Rich0's Gentoo Blog

Gentoo and Copyright Assignments

with 10 comments

A topic that has been fairly quiet for years has roared into life on a few separate occasions in the last month within the Gentoo community: copyright assignments. The goal of this post is to talk a little about the issues around these as I see them. I’ll state upfront that I’m not married to any particular approach.

But first, I think it is helpful to consider why this topic is flaring up. The two situations I’m aware of where this has come up in the last month or so both concern contributions (willing or not) from outside of Gentoo. One concerns a desire to be able to borrow eclass code from downstream distros like Exherbo, and the other is the eudev fork. In both cases the issue is with the general Gentoo policy that all Gentoo code have a statement at the top to the effect of “Copyright 2012 Gentoo Foundation.”

Now, Diego has already blogged about some of the issues created by this policy already, and I want to set that aside for the moment. Regardless of whether the Foundation can lay claim to ownership of copyright on past contributions, the question remains, should Gentoo aim to have copyright ownership (or something similar) for all Gentoo work be owned by the Foundation?

Right now I’m reaching out to other free software organizations to understand their own policies in this area. Regardless of whether we want to have Gentoo own our copyrights or not there are still legal questions around what to put on that copyright line, especially when a file is an amalgamation of code originated both inside and outside of Gentoo, perhaps even by parties who are hostile to the effort. I can’t speak for the Trustees as a whole, but I suspect that after gathering info we’ll try to have some open discussion on the lists, and perhaps even have a community-wide vote before making new policy. I don’t want to promise that – in fact I’d recommend that any community-wide vote be advisory only unless a requirement for supermajority were set, as I don’t want half the community up in arms because a 50.1% majority passed some highly unpopular policy.

So, what are some of the directions in which Gentoo might go? Why might we choose to go in these directions? Below I outline some of the options I’m aware of:

Maintain the status quo
We could just leave the issue of copyright assignment somewhat ambiguous as has been done. If Gentoo were forced to litigate over copyright ownership right now an argument could be made that because contributors willingly allowed us to stick that copyright notice on our files and made their contribution with the knowledge of our policies, that they have given implicit consent to our doing so.

I’m not a big fan of this approach – it has the virtue of requiring less work, but really has no benefits one way or the other (and as you’ll read below their are benefits from declaring a position one way or the other).

This requires us to come up with a policy around what goes on the copyright notice line. I suspect that there won’t be much controversy for Gentoo-originated work like most ebuilds, as there isn’t much controversy over them now. However, for stuff like eudev or code borrowed from other projects this could get quite messy. With no one organization owning much of the code in any file the copyright line could become quite a mess.

Do not require copyright assignment
We could just make it a policy that Gentoo would aim to own the name Gentoo, but not the actual code we distribute. This would mean that we could freely accept any code we wished (assuming it was GPL or CC BY-SA compatible per our social contract). This would also mean that Gentoo as an organization would find it difficult to pursue license violations, and future relicensing would be rather difficult.

From an ability to merge outside code this is clearly the preferred solution. This approach still carries all the difficulties of managing the copyright notice, since again no one organization is likely to hold the majority of copyright ownership of our files. Also, if we were to go this route we should strongly consider requiring that all contributions be licensed under GPL v2+, and not just GPL v2. Since Gentoo would not own the copyright if we ever wanted to move to a newer GPL version we would not have the option to do so unless this were done.

Gentoo would still own the name Gentoo, so from a branding/community standpoint we’d have a clear identity. If somebody else copied our code wholesale the Foundation couldn’t do much to prevent this unless we retroactively asked a bunch of devs to sign agreements allowing us to do so, but we could keep an outside group from using the name Gentoo, or any of our other trademarks.

Require copyright assignment
We could make it a policy that all contributions to Gentoo be made in conjunction with some form of copyright assignment, or contributor licensing agreement. I’ll set aside for now the question of how exactly this would be implemented.

In this model Gentoo would have full legal standing to pursue license violations, and to re-license our code. In practice I’m not sure how likely we’d actually be to do either. The copyright notice line would be easy to manage, even if we made the occasional exception to the policy, since the exceptions could of course be managed as exceptions as well. Most likely the majority of the code in any file would only be owned by a few entities at most.

The downside to this approach is that it basically requires turning away code, or making exceptions. Want to fork udev? Good luck getting them to assign copyright to Gentoo.

There could probably be blanket exceptions for small contributions which aren’t likely to create questions of copyright ownership. And we could of course have a transition policy where we accept outside code but all modifications must be Gentoo-owned. Again, I don’t see that as a good fit for something like eudev if the goal is to keep it aligned with upstream.

I think the end result of this would be that work that is outside of Gentoo would tend to stay outside of Gentoo. The eudev project could do its thing, but not as a Gentoo project. This isn’t necessarily a horrible thing – OpenRC wasn’t really a “Gentoo project” for much of its life (I’m not quite sure where it stands at the moment).

Alternatives
There are in-between options as well, such as encouraging the voluntary assignment/licensing of copyright (which is what KDE does), or dividing Gentoo up into projects we aim to own or not. So, we might aim to own our ebuilds and the essential eclasses and portage, but maybe there is the odd eclass or side project like eudev that we don’t care about owning. Maybe we aim to own new contributions (either all or most).

There are good things to be said for a KDE-like approach. It gives us some of the benefits of attribution, and all of the benefits of not requiring attribution. We could probably pursue license violations vigorously as we’d likely hold control of copyright over the majority of our work (aside from things like eudev – which obviously aren’t our work to begin with). Relicensing would be a bit of a pain – for anything we have control over we could of course relicense it, but for anything else we’d have to at least make some kind of effort to get approval. Legally that all becomes a murky area. If we were to go with this route again I’d probably suggest that we require all code to be licensed GPL v2+ or similar just to give us a little bit of automatic flexibility.

I’m certainly interested in feedback from the Gentoo community around these options, things I hadn’t thought of, etc. Feel free to comment here or on gentoo-nfp.

About these ads

Written by rich0

December 15, 2012 at 8:43 am

10 Responses

Subscribe to comments with RSS.

  1. It might be worth noting that copyright assignment is sometimes not possible not only due to unwillingness of the copyright holder but also the other legal issues. As Diego pointed out in (most of) Europe you cannot assign part of the right to other party – namely the moral rights ( http://en.wikipedia.org/wiki/Moral_rights_(copyright_law) ). So person from Europe can license (or wive economic rights) the code to Gentoo Fundation but not assign it. Requiring to assign code would be, I believe, null from legal standpoint (however IANAL).

    Maciej Piechotka

    December 15, 2012 at 10:39 am

    • This would be why I used the words “some form of copyright assignment, or contributor licensing agreement. I’ll set aside for now the question of how exactly this would be implemented.”

      Copyright assignment is completely legal in every jurisdiction that currently recognizes the Gentoo Foundation. However, I suspect that using an approach like the FSFe’s FLA would probably make more sense for the reasons you and Diego raised.

      I specifically avoided the mechanics of how we would implement this as the bigger question is whether we WANT to implement copyright assignment, or whatever you want to call it to satisfy the European courts.

      In practice there is little difference in the end between the FSFe FLA and US copyright assignment, beyond whether certain courts accept the agreement. All the limitations in my post apply equally to both situations.

      rich0

      December 15, 2012 at 10:44 am

  2. For the record: Exherbo is *not* any kind of “downstream” distro. We’re not using Gentoo stuff.

    Wulf C. Krueger

    December 17, 2012 at 9:05 am

    • Apologies – wasn’t quite sure what the right term would be. Obviously there is some kind of relationship, otherwise we wouldn’t have developers interested in “borrowing” your eclasses.

      rich0

      December 17, 2012 at 9:16 am

  3. Patents and copyrights were originally intended to encourage innovation, development and support, but extremism in law has greatly reduced their utility. Perhaps what’s needed is reform.

    SomSomewhat.Reticent@sharklasers.comewhat Reticent

    December 17, 2012 at 4:18 pm

  4. CLAs that permit relicensing might be a reasonable position. Although at this point it’s so legally muddled we’re probably stuck at GPL2 anyway.

    Donnie Berkholz (@dberkholz)

    December 20, 2012 at 11:55 pm

    • Yeah, that was my sense as well. Perhaps a CLA that is optional, or make clear policy that all contributions are licensed GPL2+. That would at least give us some future flexibility.

      No harm in fixing things moving forward at least. Code does get replaced, so if we improve our policies some of our errors will tend to fix themselves, albeit slowly.

      rich0

      December 21, 2012 at 12:07 am

      • Don’t think optional is the issue, rather making it absolutely, mind-bendingly trivial to agree to a CLA. Must be online only, not scanning, faxing, physical copies, etc.

        Donnie Berkholz (@dberkholz)

        December 21, 2012 at 12:21 am

        • Oh, I agree 100% on that bit. That will require us to review electronic signature laws though. From what I’ve seen they’re astonishingly lax, but I haven’t really dug into them in general. Since our devs all have GPG keys if nothing else we could ask them to digitally sign that way – it would be FAR more rigorous than most e-sig implementations I’ve seen which usually just amount to somebody filling out a form and saying “yes, it’s me.”

          But I haven’t really read the letter of the law there, and that is obviously necessary before actually implementing something.

          rich0

          December 21, 2012 at 8:12 am

  5. While I agree that it would be good to have it clearly stated (eg when submitting patches) that any contributions to Gentoo ebuilds and the like are part of a larger work which is copyright Gentoo, I’m unsure what’s wrong with a developer or a user simply putting (C) Copyright 2012 by the Gentoo Foundation Inc at the top of an ebuild they submit. I’ve done it before, also with C code.

    Contributions are all tracked via cvs history and bug-reports, so in the unlikely event that moral rights became an issue, they could still be traced.

    With respect to a project like eudev, I see that as simple misunderstanding. You can’t just put Copyright on a file that you haven’t done anything to, and when you do modify, you still have to keep the original notices intact.

    IMO though I am not a lawyer, you’re perfectly at liberty to state that the new project as a whole is your copyright in an overarching file, however, so long as you include the notices stipulating that it is based on other people’s copyrighted work.

    If that’s a lot of people, you can state “Based on the udev project, copyright 20xx to 2012 by various contributors as noted in the individual files.” Ultimately it’s about notifying anyone who wants to copy it about whose copyright the work is, and not claiming it as your sole copyright, and it’s up to them to look at individual files if that’s relevant to them, eg if they only want to copy a single file or want to check its provenance. You are not claiming copyright on the individual files, but the whole combined package with your modifications, which are your copyright, and you acknowledge that it is substantively derived from other copyrighted work, which you do not pretend to be yours.

    The license you received that work under gives you the right to modify and distribute so long as it’s under the same license. It does not take your copyright over your work away from you, nor anyone else.

    The only thing to bear in mind is the threshold for claiming copyright: an under 10-line fix, for example isn’t going to cut it, though I have seen minor patches where people claim copyright and a contributor line. iirc a 3rd of the file was given as a threshold on the list. Personally I’d just work on the code and see how it goes. Minor fixes should go upstream in any case (though perhaps only if they’re uncontroversial in this case.)

    SteveL

    December 21, 2012 at 6:45 am


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

%d bloggers like this: