrap the existing
>> notice.  Don't turn it into some kind of revision history.  Just list
>> one year range and whatever list of entities you feel compelled to
>> list.  That is the proper way to do a notice.
>
> No sir, it isn't.
>
> Look anywhere outside the Gentoo tree. For that matter, take the Linux
> kernel, or even in the systemd source, there are several places with
> multiple copyright notices in them.

indeed. it's done in a sensible way too (see comments above)

> William
>

-- kuza

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Fri, Nov 23, 2018 at 3:51 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>
> On 11/23/18 3:42 PM, Rich Freeman wrote:
> > On Fri, Nov 23, 2018 at 3:23 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
> >>
> >> On 11/23/18 2:46 PM, Rich Freeman wrote:
> >>> Nobody is suggesting that multiple copyright owners shouldn't be
> >>> allowed.  Merely that multiple copyright owners shouldn't be named in
> >>> the copyright notice.
> >>
> >> The interest in removing or discouraging a more verbose,
> >> explicit copyright notice would suggest the only legitimate
> >> interest should be assumed to be in "gentoo authors", and
> >> for no other entity(s) or person(s) need have any stake
> >> in having a well-structured copyright notice (any format)
> >
> > I'm not sure what "well-structured" means.
>
> SPDX is well-structured, and was previously given
> as an example (I believe it was in this thread)

Great, so stick this in your git commit:
SPDX-License-Identifier: GPL-2.0-or-later

That isn't a copyright notice anyway, so I see it as orthogonal to the
issue of notice.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Sarah White]

On 11/23/18 4:11 PM, Rich Freeman wrote:
> On Fri, Nov 23, 2018 at 3:51 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>>
>> On 11/23/18 3:42 PM, Rich Freeman wrote:
>>> On Fri, Nov 23, 2018 at 3:23 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>>>>
>>>> On 11/23/18 2:46 PM, Rich Freeman wrote:
>>>>> Nobody is suggesting that multiple copyright owners shouldn't be
>>>>> allowed.  Merely that multiple copyright owners shouldn't be named in
>>>>> the copyright notice.
>>>>
>>>> The interest in removing or discouraging a more verbose,
>>>> explicit copyright notice would suggest the only legitimate
>>>> interest should be assumed to be in "gentoo authors", and
>>>> for no other entity(s) or person(s) need have any stake
>>>> in having a well-structured copyright notice (any format)
>>>
>>> I'm not sure what "well-structured" means.
>>
>> SPDX is well-structured, and was previously given
>> as an example (I believe it was in this thread)
> 
> Great, so stick this in your git commit:
> SPDX-License-Identifier: GPL-2.0-or-later
> 
> That isn't a copyright notice anyway, so I see it as orthogonal to the
> issue of notice.
> 

I think there was a misunderstanding. SPDX specs have layout for more
than just licensing. (incl. layout convention for copyright notice)

-- kuza

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Fri, Nov 23, 2018 at 3:23 PM Sarah White <kuzetsa@poindexter.ovh> wrote:
>
> It depends. It is not proper to remove an otherwise valid
> copyright notice (though it's likely proper / "good enough"
> if a simplified attribution of the form "gentoo authors"
> is used instead - that's fine on an opt-in basis)
>

IMO it is legal even if it isn't opt-in.  So, legally we could always
just let contributors tack their employer's name on the one-liner and
then just trim it back off when they're not looking.  That probably
won't make us any friends, but as far as I can tell nobody has ever
successfully sued somebody for doing this when the work was
distributed under the GPL.

> What's the purpose of removing or discouraging
> something which doesn't harm gentoo

It creates clutter in files that are otherwise very concise, so it
does cause a form of harm.

I get that lawyers like imposing restrictions on employees in their
companies to look like they're doing something.  That doesn't mean
that we have to humor them.  It is unfortunate that they have their
employees at a disadvantage, but we can't control the relationships
our contributors get into.

What if a company requires that we put their logo on our sponsors page
for one of their employees to contribute even a single line of code
off-hours?  Sure, the harm of honoring that policy also is hard to
quantify, but it is clearly there, as it diminishes the value of being
recognized as a sponsor (and our existing sponsors give us more than
that - we try to have internal guidelines for what qualifies so that
the honor isn't cheapened).

As far as I'm aware, the number of contributors who are even impacted
by this policy is one.  I certainly do feel bad about the situation
they are in, but unfortunately that is the nature of employee
relationships in the US.  We have many people who are paid to
contribute to Gentoo who do not have this restriction.  As far as I
can tell, the people responsible for imposing the restriction in this
case aren't interested in making a case for why they feel it is
necessary.

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1718 bytes --]

On Tue, 13 Nov 2018 18:17:17 -0800 Rich Freeman wrote:
> On Tue, Nov 13, 2018 at 10:32 AM William Hubbs <williamh@gentoo.org> wrote:
> >
> > Since we do not do copyright assignment any more and the glep allows for
> > traditional attribution, if some entity
> > (company, person etc) has a desire for a copyright notice in
> > their work, the case for not allowing this is very weak at best, so we will
> > end up with more and more ebuilds that want to use traditional copyright
> > attribution, and once an ebuild is switched over, it is problematic to
> > switch back.
> 
> So, the purpose of allowing specific copyright holders to be named was
> to cover cases where we're forking foreign code, not to basically
> introduce a variant on the BSD advertising clause.  IMO people who are
> only willing to contribute FOSS if their name gets put in a prominent
> location might do better to contribute elsewhere.

What's the main problem of most FOSS including Gentoo? Lack of
human power. And here you propose to neglect contributions if they
want a proper and legal and allowed by GPL attribution. This is
absurd. A few extra lines in the header doesn't as much as
inability to import GPL ebuilds to the tree due to our
questionable copyright line policy.

> But, if you had to have multiple lines, then just wrap the existing
> notice.  Don't turn it into some kind of revision history.

That's what most FOSS software does. I see no reason why we should
be different.

IMO the best solution will be to recommend "Gentoo Authors"
attribution, but to allow additional copyright lines including the
case where "Gentoo Authors" is one of such lines.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Rich Freeman]

On Wed, Nov 14, 2018 at 6:36 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
>
> What's the main problem of most FOSS including Gentoo? Lack of
> human power. And here you propose to neglect contributions if they
> want a proper and legal and allowed by GPL attribution.

Where is anybody talking about "attribution?"

This is about copyright notice, which is NOT about crediting anybody
with anything or giving attribution.  It is about communicating the
fact that code is copyrighted, so that people can't claim that they
didn't know when the Foundation wants to sue them.  I'm sure they're
about to start doing that anytime...

Also, this doesn't seem to have been a problem in the past, and yet
our policy was far less free then.

> A few extra lines in the header doesn't as much as
> inability to import GPL ebuilds to the tree due to our
> questionable copyright line policy.

What is it that we want to import but can't today?

>
> > But, if you had to have multiple lines, then just wrap the existing
> > notice.  Don't turn it into some kind of revision history.
>
> That's what most FOSS software does. I see no reason why we should
> be different.

Do you have a citation for this?  I'm not aware of many FOSS projects
that use copyright notices as a revision history, let alone "most."

> IMO the best solution will be to recommend "Gentoo Authors"
> attribution, but to allow additional copyright lines including the
> case where "Gentoo Authors" is one of such lines.

IMO doing this will just cause everybody and their uncle to insist on
putting their names in various places.

We've done just fine for going on 20 years not allowing any notice
other than "Copyright xxx Gentoo Foundation."  Now we open things up a
tiny bit and suddenly everybody and their uncle is saying that their
employers won't let them contribute code unless they stick their
company name in there.  What have they been doing for the last decade?

-- 
Rich

Re: [gentoo-project] rfc: copyright attribution clarifications

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 2814 bytes --]

On Wed, 14 Nov 2018 07:31:02 -0800 Rich Freeman wrote:
> On Wed, Nov 14, 2018 at 6:36 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
> >
> > What's the main problem of most FOSS including Gentoo? Lack of
> > human power. And here you propose to neglect contributions if they
> > want a proper and legal and allowed by GPL attribution.
> 
> Where is anybody talking about "attribution?"
> 
> This is about copyright notice, which is NOT about crediting anybody
> with anything or giving attribution.  It is about communicating the
> fact that code is copyrighted, so that people can't claim that they
> didn't know when the Foundation wants to sue them.  I'm sure they're
> about to start doing that anytime...

It is your intent, but not full consequences of such statement.
Lack of proper copyright notice may be considered as a copyright or
authorship violation in some jurisdictions. Gentoo is used not only
in the US.
 
> Also, this doesn't seem to have been a problem in the past, and yet
> our policy was far less free then.
> 
> > A few extra lines in the header doesn't as much as
> > inability to import GPL ebuilds to the tree due to our
> > questionable copyright line policy.
> 
> What is it that we want to import but can't today?

I have this problem for years(!!) with hasufel overlay from which I
wanted to take voip-related stuff. Also we have wltjr's overlay
which will be useful for java packages.
 
> > > But, if you had to have multiple lines, then just wrap the existing
> > > notice.  Don't turn it into some kind of revision history.
> >
> > That's what most FOSS software does. I see no reason why we should
> > be different.
> 
> Do you have a citation for this?  I'm not aware of many FOSS projects
> that use copyright notices as a revision history, let alone "most."

git grep through git repositories of large FOSS projects will be a
citation you requested.

> > IMO the best solution will be to recommend "Gentoo Authors"
> > attribution, but to allow additional copyright lines including the
> > case where "Gentoo Authors" is one of such lines.
> 
> IMO doing this will just cause everybody and their uncle to insist on
> putting their names in various places.

There is nothing wrong with this.

> We've done just fine for going on 20 years not allowing any notice
> other than "Copyright xxx Gentoo Foundation."

Except for it was entirely wrong except for early days of Gentoo.

>  Now we open things up a
> tiny bit and suddenly everybody and their uncle is saying that their
> employers won't let them contribute code unless they stick their
> company name in there.  What have they been doing for the last decade?

They were not contributing or less contributing to Gentoo.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Ian Stakenvicius]

[-- Attachment #1.1: Type: text/plain, Size: 1103 bytes --]

On 2018-11-14 10:31 a.m., Rich Freeman wrote:
> On Wed, Nov 14, 2018 at 6:36 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
>> IMO the best solution will be to recommend "Gentoo Authors"
>> attribution, but to allow additional copyright lines including the
>> case where "Gentoo Authors" is one of such lines.
> 
> IMO doing this will just cause everybody and their uncle to insist on
> putting their names in various places.
> 

I think the impact of allowing multi-line traditional copyright in the
gentoo repo (which is acceptable according to GLEP 76, but not
necessarily according to repo policy right now) is going to be
minimal, to be honest.  The vast majority of us I expect will be happy
with "Copyright [years] Gentoo Authors" simplified attribution.

It's also plenty easy enough to discourage the use of traditional
copyright attribution by requiring a copyright audit be done whenever
something gets converted from simplified to traditional -- that will
be PLENTY enough of a pain to keep it from being performed except when
corporate legal departments require it.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1774 bytes --]

On Wed, Nov 14, 2018 at 01:59:47PM -0500, Ian Stakenvicius wrote:
> On 2018-11-14 10:31 a.m., Rich Freeman wrote:
> > On Wed, Nov 14, 2018 at 6:36 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
> >> IMO the best solution will be to recommend "Gentoo Authors"
> >> attribution, but to allow additional copyright lines including the
> >> case where "Gentoo Authors" is one of such lines.
> > 
> > IMO doing this will just cause everybody and their uncle to insist on
> > putting their names in various places.
> > 
> 
> I think the impact of allowing multi-line traditional copyright in the
> gentoo repo (which is acceptable according to GLEP 76, but not
> necessarily according to repo policy right now) is going to be
> minimal, to be honest.  The vast majority of us I expect will be happy
> with "Copyright [years] Gentoo Authors" simplified attribution.

I personally am fine with this for things I do on my personal time, yes,
and I think most of us would be.

> It's also plenty easy enough to discourage the use of traditional
> copyright attribution by requiring a copyright audit be done whenever
> something gets converted from simplified to traditional -- that will
> be PLENTY enough of a pain to keep it from being performed except when
> corporate legal departments require it.

Well, there really wouldn't be much of an Audit to do if "Gentoo
Authors" is allowed in all attribution types as a catch-all.

# Copyright 1991-2018 Gentoo Authors
# Copyright [years] other copyright holder
...

Everything in the ebuild that other copyright holders don't hold
copyright on falls back to Gentoo Authors.

That would require a glep change, but I will write the patch for the
glep myself if we go for it.

William

> 




[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Patrick McLean]

On Wed, 14 Nov 2018 13:59:47 -0500
Ian Stakenvicius <axs@gentoo.org> wrote:

> On 2018-11-14 10:31 a.m., Rich Freeman wrote:
> > On Wed, Nov 14, 2018 at 6:36 AM Andrew Savchenko
> > <bircoph@gentoo.org> wrote:  
> >> IMO the best solution will be to recommend "Gentoo Authors"
> >> attribution, but to allow additional copyright lines including the
> >> case where "Gentoo Authors" is one of such lines.  
> > 
> > IMO doing this will just cause everybody and their uncle to insist
> > on putting their names in various places.
> >    
> It's also plenty easy enough to discourage the use of traditional
> copyright attribution by requiring a copyright audit be done whenever
> something gets converted from simplified to traditional -- that will
> be PLENTY enough of a pain to keep it from being performed except when
> corporate legal departments require it.

It would also discourage developers under deadlines from contributing
upstream rather than just adding to a local private repository. There
are some companies that strongly encourage their employees to upstream
any work done on an open source project, if any signifigant contribution
turns in to a git hsitory deep-dive, then they may opt to not
contribute at all, especially if they are under a deadline.

This discussion keeps me wondering whether Gentoo wants to make it easy
and painless to accept outside contribution (or coprorate
contribution), or if they want to make it so painful for corporations
to contribute that most opt not to do it at all. I personally think
that the more developer time that can spent on improving Gentoo, the
better. If increasing the developers fixing bugs and adding features
requires accepting some extra lines (or one _very_ long line at the
start of a file) at the top of some small percentage of ebuilds in the
tree, then it is worth it.

rich0 mentioned earlier in this thread that developer eyeballs is far
more valuable than CPU time, isn't having paid developers working on
fixing and improving Gentoo valuable? That can add up to quite a large
amount of developer time that would not otherwise be spent. We have
lost many developers who had life changes that reduced their free time
to work on Gentoo, in the case where a developer can work on Gentoo in
their day job, then that can help avoid losing valuable contributions.

Re: [gentoo-project] rfc: copyright attribution clarifications

[M. J. Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 2107 bytes --]

On 14/11/18 20:02, Patrick McLean wrote:
>
> It would also discourage developers under deadlines from contributing
> upstream rather than just adding to a local private repository. There
> are some companies that strongly encourage their employees to upstream
> any work done on an open source project, if any signifigant contribution
> turns in to a git hsitory deep-dive, then they may opt to not
> contribute at all, especially if they are under a deadline.
>
> This discussion keeps me wondering whether Gentoo wants to make it easy
> and painless to accept outside contribution (or coprorate
> contribution), or if they want to make it so painful for corporations
> to contribute that most opt not to do it at all. I personally think
> that the more developer time that can spent on improving Gentoo, the
> better. If increasing the developers fixing bugs and adding features
> requires accepting some extra lines (or one _very_ long line at the
> start of a file) at the top of some small percentage of ebuilds in the
> tree, then it is worth it.
>
> rich0 mentioned earlier in this thread that developer eyeballs is far
> more valuable than CPU time, isn't having paid developers working on
> fixing and improving Gentoo valuable? That can add up to quite a large
> amount of developer time that would not otherwise be spent. We have
> lost many developers who had life changes that reduced their free time
> to work on Gentoo, in the case where a developer can work on Gentoo in
> their day job, then that can help avoid losing valuable contributions.
>
I wouldn't be sure the proponents of these proposals have the 'big picture'
in mind .. or they wouldn't even have found discussion or questioning here.

There seems to be a remarkable amount of 'busy-work' being done in the
echelons of Gentoo, and not a lot of work on fixing bugs, updating packages
and developing new features ...

That said, I credit those developers who are tirelessly and thanklessly
grinding away. You know who you are, and I take my hat off to you, and
thank you for your hard work.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 1057 bytes --]

On 2018-11-14 19:59, Ian Stakenvicius wrote:
> I think the impact of allowing multi-line traditional copyright in the
> gentoo repo (which is acceptable according to GLEP 76, but not
> necessarily according to repo policy right now) is going to be
> minimal, to be honest.  The vast majority of us I expect will be happy
> with "Copyright [years] Gentoo Authors" simplified attribution.

This is a big misunderstanding and was probably the biggest mistake we
(the people directly involved) made, when we proposed the GLEP text.

Like ulm said in another branch of this thread, we added that exception
for *external* code. To be prepared if we ever need to handle that.
At no time we thought about that any contributor could *abuse* that
paragraph to add a copyright notice into our normal repositories,
especially in ebuilds.

Now we have to deal with arguments like "It isn't explicit forbidden so
it is allowed", great.


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[Brian Dolbec]

On Wed, 14 Nov 2018 07:31:02 -0800
Rich Freeman <rich0@gentoo.org> wrote:

> 
> Also, this doesn't seem to have been a problem in the past, and yet
> our policy was far less free then.
> 
...
> 
> We've done just fine for going on 20 years not allowing any notice
> other than "Copyright xxx Gentoo Foundation."  Now we open things up a
> tiny bit and suddenly everybody and their uncle is saying that their
> employers won't let them contribute code unless they stick their
> company name in there.  What have they been doing for the last decade?
> 

Just like Gentoo's policies, things change in corporate environments.

Where things have been fine contirubting without the attribution in the
past.  The new attribution requirement is due to Gentoo changing
things with the copyright.  With that change meant that the new "Gentoo"
change had to be run by the "new" corporate management structure.  That
result came back that the contributions now require the SIE
attribution.

Why is that so hard to understand...  

If you didn't push for the copyright change in Gentoo, then the new
policy wouldn't have had to be run past the "new bigger" corporate
lawyers...   and the status quo would not have changed...  we wouldn't
be having this run-on rant/bikeshed/waste of everyone's time/...
typical endless mail list thread which just makes even more current or
future developers want to quit/withdraw their application/add another
tick to the con column about becoming a Gentoo dev.

What you are calling abuse (Not just Rich0, anyone with that opinion)
is just a consequence of the new GLEP and it's text.  Get over it. 

Re: [gentoo-project] rfc: copyright attribution clarifications

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 714 bytes --]

On 2018-11-15 16:51, Brian Dolbec wrote:
> [...] That result came back that the contributions now require the SIE
> attribution.
> 
> Why is that so hard to understand...  

We understand that. But our problem is that we don't buy the argument "X
requires Foo". We need something more. Now it looks like an arbitrary
request.

Maybe someone contributing to Gentoo will start working for a company
which will require short disclaimer or HTTP link, ASCII art style
notation... are we going to allow any of that just because someone says
"My company requires that kind of attribution"?


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] rfc: copyright attribution clarifications

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 989 bytes --]

On Thu, Nov 15, 2018 at 05:25:20PM +0100, Thomas Deutschmann wrote:
> On 2018-11-15 16:51, Brian Dolbec wrote:
> > [...] That result came back that the contributions now require the SIE
> > attribution.
> > 
> > Why is that so hard to understand...  
> 
> We understand that. But our problem is that we don't buy the argument "X
> requires Foo". We need something more. Now it looks like an arbitrary
> request.

Whether or not something is arbitrary depends on your viewpoint I
suppose.

> Maybe someone contributing to Gentoo will start working for a company
> which will require short disclaimer or HTTP link, ASCII art style
> notation... are we going to allow any of that just because someone says
> "My company requires that kind of attribution"?

This is a red herring and you know it.

All we are talking about is adding a single line copyright notice in an
ebuild. We are not talking about some company requiring fancy ascii art
or disclaimers.

William

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]