March 2014 - legal-discuss - lists.openstack.org

Licensing of documentation
by Richard Fontana 16 Mar '15

16 Mar '15

Hi, Certain manuals available at docs.openstack.org contain this legal notice: Copyright © 2013 OpenStack Foundation Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. followed immdiately by a box that says: Except where otherwise noted, this document is licensed under Creative Commons Attribution ShareAlike 3.0 License http://creativecommons.org/licenses/by-sa/3.0/legalcode This github repository suggests at quickest glance that Apache License 2.0 is the license: https://github.com/openstack/openstack-manuals Some docs writers at Red Hat were previously under the impression that CC BY was the license of OpenStack documentation, which I assume is incorrect except for material specifically on wiki.openstack.org. Can anyone clarify? We'd like to adapt some portions of the upstream documentation in our product documentation and we want to make sure we get the licensing right. Thanks! Richard Fontana Legal Red Hat, Inc.

4 6

Copyright statements in source
by Rich Bowen 12 Jun '14

12 Jun '14

Stefano suggested that I bring this to the legal-discuss list. I know that this has been discussed in the past, so I don't anticipate a great shift in sentiment, but it seemed worth discussing. My full thoughts are on my blog - http://drbacchus.com/copyright-statements-in-source-files - and I know some of you have seen this discussed on the docs mailing list, or seen it on planet.openstack Anyways, it has been my experience in Open Source communities that having a copyright statement at the top of a source file can be very off-putting to people who want to contribute to that file, due to the perception that it is "owned" by someone in particular. The statement is not necessary: copyright law ensures that contributors have copyright on the content that they author, and git keeps a permanent record of who contributed what. Some folks have claimed (the last time this came up on this list) that the statement was necessary, and this is not the case. It's also unscalable - think in terms of 10 years from now when every file potentially lists hundreds of copyright holders - or perhaps only those who saw fit to add their name to the growing list. What would this contribute? And if people are contributing solely for recognition - which seems at least part of the motivation for a copyright statement, perhaps 1) they're missing the point of Open Source and 2) we should provide a more public means of thanking the enormous list of contributors, rather than having it scattered across thousands of files that relatively few people will ever see. -- Rich Bowen - rbowen(a)redhat.com OpenStack Community Liaison http://openstack.redhat.com/

15 39

Re: [legal-discuss] Why is marconi a queue implementation vs a provisioning API?
by Paul Querna 30 Mar '14

30 Mar '14

> On 3/20/14, 8:22 AM, Richard Fontana wrote: > > On Thu, Mar 20, 2014 at 08:22:12AM +0000, Mark McLoughlin wrote: > >> I'm no fan (personally) of AGPLv3, but taking a stance that there must > >> be a way of deploying OpenStack in production without requiring any > >> AGPLv3 code to be deployed is a significant policy decision for the > >> project and I don't think we've ever articulated the reasons clearly for > >> it. > > Such a policy would be unprecedented for any Apache License 2.0 > > project as far as I am aware. For comparisons look at the legal > > policies of the Apache Software Foundation, which don't go this far. > > > Such a policy needs to be made on a project-by-project basis, as well, > especially w/r/t AGPL code. MongoDB/10Gen has communicated very clearly > where they consider their copyright boundary to exist, and I believe > that legally that functions as a waiver/license if they would ever end > up being wrong (which I don't think they would, as I believe a network > communication creates a copyright boundary). > Thanks, > Van The ASF has been dealing with optional dependencies and their license interactions with the Apache License for a long time. They have formed at the least more "in depth" documentation on how all of it interacts, specifically as it relates to the issues presented here, I think it is reasonable to refer to: http://www.apache.org/legal/resolved.html#optional "Will the majority of users want to use my product without adding the optional components?" This is clearly false in the case of Marconi as it stands today. MongoDB might be "optional", but it is the only realistic choice. An additional document that hasn't quite moved all the way through the ringer, and hence still "proposed" at the ASF is this one: https://www.apache.org/legal/3party.html The contents of the Guiding Principles seem perfectly aligned with OpenStack. I think it also does a good job of laying out both groups of licenses based on their properties, and how projects can depend on or build modules with mixed license dependencies. Things like classifying "System Requirements" are a good fit for projects like Nova, which have many plugins for restricted licensed Hypervisors for example. I would love to help see this kind of documentation get added to the Legal FAQ / references for OpenStack. What is the best set of actions to get there? Port the "LegalIssuesFAQ"[1] to a git report and start proposing changes in a Code Review? Thanks, Paul [1] - https://wiki.openstack.org/wiki/LegalIssuesFAQ

2 1

[Fwd: Re: [openstack-dev] [Marconi] Why is marconi a queue implementation vs a provisioning API?]
by Mark McLoughlin 27 Mar '14

27 Mar '14

-------- Forwarded Message -------- > From: Matt Asay <matt.asay(a)mongodb.com> > Reply-to: "OpenStack Development Mailing List \(not for usage > questions\)" <openstack-dev(a)lists.openstack.org> > To: openstack-dev(a)lists.openstack.org > Subject: Re: [openstack-dev] [Marconi] Why is marconi a queue > implementation vs a provisioning API? > Date: Thu, 27 Mar 2014 10:26:46 -0600 > > In response to Gil Yehuda's comments on MongoDB and the AGPL > (here http://lists.openstack.org/pipermail/openstack-dev/2014-March/030510.html), I understand the concern about the AGPL. But in this case it's completely, absolutely unfounded. As mentioned earlier, MongoDB Inc. wants people to use MongoDB, the project. That's why we wrapped the server code (AGPL) in an Apache license (drivers). Basically, for 99.999% of the world's population, you can use MongoDB under the cover of the Apache license. If you'd like more assurance, we're happy to provide it. > > > We want people using the world's most popular NoSQL database with the > world's most popular open source cloud (OpenStack). I think our track > record on this is 100% in the affirmative. > _______________________________________________ > OpenStack-dev mailing list > OpenStack-dev(a)lists.openstack.org > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev

1 0

Re: [legal-discuss] [openstack-dev] [Marconi] Why is marconi a queue implementation vs a provisioning API?
by Matt Asay 27 Mar '14

27 Mar '14

In response to this thread: http://lists.openstack.org/pipermail/legal-discuss/2014-March/000174.html As a general rule, MongoDB reads the AGPL generously and broadly to allow unfettered use of the database. See, for example, our licensing policy: http://www.mongodb.org/about/licensing/ I or our legal counsel would be happy to discuss this with the relevant parties at OpenStack. We'd love to see more organizations using MongoDB with OpenStack. Matt ------- { name : "matt asay", title : "vp, business development & marketing", twitter/skype : "@mjasay", website : "www.mongodb.com" }

1 0

License for design specifications (blueprints)
by Russell Bryant 24 Mar '14

24 Mar '14

The Nova project is looking to move the content of design specifications to a git repository for the Juno development cycle [1]. The contents of this repository will not be code. It will primarily be documentation. Right now we put the Apache 2 LICENSE file in the repository and have the same license header in the template used for specifications. http://git.openstack.org/cgit/openstack/nova-specs/tree/LICENSE http://git.openstack.org/cgit/openstack/nova-specs/tree/template.rst Is this licensing the proper choice here? If not, what should we use instead? Thanks, [1] http://lists.openstack.org/pipermail/openstack-dev/2014-March/030576.html -- Russell Bryant

6 10

[Fwd: Re: [openstack-dev] [Marconi] Why is marconi a queue implementation vs a provisioning API?]
by Mark McLoughlin 21 Mar '14

21 Mar '14

-------- Forwarded Message -------- > From: Gil Yehuda <gyehuda(a)yahoo-inc.com> > Reply-to: "OpenStack Development Mailing List \(not for usage > questions\)" <openstack-dev(a)lists.openstack.org> > To: OpenStack Development Mailing List (not for usage questions) > <openstack-dev(a)lists.openstack.org> > Subject: Re: [openstack-dev] [legal-discuss] [Marconi] Why is marconi > a queue implementation vs a provisioning API? > Date: Thu, 20 Mar 2014 17:09:32 +0000 > > >To be clear, Marconi does not incorporate any AGPL code itself; pymongo is > Apache2 licensed. > > Understood, but here's the rub. Someone else is going to want to build on this (which it the point of this open source project). Whereas 'pymongo' is Apache licensed, since the copyright holder, MongoDB Inc. declared it as such, the authors of the other community drivers (for other language bindings and features of MongoDB, etc.) are also of releasing drivers under the Apache or BSD licenses too (thinking that's OK to do since no one is telling them otherwise). That community is unaware of their legal obligations when creating drivers to an AGPL database. Thus if one of those community drivers gets intertwined in a court case clarifying their license to be infringing on the AGPL terms, we've inadvertently impacted our community. This is a credible risk that is difficult for OpenStack to abate, since the problem lies with the way a different community chose to operate. > > There are three interconnected issues here: > 1. The confusion that MongoDB has created in Open Source licensing due to the asymmetric control they have on licensing terms. > 2. The diligence of Open Stack to remain careful with OpenStack's CLA compliance and Apache-friendly terms. > 3. The pragmatics of the effect MondgoDB would have onto OpenStack's economic viability and legal risks at large. > > The first problem is out of scope for this list. But I think people who rely upon Open Source for their business ought to understand what MongoDB is doing to open source software. The second is, to your point, the issue in this conversation. As long as Openstack only use Apache licensed code >>from MondgoDB Inc.<< and diligently avoids using any open source contributions from any community contributor to the MongoDB ecosystem, then you remain compliant the your CLA. But you will have to exclude the rest of the MongoDB community (which goes against the spirit of Open Source -- back to the problem #1, which is out of scope). As for #3, I think the foundation needs to weigh in on the pragmatics here, since this has an economic and legal impact to the entire endeavor, not just to persisting data in one component of the project. > > Gil Yehuda > Sr. Director Of Open Source, Open Standards > > -----Original Message----- > From: Kurt Griffiths [mailto:kurt.griffiths@rackspace.com] > Sent: Thursday, March 20, 2014 9:29 AM > To: OpenStack Development Mailing List (not for usage questions) > Subject: Re: [openstack-dev] [legal-discuss] [Marconi] Why is marconi a queue implementation vs a provisioning API? > > > The incorporation of AGPLv3 code Into OpenStack Project is a > >significant decision > > > > _______________________________________________ > OpenStack-dev mailing list > OpenStack-dev(a)lists.openstack.org > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev

3 2

Re: [legal-discuss] License for design specifications (blueprints)
by Monty Taylor 20 Mar '14

20 Mar '14

++ On Mar 20, 2014 9:12 PM, Russell Bryant <rbryant(a)redhat.com> wrote: > > On 03/20/2014 01:06 PM, Russell Bryant wrote: > > The Nova project is looking to move the content of design specifications > > to a git repository for the Juno development cycle [1]. The contents of > > this repository will not be code. It will primarily be documentation. > > > > Right now we put the Apache 2 LICENSE file in the repository and have > > the same license header in the template used for specifications. > > > > http://git.openstack.org/cgit/openstack/nova-specs/tree/LICENSE > > http://git.openstack.org/cgit/openstack/nova-specs/tree/template.rst > > > > Is this licensing the proper choice here? If not, what should we use > > instead? > > > > Thanks, > > > > [1] > > http://lists.openstack.org/pipermail/openstack-dev/2014-March/030576.html > > > > To possibly answer my own question ... > > I found in a previous thread that the board officially approved using > CC-BY for documentation here: > > https://wiki.openstack.org/wiki/Governance/Foundation/15Oct2012BoardMinutes…. > > So perhaps we should be using that since this is effectively > documentation? I also expect that this content be used heavily when > developing the official project documentation based on the features > described in these specifications. > > -- > Russell Bryant > > _______________________________________________ > legal-discuss mailing list > legal-discuss(a)lists.openstack.org > http://lists.openstack.org/cgi-bin/mailman/listinfo/legal-discuss >

2 1

Re: [legal-discuss] [openstack-dev] [Marconi] Why is marconi a queue implementation vs a provisioning API?
by Monty Taylor 20 Mar '14

20 Mar '14

Ianal, but I know there are some lawyers out there who are concerned that the mechanism of attachment is vague. If there is an issue (I'm not saying there is) I don't think mongodb's view is relevant, as they are quite likely to be bought by someone, say Oracle, who might not share and would not be bound by that opinion. That said, I don't think a mongo driver is an issue, as long as it's not the only driver... That way deployers can make an agpl call on their own. We've had mongo driver for ceilometer for a while. On Mar 20, 2014 7:28 AM, Richard Fontana <rfontana(a)redhat.com> wrote: > > Why not contact MongoDB to understand its viewpoint, if there's > concern? > > > > On Wed, Mar 19, 2014 at 09:38:53PM +0000, Fox, Kevin M wrote: > > Its my understanding that the only case the A in the AGPL would kick in is if the cloud provider made a change to MongoDB and exposed the MongoDB instance to users. Then the users would have to be able to download the changed code. Since Marconi's in front, the user is Marconi, and wouldn't ever want to download the source. As far as I can tell, in this use case, the AGPL'ed MongoDB is not really any different then the GPL'ed MySQL in footprint here. MySQL is acceptable, so why isn't MongoDB? > > > > It would be good to get legal's official take on this. It would be a shame to make major architectural decisions based on license assumptions that turn out not to be true. I'm cc-ing them. > > > > Thanks, > > Kevin > > ________________________________________ > > From: Chris Friesen [chris.friesen(a)windriver.com] > > Sent: Wednesday, March 19, 2014 2:24 PM > > To: openstack-dev(a)lists.openstack.org > > Subject: Re: [openstack-dev] [Marconi] Why is marconi a queue implementation vs a provisioning API? > > > > On 03/19/2014 02:24 PM, Fox, Kevin M wrote: > > > Can someone please give more detail into why MongoDB being AGPL is a > > > problem? The drivers that Marconi uses are Apache2 licensed, MongoDB is > > > separated by the network stack and MongoDB is not exposed to the Marconi > > > users so I don't think the 'A' part of the GPL really kicks in at all > > > since the MongoDB "user" is the cloud provider, not the cloud end user? > > > > Even if MongoDB was exposed to end-users, would that be a problem? > > > > Obviously the source to MongoDB would need to be made available > > (presumably it already is) but does the AGPL licence "contaminate" the > > Marconi stuff? I would have thought that would fall under "mere > > aggregation". > > > > Chris > > > > _______________________________________________ > > OpenStack-dev mailing list > > OpenStack-dev(a)lists.openstack.org > > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev > > > > _______________________________________________ > > legal-discuss mailing list > > legal-discuss(a)lists.openstack.org > > http://lists.openstack.org/cgi-bin/mailman/listinfo/legal-discuss > > _______________________________________________ > legal-discuss mailing list > legal-discuss(a)lists.openstack.org > http://lists.openstack.org/cgi-bin/mailman/listinfo/legal-discuss >

5 10

Re: [legal-discuss] [openstack-dev] [Marconi] Why is marconi a queue implementation vs a provisioning API?
by Fox, Kevin M 20 Mar '14

20 Mar '14

Its my understanding that the only case the A in the AGPL would kick in is if the cloud provider made a change to MongoDB and exposed the MongoDB instance to users. Then the users would have to be able to download the changed code. Since Marconi's in front, the user is Marconi, and wouldn't ever want to download the source. As far as I can tell, in this use case, the AGPL'ed MongoDB is not really any different then the GPL'ed MySQL in footprint here. MySQL is acceptable, so why isn't MongoDB? It would be good to get legal's official take on this. It would be a shame to make major architectural decisions based on license assumptions that turn out not to be true. I'm cc-ing them. Thanks, Kevin ________________________________________ From: Chris Friesen [chris.friesen(a)windriver.com] Sent: Wednesday, March 19, 2014 2:24 PM To: openstack-dev(a)lists.openstack.org Subject: Re: [openstack-dev] [Marconi] Why is marconi a queue implementation vs a provisioning API? On 03/19/2014 02:24 PM, Fox, Kevin M wrote: > Can someone please give more detail into why MongoDB being AGPL is a > problem? The drivers that Marconi uses are Apache2 licensed, MongoDB is > separated by the network stack and MongoDB is not exposed to the Marconi > users so I don't think the 'A' part of the GPL really kicks in at all > since the MongoDB "user" is the cloud provider, not the cloud end user? Even if MongoDB was exposed to end-users, would that be a problem? Obviously the source to MongoDB would need to be made available (presumably it already is) but does the AGPL licence "contaminate" the Marconi stuff? I would have thought that would fall under "mere aggregation". Chris _______________________________________________ OpenStack-dev mailing list OpenStack-dev(a)lists.openstack.org http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev

6 5