RISK-000008 Incomplete coverage of CLAs

6a6d74 commented 6 years ago

Incomplete coverage of Contributor License Agreements (e.g. all Contributors have not signed them) exposes the Association to intellectual property claims.

6a6d74 commented 6 years ago

Probability	Financial impact	Reputation impact	Goals impact
VL	H	VH	Vl

6a6d74 commented 6 years ago

Risk discussed at SC-2018.

Mitigation actions include:

getting CLAs signed (responsibility of Technical Committee)
getting them stored securely online

See also:

ACTION-SC-2017-19 Submit completed CLA forms (#190)
ACTION-SC-2017-72 Finalize the CLA as-is and obtain signed copies from all contributors (#342)

jude2018 commented 6 years ago

Latest status of CLA tasks -https://github.com/OpenWIS/openwis-documentation/projects/3?

6a6d74 commented 5 years ago

Further discussions with NWS about completing the CLA during SC May-2019. Actions and next steps agreed. Fred Branski is progressing this from NWS perspective.

jude2018 commented 5 years ago

Detail information on progress and issues are in #456

jude2018 commented 4 years ago

Awaiting a draft text from NWS @klsheets to follow up

jude2018 commented 4 years ago

Please also see #456 for action plan agreed at the SC May 2019

6a6d74 commented 4 years ago

2020 Annual Technical Committee meeting:

@6a6d74 / @jeremytandy and Fred Branski agreed to be the organizational contact points for resolving the USA issues with the CLA. As it currently stands, NWS / NOAA cannot sign the agreement as it does not comply with US law.

Dialogue needs to be restarted between legal councils in UK and USA to find a workable compromise for the 1-2% of the CLA that is causing the problem.

Depending on the changes, other OpenWIS Members / Partners may need to sign the amended CLA ... but only if it materially changes the agreement.

6a6d74 commented 4 years ago

Email sent to Michael Robbins ...

jude2018 commented 4 years ago

Per Board of 4 June 2020 - agreed to review at the September 2020 SC and Board

jude2018 commented 4 years ago

@klsheets is there an udpate ?

jude2018 commented 4 years ago

Per SC and Board of 29 Sep and 1 Oct - CLA update to accomodate the OpenCDMS project approved (https://github.com/OpenWIS/openwis-documentation/issues/601) and actions in progress to agree CLA with NWS (https://github.com/OpenWIS/openwis-documentation/issues/456)

So no change in the risk assessment

jude2018 commented 3 years ago

Inital CLA for OpenCDMS received

jude2018 commented 3 years ago

Per SC on 7 Dec 2020 -

@6a6d74 to check with Peer Heckler (WMO) as to when a new CLA Is expected/needed for OpenCDMS to enable a decision on creating an interim CLA (i..e a potential interm CLA to accomodate OpenCDMS needs ahead of agreeing CLA terms with NOAA/NWS)

jude2018 commented 3 years ago

Per SC on 7 December 2020 -

@6a6d74 to update CLA clauses referring with documentation and data assets in respect of OpenCDMS needs (in liaison with Michael Robbins)

jude2018 commented 3 years ago

Per annual TC - The TC to establish the most current version of the CLA that should be used and published on the Association website @solson-nws

jude2018 commented 3 years ago

Per SC on 19 May - @6a6d74 and @jude2018 to inform NWS and UKMO Legal representatives that the Association needs to make a decsion by September 2021 on whether to have one CLA that covers all projects or whether to have specific CLAs for each project.

jude2018 commented 3 years ago

Per meeting on 23 June 2021 with Michael Robbins , Fred Branski and Derrick Hanson:

Board to consider the need the indemnification clause, i..e the risk of not having this clause in the current CLA (v4, Section 7).
Directors to consider whether to remove point no.9 in section 11 of CLA v4.
Proposed text for section 7 for US gov employees only.

"The Government agrees to promptly consider and adjudicate any and all claims that may arise out of this Agreement resulting from the actions of the Government, duly authorized representatives, or contractors of the Government, and to pay for any damage or injury as may be required by Federal law. Such adjudication will be pursued under the Federal Tort Claims Act, 28 U.S.C. § 2671 et seq., the Federal Employees Compensation Act, 5 U.S.C. § 8101 et seq., or such other Federal legal authority as may be pertinent."

Next steps

Derrick to review sections 8 and 9 with NOAA Legal of CLA v4.

If these points are agreeable a single/common CLA is possible. Other options are specific CLA or no CLA both of which are possible legally.

jude2018 commented 3 years ago

Updated proposed CLA v5 (which is based on agreements with NOAA Legal ) is available for @6a6d74 to review

isedwards commented 3 years ago

Is the OpenWIS Association happy for contributors to electronically sign the CLA form using their GitHub account instead of requiring a paper form?

In the OpenCDMS Project we are using cla-bot to automatically ensure that a Contributor's Licence Agreement is in place for all pull requests, thus ensuring 100% coverage.

We would also like to allow contributors to use their GitHub account to electronically sign the Contributor's Licence Agreement using a "verified commit" that is verified by github.com.

This guarentees that the person who owns the GitHub account that is submitting the code under that username has electronically signed the CLA - which is more certain than a unverifiable signature on a piece of paper that could also be lost.

An example of this can be seen here: https://github.com/opencdms/clabot-config/issues/4

jude2018 commented 3 years ago

Hi @isedwards,

To me this seems a good step to automate CLA signing and its maintenance. Could you please elaborate on the process for setting up a GitHub account (i.e. what steps are taken to ensure that a Github account is authentic)?

I think your propsal would need to be agreed by the Steering Committee (this can be done ex-committee, i..e. by commenting on this 'issue'.

Hope this helps

Jude

isedwards commented 3 years ago

In the case of the paper form:

When the form is passed around the office another employee could make up a signature because you're working from home
Your manager could create a plausible signature and sign for you (e.g. if you're away on holiday for two weeks and they want the form out of the way)
I could create a email account like jude2018_home@gmail.com, fill out the form with your details, submit it and it would probably be accepted

In the case if a GitHub Verified Commit

Only you can log into GitHub as jude2018
We can require two factor authentication to be even more certain that it really is jude2018
When you are logged in then only you can make the GitHub Verified Commit to agree to the CLA as @jude2018
We then accept contributions coming from GitHub user @jude2018

jude2018 commented 3 years ago

@isedwards - When setting up an account, how for example is Jude2018 verified as 'Jude'?

isedwards commented 3 years ago

It's the same as with paper CLAs - If @jude2018 were to submit code to OpenWIS Core would we know that @jude2018 is 'Jude'? Would we accept the contribution?

GitHub are not verifying that @jude2018 is 'Jude' any more than they are now, but they are verifying that GitHub user @jude2018 made the commit that agreed to the CLA.

With electronic signing we know everything we know with paper forms, but we also know that the person who signed the CLA is the same as the person making pull requests.

In OpenCDMS we're now doing both paper and electronic signing... but we have lost code contributions in the past from volunteers who don't have easy access to a printer and/or scanner and so we've not merged their contribution.

jude2018 commented 3 years ago

Thanks for the info an explanation @isedwards, I understand the reasons and others can refer to the posts immediately above to get the contesxt etc. :-)

I'll let @solson-nws and @davidpodeur (Vice Chair and Chairs of the Technical Committee comment re current rules (ref here - http://openwis.github.io/openwis-documentation/static/CLA/CLAform.html)

Its then upto the Chairs of the Steering Committee (i.e. @6a6d74 and @remygiraud ) to decide whether to take a decision ex-committee or to take this item alongside the point on the wider CLA (i..e https://github.com/OpenWIS/openwis-documentation/issues/494#issuecomment-866955777) at the SC meeting on 27 September 2021. :-)

jude2018 commented 2 years ago

per SC on 27 September 2021:

1) @klsheets - to confirm with Derrick Hanson that marking a commit is sufficent for US Government work.

2) @jude2018 to store document from Michael Robbins as a document of record.

3) @solson-nws assess proposal for CLA-BOT and verified-commit to determine if it is easy to incorporate into OpenWIS projects with the technical committee.

4) @6a6d74 to confirm if steering committee need to resign the CLA V5.

jude2018 commented 2 years ago

Next review at SC on January 2022

JoeDavies90 commented 2 years ago

Next review at TC and SC in May 2022

JoeDavies90 commented 2 years ago

Dear All, please can you provide an update to the below actions. @klsheets - to confirm with Derrick Hanson that marking a commit is sufficent for US Government work.

@solson-nws assess proposal for CLA-BOT and verified-commit to determine if it is easy to incorporate into OpenWIS projects with the technical committee.

@6a6d74 to confirm if steering committee need to resign the CLA V5.

OpenWIS / openwis-documentation

RISK-000008 Incomplete coverage of CLAs #494