search

ckan / cla

Other
0 stars 3 forks source link

adopt Developer Certificate of Origin #2

Open wardi opened 10 years ago

wardi commented 10 years ago

background: http://lwn.net/Articles/592503/

There are three important components to any contributor agreement: an assertion that the contributor has the right to contribute the code, a statement of actual contribution, and consent that the code may be distributed under the project's licenses.

Every project should be able to prove that every line of code it distributes was intentionally contributed... A project can't just pick up patches off the street and hope that all will be well; if the code was not overtly contributed, the author could always try to revoke the project's right to the code, leading to trouble.

Equity is one of the fundamental principles of the free software community; it is important that everybody meets on an equal basis. But, when company lawyers sit down to write a contributor agreement, they will naturally write that agreement to favor their employers; that is just part of what lawyers do. The result is inequity, and that destroys communities.

(emphasis mine)

http://developercertificate.org/

seanh commented 10 years ago

To clarify, the suggestion is to use DCO instead of the current CLA?

wardi commented 10 years ago

@seanh yes.

From the lwn article:

the DCO offers everything that a project needs for a contributor agreement... The more projects that use this agreement, the easier it will be for developers to contribute code to projects on an equal basis without the need for undue paperwork.

seanh commented 10 years ago

It does seem a lot simpler. It keeps on saying things like "The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file", but I'm not sure what file that refers to. The source code file that the contribution modifies? In that case we may need to add a license statement to the top of each source code file. Also shouldn't that be the files?

But anyway this seems simple and sounds good to me

wardi commented 10 years ago

I think technically each file covered by the AGPL needs a line that says that it is covered by the AGPL. It is possible to distribute source with multiple compatible licenses, so that might be why they wrote it that wayt

wardi commented 10 years ago

just pasted some quotes from the lwn.net article into the description above, for those that TL;DR

jpmckinney commented 10 years ago

+1 Using standard legal text should always be preferred, where possible.

rufuspollock commented 8 years ago

@wardi I'm not totally clear on difference vs current CLA (which is taken from jQuery project). Could you summarize differences.

I also have had engagement in past with http://harmonyagreements.org/ - standardized CLA's. Current choice was based on Irina's research about best practice out there.

wardi commented 8 years ago

IANAL of course. My understanding is the DCO satisfies the legitimate legal concerns around accepting code from outside contributors.

The jQuery CLA does the same but also gives the creators of jQuery an advantage over outside contributors of code.

If we're talking about taking the re-licensing part out of the jQuery CLA https://github.com/ckan/cla/pull/8 why not use a CLA we don't need to modify?

rufuspollock commented 8 years ago

@wardi my question here was if you had specific understanding of differences between current proposed CLA (which was based on some efforts done already) modulo change and the DCO. A short point by point summary of differences would be really useful. There are lots of other CLAs we could look at. the question is whether the current one is sufficient - which we have all already looked at quite a bit :-)

A short summary of differences would be really useful :-)

wardi commented 8 years ago

ok, here's my understanding of the differences based on sections in the current proposed CLA.

You grant to the Open Knowledge Foundation...

DCO (d) makes it clear that contributions are going to be public, maintained indefinitely and redistributed under the open source license. The DCO has no requirement for the developer to give extra rights on their work to Open Knowledge. This is the key difference.

You are able to grant us these rights...

Doesn't apply to the DCO as there is no additional grant of rights like the previous paragraph.

The Contributions are your original work...

DCO (a) is similar but less restrictive, allowing developers to also contribute code that is partially theirs and DCO (b) and (c) allows people to contribute code from other developers that is appropriately licensed, without needing to find all the original developers and have them agree to this agreement as well.

We determine the code that is in our project...

The DCO has no similar language. I don't know why it's necessary. Is someone going to claim that this agreement requires Open Knowledge to accept their contribution? That seems far-fetched.

No Implied Warranties...

The DCO has no similar language about protecting the contributor from warranty claims from Open Knowledge. I think Open Knowledge making warranty claims against contributors is also pretty far-fetched.