[gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Patrick Lauer]

Good $timezonegreeting,

The README at both

https://github.com/coreos/portage-stable
and
https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README

claims that:

"""
Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
Use of this source code is governed by a BSD-style license that can be
found in the LICENSE file.
"""

Since this is a copy of Gentoo ebuilds this is demonstrably wrong, the
copyrights on the files themselves are intact. Copyright is obviously
Gentoo Foundation, and license is GPL-2.

I have been unable to find a proper contact for both repositories, so I
hope people that know who to contact are reading this.

Once this is corrected I'd strongly suggest to both downstreams to poste
a prominent notice to inform all downstream users of this issue to avoid
accidental license violations.


Have fun,

Patrick

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Alex Brandt]

On Saturday, March 07, 2015 10:22:00 Patrick Lauer wrote:
> I have been unable to find a proper contact for both 
repositories, so I
> hope people that know who to contact are reading this.

For the CoreOS violations, have you attempted to reach out to 
coreos-dev@googlegroups.com?

If not I can forward this message for their attention.  Let me 
know if you would like me to take this action.

Regards,

-- 
Alex Brandt
Cloud Evangelist for Rackspace and Developer for Gentoo
http://blog.alunduil.com

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1393 bytes --]

On Sat, 07 Mar 2015 10:22:00 +0800 Patrick Lauer wrote:
> Good $timezonegreeting,
> 
> The README at both
> 
> https://github.com/coreos/portage-stable
> and
> https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README
> 
> claims that:
> 
> """
> Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
> Use of this source code is governed by a BSD-style license that can be
> found in the LICENSE file.
> """
> 
> Since this is a copy of Gentoo ebuilds this is demonstrably wrong, the
> copyrights on the files themselves are intact. Copyright is obviously
> Gentoo Foundation, and license is GPL-2.
> 
> I have been unable to find a proper contact for both repositories, so I
> hope people that know who to contact are reading this.

1. Maybe a license and copyright violation claims should be filed
directly to github? They should contact upstream fast.

2. One may contact person responsible to that commit of invalid
README file:

Darin Petkov <petkov@chromium.org>
https://github.com/coreos/portage-stable/commit/0465d53c7be43d55cfabb3dff56f32803719d0fe
https://codereview.chromium.org/6756045

> Once this is corrected I'd strongly suggest to both downstreams to poste
> a prominent notice to inform all downstream users of this issue to avoid
> accidental license violations.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Rich Freeman]

On Fri, Mar 6, 2015 at 10:55 PM, Andrew Savchenko <bircoph@gentoo.org> wrote:
>
> 1. Maybe a license and copyright violation claims should be filed
> directly to github? They should contact upstream fast.
>

I'd really suggest doing something like this only as a last resort.
If we made a well-intentioned but disputable change in a copyright
notice (cough, udev), would we want people calling our hosting
providers and such and starting the DMCA process?

I'd just reach out to them, and keep in mind that it is a weekend.
I'm sure it will get sorted out.

-- 
Rich

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Sven Vermeulen]

On Fri, Mar 06, 2015 at 11:13:03PM -0500, Rich Freeman wrote:
> I'd just reach out to them, and keep in mind that it is a weekend.
> I'm sure it will get sorted out.

Exactly this. Has someone already send out a mail to ask that the
information is updated accordingly?

Keep trustees@gentoo.org in the loop so we can track it, but I'm confident
this is nothing more than a small oversight and that the developers will
gladly fix it.

Wkr,
	Sven Vermeulen

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1039 bytes --]

>>>>> On Sat, 07 Mar 2015, Patrick Lauer wrote:

> The README at both

> https://github.com/coreos/portage-stable
> and
> https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README

> claims that:

> """
> Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
> Use of this source code is governed by a BSD-style license that can be
> found in the LICENSE file.
> """

> Since this is a copy of Gentoo ebuilds this is demonstrably wrong, the
> copyrights on the files themselves are intact. Copyright is obviously
> Gentoo Foundation, and license is GPL-2.

Thanks for noticing this. Quoting the GPL-2:

   4. You may not copy, modify, sublicense, or distribute the Program
   except as expressly provided under this License.  Any attempt
   otherwise to copy, modify, sublicense or distribute the Program is
   void, and will automatically terminate your rights under this License.

Does this apply here? It would mean that Google's rights to distribute
the Portage tree have been terminated.

Ulrich

[-- Attachment #2: Type: application/pgp-signature, Size: 490 bytes --]

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1370 bytes --]

On Sat, 7 Mar 2015 09:53:57 +0100 Ulrich Mueller wrote:
> >>>>> On Sat, 07 Mar 2015, Patrick Lauer wrote:
> 
> > The README at both
> 
> > https://github.com/coreos/portage-stable
> > and
> > https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README
> 
> > claims that:
> 
> > """
> > Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
> > Use of this source code is governed by a BSD-style license that can be
> > found in the LICENSE file.
> > """
> 
> > Since this is a copy of Gentoo ebuilds this is demonstrably wrong, the
> > copyrights on the files themselves are intact. Copyright is obviously
> > Gentoo Foundation, and license is GPL-2.
> 
> Thanks for noticing this. Quoting the GPL-2:
> 
>    4. You may not copy, modify, sublicense, or distribute the Program
>    except as expressly provided under this License.  Any attempt
>    otherwise to copy, modify, sublicense or distribute the Program is
>    void, and will automatically terminate your rights under this License.
> 
> Does this apply here? It would mean that Google's rights to distribute
> the Portage tree have been terminated.

GPL-2 is violated. So yes, it applies here. And until this issue
is resolved they lost not only the right to distribute, but the
rights to use and modify.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Rich Freeman]

On Sat, Mar 7, 2015 at 3:53 AM, Ulrich Mueller <ulm@gentoo.org> wrote:
>
>> Since this is a copy of Gentoo ebuilds this is demonstrably wrong, the
>> copyrights on the files themselves are intact. Copyright is obviously
>> Gentoo Foundation, and license is GPL-2.
>
> Thanks for noticing this. Quoting the GPL-2:
>
>    4. You may not copy, modify, sublicense, or distribute the Program
>    except as expressly provided under this License.  Any attempt
>    otherwise to copy, modify, sublicense or distribute the Program is
>    void, and will automatically terminate your rights under this License.
>
> Does this apply here? It would mean that Google's rights to distribute
> the Portage tree have been terminated.

I'd probably talk to a lawyer before celebrating the death of Google.

All the copyright notices in the files are intact.  As far as I can
tell Google hasn't done anything that actually violates the GPL.  The
only complaint here is that there is a readme file with a different
copyright notice inside.  The issue is trivially correctable by Google
by simply fixing the notice, or clarifying what it applies to.  No
court is going to prefer permanently terminating Google's rights to
distribute ChromeOS over simply letting them clean things up.

Besides, is the goal of Gentoo really to kill off the #1 used open
source desktop OS in the world which is based on Gentoo?  That hardly
sounds like "Gentoo lives for the community, by the community" as
stated in the Foundation's charter.  The purpose of our copyrights is
to preserve Gentoo so that all can benefit from it, not to club people
over the head with if they dare to actually use Gentoo and make a
mistake.

Honestly, I'm a bit concerned by some of the talk in this thread.
What kind of message to we want to send to companies or organizations
that use Gentoo?  Do we really want the message to be "better not slip
up, because Gentoo is the kind of group that will get your site taken
down on a weekend over a readme file?"  Don't get me wrong - I think
Google has benefitted a great deal from Gentoo and I'd love to see
they contribute back more actively than they already do (we do have
people doing 10% time work for Gentoo and we have benefitted from past
GSoC).

How would we want to be treated in the reverse situation?  I was
annoyed when it seemed like everybody was over-reacting over the eudev
copyright notice fiasco.  Copyright is complicated, and most people
working on software are not lawyers, and since there isn't a ton of
open source case law even the lawyers can disagree on where the lines
are.  When somebody infringes on your copyright the solution is to
work with them to fix things, so that the scope of open source
software is increased and the public benefits, not to act like the
RIAA.  Since we are an open community, we make our mistakes in the
public light - we should afford the same leniency to others since we
WANT others to act as open communities as well.

I'm sure if we ask Google nicely to clean things up they will.  That
is the best outcome for the general public, and the best outcome for
Gentoo.  Remember, we can borrow their code as well, and some of our
devs do just that.  If we have trouble getting through to them the
legal issues would allow us to escalate things, but that can be done
in a way that creates opportunities ("hey, while we have you on the
phone, did you realize how much you benefit from Gentoo, and are there
ways we can better partner to improve things for all of our users?").
Why make enemies when we can make friends?

-- 
Rich

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Anthony G. Basile]

On 03/07/15 07:09, Rich Freeman wrote:
> On Sat, Mar 7, 2015 at 3:53 AM, Ulrich Mueller <ulm@gentoo.org> wrote:
>>> Since this is a copy of Gentoo ebuilds this is demonstrably wrong, the
>>> copyrights on the files themselves are intact. Copyright is obviously
>>> Gentoo Foundation, and license is GPL-2.
>> Thanks for noticing this. Quoting the GPL-2:
>>
>>     4. You may not copy, modify, sublicense, or distribute the Program
>>     except as expressly provided under this License.  Any attempt
>>     otherwise to copy, modify, sublicense or distribute the Program is
>>     void, and will automatically terminate your rights under this License.
>>
>> Does this apply here? It would mean that Google's rights to distribute
>> the Portage tree have been terminated.
> I'd probably talk to a lawyer before celebrating the death of Google.
>
> All the copyright notices in the files are intact.  As far as I can
> tell Google hasn't done anything that actually violates the GPL.  The
> only complaint here is that there is a readme file with a different
> copyright notice inside.  The issue is trivially correctable by Google
> by simply fixing the notice, or clarifying what it applies to.  No
> court is going to prefer permanently terminating Google's rights to
> distribute ChromeOS over simply letting them clean things up.

During the eudev thingy, Greg K-H said that you can copyright a line, a 
file or an entire program.  If the copyright notices in the files are 
intact, then I think they're okay.  Those individual files can still be 
distributed under GPLv2 copyright Gentoo.  The question is, what do 
their non-GPLv2 copyright notices refer to?  If there is some confusion, 
then we should ask downstream to clearify it in their README.  Something 
like "FooBarOS is licensed under BSD except for those components which 
are licensed otherwise.  Copyright notices for individual files can be 
found in the respective files." Or something like that.

On a different note, I like having downstreams.  I just wish they'd toot 
our whistle more and say "we are a gentoo derived distro".

-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@gentoo.org
GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
GnuPG ID  : F52D4BBA

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Jeroen Roovers]

On Sat, 07 Mar 2015 09:27:54 -0500
"Anthony G. Basile" <blueness@gentoo.org> wrote:

> During the eudev thingy, Greg K-H said that you can copyright a line,
> a file or an entire program.  If the copyright notices in the files
> are intact, then I think they're okay.

Better yet, you can claim copyright on a "compilation" which is
probably what is effectively being done here. This is how people get
away with defending their copyright on publications of (slightly
modified/ abridged/ annotated, if at all) "compilations" of centuries
old works. Because copyright law.


     jer

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 908 bytes --]

>>>>> On Sun, 22 Mar 2015, Jeroen Roovers wrote:

> Better yet, you can claim copyright on a "compilation" which is
> probably what is effectively being done here. This is how people get
> away with defending their copyright on publications of (slightly
> modified/ abridged/ annotated, if at all) "compilations" of
> centuries old works. Because copyright law.

It doesn't work like this in our case. The Portage tree is licensed
under the GPL-2. If someone takes a subset of ebuilds from it, it will
be a "derivative work" and it cannot be distributed under any license
other than the GPL-2.

It is even doubtful if any third-party ebuilds added to such a tree
could be under a different license. If such ebuilds inherit from a GPL
licensed eclass or depend on (or are depended on by) other ebuilds,
they cannot "be reasonably considered independent and separate works
in themselves".

IANAL, TINLA
Ulrich

[-- Attachment #2: Type: application/pgp-signature, Size: 490 bytes --]

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Rich Freeman]

On Sun, Mar 22, 2015 at 4:21 AM, Ulrich Mueller <ulm@gentoo.org> wrote:
>>>>>> On Sun, 22 Mar 2015, Jeroen Roovers wrote:
>
>> Better yet, you can claim copyright on a "compilation" which is
>> probably what is effectively being done here. This is how people get
>> away with defending their copyright on publications of (slightly
>> modified/ abridged/ annotated, if at all) "compilations" of
>> centuries old works. Because copyright law.
>
> It doesn't work like this in our case. The Portage tree is licensed
> under the GPL-2. If someone takes a subset of ebuilds from it, it will
> be a "derivative work" and it cannot be distributed under any license
> other than the GPL-2.

That is true for the ebuilds that were copied/modified.  It isn't
necessarily true for other stuff stuck in the same tarball.

>
> It is even doubtful if any third-party ebuilds added to such a tree
> could be under a different license. If such ebuilds inherit from a GPL
> licensed eclass or depend on (or are depended on by) other ebuilds,
> they cannot "be reasonably considered independent and separate works
> in themselves".
>

That has been a longstanding argument with the GPL (you can link with
the LGPL under a non-free license, but not with the GPL).  However, it
has never actually been tested in court and I'm not convinced that it
will actually stand up.  The only content of the library/eclass/etc
that is present in the "derived work" are the names of symbols and the
name of the eclass and copyrighting those seems a lot like SCO arguing
that they can copyright signal enums.  They don't even get commingled
when you run the program - each gets loaded into its own set of memory
and the linker just fills in some memory addresses.

I'd think a judge would be as likely as not to say that the GPL would
only apply to the library itself, and that you could link whatever you
want to that library under any license at all, and that effectively
there is no distinction between the GPL and LGPL.  That is, if you get
the sort of judge who wouldn't give the win to SCO.

-- 
Rich

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 794 bytes --]

>>>>> On Sun, 22 Mar 2015, Rich Freeman wrote:
> On Sun, Mar 22, 2015 at 4:21 AM, Ulrich Mueller <ulm@gentoo.org> wrote:
>> It is even doubtful if any third-party ebuilds added to such a tree
>> could be under a different license. If such ebuilds inherit from
>> a GPL licensed eclass or depend on (or are depended on by) other
>> ebuilds, they cannot "be reasonably considered independent and
>> separate works in themselves".

> That has been a longstanding argument with the GPL (you can link
> with the LGPL under a non-free license, but not with the GPL).
> However, it has never actually been tested in court and I'm not
> convinced that it will actually stand up.

That's why I wrote "doubtful". To be on the safe side, one should go
with the FSF's interpretation of the matter.

Ulrich

[-- Attachment #2: Type: application/pgp-signature, Size: 490 bytes --]

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Mike Frysinger]

[-- Attachment #1: Type: text/plain, Size: 1283 bytes --]

On 22 Mar 2015 09:21, Ulrich Mueller wrote:
> >>>>> On Sun, 22 Mar 2015, Jeroen Roovers wrote:
> > Better yet, you can claim copyright on a "compilation" which is
> > probably what is effectively being done here. This is how people get
> > away with defending their copyright on publications of (slightly
> > modified/ abridged/ annotated, if at all) "compilations" of
> > centuries old works. Because copyright law.
> 
> It doesn't work like this in our case. The Portage tree is licensed
> under the GPL-2. If someone takes a subset of ebuilds from it, it will
> be a "derivative work" and it cannot be distributed under any license
> other than the GPL-2.

no, content is licensed, not directories.  you can't reasonably claim that all 
the various files/ (like patches we grab from elsewhere) are all under GPL-2- 
only.

> It is even doubtful if any third-party ebuilds added to such a tree
> could be under a different license. If such ebuilds inherit from a GPL
> licensed eclass or depend on (or are depended on by) other ebuilds,
> they cannot "be reasonably considered independent and separate works
> in themselves".

the combined work might be, but that doesn't mean the individual content itself 
can't be different.

-mike</personal opinion>

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 633 bytes --]

>>>>> On Sun, 22 Mar 2015, Mike Frysinger wrote:

> On 22 Mar 2015 09:21, Ulrich Mueller wrote:
>> It doesn't work like this in our case. The Portage tree is licensed
>> under the GPL-2.

Sorry, this wasn't as precise as it should have been. I should have
written "ebuilds in the Portage tree" here.

>> If someone takes a subset of ebuilds from it, it will be a
>> "derivative work" and it cannot be distributed under any license
>> other than the GPL-2.

> no, content is licensed, not directories. you can't reasonably claim
> that all the various files/ (like patches we grab from elsewhere)
> are all under GPL-2- only.

Ulrich

[-- Attachment #2: Type: application/pgp-signature, Size: 490 bytes --]

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Mike Frysinger]

[-- Attachment #1: Type: text/plain, Size: 298 bytes --]

On 07 Mar 2015 07:09, Rich Freeman wrote:
> in a way that creates opportunities ("hey, while we have you on the
> phone, did you realize how much you benefit from Gentoo, and are there
> ways we can better partner to improve things for all of our users?").

yes, apply for a job at Google ;)
-mike

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Matthias Maier]

> The README at both
>
> https://github.com/coreos/portage-stable
> and
> https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README
>

The individual headers in the ebuilds are intact.

This readme snipped might very well be just an oversight.

Best,
Matthias

[gentoo-project] Re: Bad license and attribution by ChromiumOS and CoreOS

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 1061 bytes --]

On Fri, Mar 6, 2015 at 6:22 PM, Patrick Lauer <patrick@gentoo.org> wrote:

> Good $timezonegreeting,
>
> The README at both
>
> https://github.com/coreos/portage-stable
> and
>
> https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README
>
> claims that:
>
> """
> Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
> Use of this source code is governed by a BSD-style license that can be
> found in the LICENSE file.
> """
>
> Since this is a copy of Gentoo ebuilds this is demonstrably wrong, the
> copyrights on the files themselves are intact. Copyright is obviously
> Gentoo Foundation, and license is GPL-2.
>
> I have been unable to find a proper contact for both repositories, so I
> hope people that know who to contact are reading this.
>

I will let the correct people at Google know.

-A


>
> Once this is corrected I'd strongly suggest to both downstreams to poste
> a prominent notice to inform all downstream users of this issue to avoid
> accidental license violations.
>
>
> Have fun,
>
> Patrick
>
>
>

[-- Attachment #2: Type: text/html, Size: 1859 bytes --]

Re: [gentoo-project] Re: Bad license and attribution by ChromiumOS and CoreOS

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1197 bytes --]

On Sat, 7 Mar 2015 11:11:08 -0800 Alec Warner wrote:
> On Fri, Mar 6, 2015 at 6:22 PM, Patrick Lauer <patrick@gentoo.org> wrote:
> 
> > Good $timezonegreeting,
> >
> > The README at both
> >
> > https://github.com/coreos/portage-stable
> > and
> >
> > https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README
> >
> > claims that:
> >
> > """
> > Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
> > Use of this source code is governed by a BSD-style license that can be
> > found in the LICENSE file.
> > """
> >
> > Since this is a copy of Gentoo ebuilds this is demonstrably wrong, the
> > copyrights on the files themselves are intact. Copyright is obviously
> > Gentoo Foundation, and license is GPL-2.
> >
> > I have been unable to find a proper contact for both repositories, so I
> > hope people that know who to contact are reading this.
> >
> 
> I will let the correct people at Google know.

Any news here? Two business days have passed already. And no action
from Google: both README files are still incorrect. If this is a
simple mistake, what takes so long to correct it?

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Re: Bad license and attribution by ChromiumOS and CoreOS

[Kristian Fiskerstrand]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 03/11/2015 06:22 AM, Andrew Savchenko wrote:
> On Sat, 7 Mar 2015 11:11:08 -0800 Alec Warner wrote:
>> On Fri, Mar 6, 2015 at 6:22 PM, Patrick Lauer
>> <patrick@gentoo.org> wrote:
>> 



> Any news here? Two business days have passed already. And no
> action from Google: both README files are still incorrect. If this
> is a simple mistake, what takes so long to correct it?
> 

My two cents; two days != long time for something non-critical (and by
that I mean house on fire).

- -- 
Kristian Fiskerstrand
Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJU//2cAAoJEP7VAChXwav6wi4H/31HckFOp8cphWY2/2woCf2T
AIo9jxYjBF7WokL1d3II9/qjpt1aWYJevZmbRAyW/nBAMgUfd1cxpsI3JT6azerE
hovLmqpiYU+Rn9JrLFxtecv57UYBEC1m7jKn1KQjWKacAXmhQaG+iFifoD2cYkOI
mi1O+7D1d9XPI5rL9b+Pw76/H73NriSpc0ojf3Pb05a8R2yac1c9V62aMa1RYDxN
AHpCPjHrgq5Oxg/awEv/aVxCaleooUVMeI0U8xv269UywMNrp1DXhqeXgl6b9RjK
YIPssU8b4Ju1jjboGmflNaLpVYg8xsV3GpERB6f+RGS50uiK3lv+G8AJR6Ptfcg=
=Vmpz
-----END PGP SIGNATURE-----

[gentoo-project] Re: Bad license and attribution by ChromiumOS and CoreOS

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 1555 bytes --]

On Sat, Mar 7, 2015 at 11:11 AM, Alec Warner <antarus@gentoo.org> wrote:

>
>
> On Fri, Mar 6, 2015 at 6:22 PM, Patrick Lauer <patrick@gentoo.org> wrote:
>
>> Good $timezonegreeting,
>>
>> The README at both
>>
>> https://github.com/coreos/portage-stable
>> and
>>
>> https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README
>>
>> claims that:
>>
>> """
>> Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
>> Use of this source code is governed by a BSD-style license that can be
>> found in the LICENSE file.
>> """
>>
>> Since this is a copy of Gentoo ebuilds this is demonstrably wrong, the
>> copyrights on the files themselves are intact. Copyright is obviously
>> Gentoo Foundation, and license is GPL-2.
>>
>> I have been unable to find a proper contact for both repositories, so I
>> hope people that know who to contact are reading this.
>>
>
> I will let the correct people at Google know.
>
>
Just for the record I'm not on gentoo-project, so if you don't reply to the
trustees I will never see it. In any case, someone requested an update; and
the update is that I have been busy at work (we just launched Google Cloud
Storage Nearline, yay!). Luckily Mike picked up my slack and contacted the
appropriate people and this is in-progress. Thanks Mike!

-A


> -A
>
>
>>
>> Once this is corrected I'd strongly suggest to both downstreams to poste
>> a prominent notice to inform all downstream users of this issue to avoid
>> accidental license violations.
>>
>>
>> Have fun,
>>
>> Patrick
>>
>>
>>
>

[-- Attachment #2: Type: text/html, Size: 3024 bytes --]

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Mike Frysinger]

[-- Attachment #1: Type: text/plain, Size: 819 bytes --]

While we agree that the README can be misleading, that was certainly not the 
point and has been updated:
	https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README

The history indicates this was more a matter of copy & paste from another repo, 
as well as trying to please an over-eager presubmit license check (said check 
was later disabled for this repo).

However, we do not see there being any compliance issues, so no further action 
will be taken at this time.

If anyone still has concerns/inquiries, please provide your contact info and 
we'll be happy to reach out personally to try to address them.

<personal opinion>
Lets follow Rich's suggestions and strike a more cordial tone.  Both sides only 
have the best of intentions here.
</personal opinion>
-mike

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Alexander Berntsen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 13/03/15 05:41, Mike Frysinger wrote:
> While we agree that the README can be misleading, that was certainly not the 
> point and has been updated:
> 	https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README
Ta, Mike.
- -- 
Alexander
bernalex@gentoo.org
https://secure.plaimi.net/~alexander
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iF4EAREIAAYFAlUCleEACgkQRtClrXBQc7U07wEApVwyE6OCBYwCnVnSX0PgDkMn
QRAhl78lFJ8qa2UI7XYBAKbJOimYHqOiVBk+FIlfThBEzItlmGG7PdPr76PlNtvb
=zVZk
-----END PGP SIGNATURE-----

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 381 bytes --]

On Fri, 13 Mar 2015 00:41:11 -0400 Mike Frysinger wrote:
> While we agree that the README can be misleading, that was certainly not the 
> point and has been updated:
> 	https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README

Good. But github repo is still not fixed:
https://github.com/coreos/portage-stable

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Rich Freeman]

On Fri, Mar 13, 2015 at 6:30 AM, Andrew Savchenko <bircoph@gentoo.org> wrote:
> On Fri, 13 Mar 2015 00:41:11 -0400 Mike Frysinger wrote:
>> While we agree that the README can be misleading, that was certainly not the
>> point and has been updated:
>>       https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README
>
> Good. But github repo is still not fixed:
> https://github.com/coreos/portage-stable
>

That is CoreOS, not ChromiumOS.  We should ping them about this
separately.  Since they're based on ChromiumOS I doubt they'll fuss
much over adopting the new README.

I posted this on their -dev "list":
https://groups.google.com/forum/#!topic/coreos-dev/goLG-5r8m1s

-- 
Rich

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Rich Freeman]

On Fri, Mar 13, 2015 at 7:26 AM, Rich Freeman <rich0@gentoo.org> wrote:
> On Fri, Mar 13, 2015 at 6:30 AM, Andrew Savchenko <bircoph@gentoo.org> wrote:
>> On Fri, 13 Mar 2015 00:41:11 -0400 Mike Frysinger wrote:
>>> While we agree that the README can be misleading, that was certainly not the
>>> point and has been updated:
>>>       https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README
>>
>> Good. But github repo is still not fixed:
>> https://github.com/coreos/portage-stable
>>
>
> That is CoreOS, not ChromiumOS.  We should ping them about this
> separately.  Since they're based on ChromiumOS I doubt they'll fuss
> much over adopting the new README.
>
> I posted this on their -dev "list":
> https://groups.google.com/forum/#!topic/coreos-dev/goLG-5r8m1s
>

... and they have changed the file in question.

-- 
Rich

Re: [gentoo-project] Bad license and attribution by ChromiumOS and CoreOS

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1094 bytes --]

On Fri, 13 Mar 2015 18:17:12 -0400 Rich Freeman wrote:
> On Fri, Mar 13, 2015 at 7:26 AM, Rich Freeman <rich0@gentoo.org> wrote:
> > On Fri, Mar 13, 2015 at 6:30 AM, Andrew Savchenko <bircoph@gentoo.org> wrote:
> >> On Fri, 13 Mar 2015 00:41:11 -0400 Mike Frysinger wrote:
> >>> While we agree that the README can be misleading, that was certainly not the
> >>> point and has been updated:
> >>>       https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/master/README
> >>
> >> Good. But github repo is still not fixed:
> >> https://github.com/coreos/portage-stable
> >>
> >
> > That is CoreOS, not ChromiumOS.  We should ping them about this
> > separately.  Since they're based on ChromiumOS I doubt they'll fuss
> > much over adopting the new README.
> >
> > I posted this on their -dev "list":
> > https://groups.google.com/forum/#!topic/coreos-dev/goLG-5r8m1s
> >
> 
> ... and they have changed the file in question.
 
Great job. GPL prevails :)
I'm CCing trustees here, so they can see that issue is resolved.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]