- legal-discuss - lists.openstack.org

[Fwd: Re: [openstack-tc] Copyrights and License Headers in source files]
by Mark McLoughlin 03 May '13

03 May '13

Wow, interesting - people including copyright notices in blueprints Cheers, Mark. -------- Forwarded Message -------- > From: Russell Bryant <rbryant(a)redhat.com> > To: Monty Taylor <mordred(a)inaugust.com> > Cc: openstack-tc(a)lists.openstack.org > Subject: Re: [openstack-tc] Copyrights and License Headers in source > files > Date: Wed, 01 May 2013 18:55:38 -0400 > > On 05/01/2013 06:12 PM, Monty Taylor wrote: > > > > > > On 05/01/2013 06:05 PM, John Griffith wrote: > >> > >> > >> > >> On Wed, May 1, 2013 at 3:57 PM, Mark Washenberger > >> <mark.washenberger(a)markwash.net <mailto:mark.washenberger@markwash.net>> > >> wrote: > >> > >> Hi folks, > >> > >> I was looking into the ASL-2.0, and chanced across the fact that in > >> Apache projects, they require that source files only have the > >> License Header, and may not have any copyright notices [1]. It > >> occurred to me that we waste a fair amount of time on copyrights in > >> license headers, and it would be nice not to have to do that anymore. > > > > I would like to hear more about the time waste there - where are we > > spending time? Can we do something to make that better? > > > >> I think that only applies to code submitted directly to ASF, but > >> regardless you wouldn't get any objections from me regarding your > >> proposal. Some of the legal teams in companies involved in OpenStack > >> however may feel differently. > > > > And some of the developers. I would not like that. > > > > I would really like to see more folks learn about appropriate addition > > of copyright attribution when they work on a file, because I think it's > > quite important. Don't think that removing attribution from each file > > would prevent people from needing to do it - if we moved to a NOTICE > > file system, they'd need to put the notice there. > > +1 > > > I also think that it's important that the attribution be per-file and > > not just in a NOTICE file, because the world has moved on from the days > > when tarballs were the primary mechanism of source code distribution. We > > publish this all on the web now. So this: > > > > https://github.com/openstack-dev/pbr/blob/master/pbr/packaging.py > > > > without per-file attribution, would not indicate who the license > > associated with this file was from. > > > >> I'm actually more troubled by seeing folks put copyright headers on > >> blueprints. > > > > Fascinating. I wonder if they realize that they're just asserting > > copyright on the text of the blueprint itself... > > It's quite irritating. It's not clear at all what the intention is. > Here are some examples: > > https://blueprints.launchpad.net/nova/+spec/accurate-capacity-of-clusters-f… > > https://blueprints.launchpad.net/nova/+spec/deploy-vcenter-templates-from-v… > > https://blueprints.launchpad.net/nova/+spec/esx-resource-pools-as-compute-n… > > https://blueprints.launchpad.net/nova/+spec/multiple-clusters-managed-by-on… > > I emailed the submitted and asked for clarification on the intent, but > haven't heard anything back. > > Monty, since the ones I've noticed are from HP, perhaps this is > something you can help track down? > > >> I also noticed a previous conversation [2] on this subject. I have > >> not found any policy that actually requires us to include copyrights > >> with each source file license header. > >> > >> Feel free to suggest that this is more trouble than it is worth, but > >> I'd like to propose that we discourage new contributions from > >> including copyright attribution, and provide a process to work with > >> the various parties we have to remove the copyrights from existing > >> files. Somewhere along the line, somebody (maybe even me!) could > >> write some appropriate hooks to ensure the (now identical) license > >> header is present in every file for every submission. > >> > >> Also, feel free to suggest that I'm plain wrong and am still wet > >> behind the ears--I won't be terribly surprised! > >> > >> [1] http://www.apache.org/legal/src-headers.html#headers > >> [2] > >> http://markmail.org/message/eawha7pjiqoslm66?q=openstack+license+source+hea… > >> > >> _______________________________________________ > >> OpenStack-TC mailing list > >> OpenStack-TC(a)lists.openstack.org > >> <mailto:OpenStack-TC@lists.openstack.org> > >> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-tc > >> > >> > >> > >> > >> _______________________________________________ > >> OpenStack-TC mailing list > >> OpenStack-TC(a)lists.openstack.org > >> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-tc > >> > > > > _______________________________________________ > > OpenStack-TC mailing list > > OpenStack-TC(a)lists.openstack.org > > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-tc > > > > > -- > Russell Bryant > > _______________________________________________ > OpenStack-TC mailing list > OpenStack-TC(a)lists.openstack.org > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-tc

2 2

Fwd: [openstack-tc] Copyrights and License Headers in source files
by Mark Washenberger 03 May '13

03 May '13

:-( Apparently I'm not doing so great at reply-to-list these days ---------- Forwarded message ---------- From: Mark Washenberger <mark.washenberger(a)markwash.net> Date: Thu, May 2, 2013 at 12:33 AM Subject: Re: [openstack-tc] Copyrights and License Headers in source files To: Mark McLoughlin <markmc(a)redhat.com> On Wed, May 1, 2013 at 10:53 PM, Mark McLoughlin <markmc(a)redhat.com> wrote: > Hi Mark, > > On Wed, 2013-05-01 at 14:57 -0700, Mark Washenberger wrote: > > Hi folks, > > > > I was looking into the ASL-2.0, and chanced across the fact that in > Apache > > projects, they require that source files only have the License Header, > and > > may not have any copyright notices [1]. It occurred to me that we waste a > > fair amount of time on copyrights in license headers, and it would be > nice > > not to have to do that anymore. > > Like Monty said, I'd like to hear more about why these are seen as a > time sink. > I'm having a difficult time providing hard numbers for you. I think one way to check for this would be to grep gerrit review notes, but I don't know how to do that. But in a non-exhaustive search, I can see some examples https://review.openstack.org/#/c/27001/ -> headers were missing from empty files, caught in review (eventually) https://review.openstack.org/#/c/23044/ -> copyright had wrong year (caught in review) https://review.openstack.org/#/c/22742/ -> just my fault, but I misunderstood the copyright policy and got someone to change to "Openstack Foundation" from their company https://review.openstack.org/#/c/20927/ -> wrong year (caught in review) https://review.openstack.org/#/c/20926/ -> wrong year (caught in review) https://review.openstack.org/#/c/20925/ -> wrong year (caught in review) https://review.openstack.org/#/c/20914 -> should be "Foundation" not "LLC", not caught in review https://review.openstack.org/#/c/21130 -> s/LLC/Foundation/ not caught in review I found these by manually inspecting only the latest 13 results I got when I searched for commits in glance that add files. >From this data, I think its clear that coders are making mistakes about licensing/copyright headers, and reviewers are having to pause to think about the correctness of those headers. While the amount of effort here isn't necessarily very large, I'd like to draw your attention to the amount of effort that it probably should be: 0. In proportional terms, we're pretty far away from ideal :-) > > > I also noticed a previous conversation [2] on this subject. I have not > > found any policy that actually requires us to include copyrights with > each > > source file license header. > > > > Feel free to suggest that this is more trouble than it is worth, but I'd > > like to propose that we discourage new contributions from including > > copyright attribution, and provide a process to work with the various > > parties we have to remove the copyrights from existing files. > > I don't have a massively strong opinion on this and I'd never really > considered the possibility of not having copyright headers, but my first > thought is that I like that we have them. I like that "ownership" of the > work is distributed and it's nice to be able to see how that ownership > is distributed through the code base. > I'd never considered it either, until I found out that Apache Software Foundation projects are explicitly required to *not* put copyright headers in their source files (they do, however, retain license headers). I realize that rule doesn't apply to us, but if it's good enough for ASF, how are we different? I'd also contend that the view of ownership you get from looking at copyright headers is pretty inaccurate. For example (again from Glance), $ git grep -i rackspace | grep -i copyright | wc -l 0 > > In any case, I think it's too late for us to effectively make a change > in like this successfully and not worth the hassle. > I would agree if I thought that such a change required any of the following: 1) changing existing copyright headers 2) changing the CLA 3) changing bylaws But I don't think those are needed. If we simply said "stop adding copyright headers", then I believe I could write a flake8 hacking rule to check for correct license headers (sans copyright) on new files. That would be enough for me, because my goal here is for people to not have to think about such headers during future development and review.

2 3

Guidelines for naming new projects
by Mark McLoughlin 02 May '13

02 May '13

Hi I've just added a new question to the FAQ: https://wiki.openstack.org/wiki/LegalIssuesFAQ Q: What sort of things should I bear in mind when choosing a new project name, in order to reduce the risk of running into legal problems in the future? But I don't have an answer! I understand we can't cover all bases here. I understand that general guidelines can't replace a full conflict search by counsel. However, there are plenty of examples of why a general question to this would help developers avoid making obvious mistakes. And we're likely to just see more and more new project names, so we can't have the answer be "ask Mr Name Expert whether the name is sane". Without using any of our current project names as examples, would anyone care to take a stab at answering this generally? Thanks, Mark.

5 7

Re: [legal-discuss] [openstack-tc] Copyrights and License Headers in source files
by Mark McLoughlin 02 May '13

02 May '13

On Thu, 2013-05-02 at 07:30 -0400, Sean Dague wrote: > On 05/01/2013 06:12 PM, Monty Taylor wrote: > > On 05/01/2013 06:05 PM, John Griffith wrote: > >> On Wed, May 1, 2013 at 3:57 PM, Mark Washenberger > >> <mark.washenberger(a)markwash.net <mailto:mark.washenberger@markwash.net>> > >> wrote: > >> > >> Hi folks, > >> > >> I was looking into the ASL-2.0, and chanced across the fact that in > >> Apache projects, they require that source files only have the > >> License Header, and may not have any copyright notices [1]. It > >> occurred to me that we waste a fair amount of time on copyrights in > >> license headers, and it would be nice not to have to do that anymore. > > > > I would like to hear more about the time waste there - where are we > > spending time? Can we do something to make that better? > > > >> I think that only applies to code submitted directly to ASF, but > >> regardless you wouldn't get any objections from me regarding your > >> proposal. Some of the legal teams in companies involved in OpenStack > >> however may feel differently. > > > > And some of the developers. I would not like that. > > > > I would really like to see more folks learn about appropriate addition > > of copyright attribution when they work on a file, because I think it's > > quite important. Don't think that removing attribution from each file > > would prevent people from needing to do it - if we moved to a NOTICE > > file system, they'd need to put the notice there. > > +1 > > This is really an education issue. Lots of first time Open Source folks > on the project that don't understand that copyright + license grant in > each file is actually quite important to ensure things are actually Open > Source in all jurisdictions. > > It would be good if there was a single wiki page that I could respond to > people that -1 adding Copyright statements to explain that it is normal. > I've had to explain that too many times Let's get this on: https://wiki.openstack.org/wiki/LegalIssuesFAQ Cheers, Mark.

2 1

Re: [legal-discuss] [openstack-tc] Copyrights and License Headers in source files
by Mark McLoughlin 02 May '13

02 May '13

Hi Mark, On Wed, 2013-05-01 at 14:57 -0700, Mark Washenberger wrote: > Hi folks, > > I was looking into the ASL-2.0, and chanced across the fact that in Apache > projects, they require that source files only have the License Header, and > may not have any copyright notices [1]. It occurred to me that we waste a > fair amount of time on copyrights in license headers, and it would be nice > not to have to do that anymore. Like Monty said, I'd like to hear more about why these are seen as a time sink. > I also noticed a previous conversation [2] on this subject. I have not > found any policy that actually requires us to include copyrights with each > source file license header. > > Feel free to suggest that this is more trouble than it is worth, but I'd > like to propose that we discourage new contributions from including > copyright attribution, and provide a process to work with the various > parties we have to remove the copyrights from existing files. I don't have a massively strong opinion on this and I'd never really considered the possibility of not having copyright headers, but my first thought is that I like that we have them. I like that "ownership" of the work is distributed and it's nice to be able to see how that ownership is distributed through the code base. In any case, I think it's too late for us to effectively make a change in like this successfully and not worth the hassle. Cheers, Mark.

1 0

[Fwd: [openstack-tc] Copyrights and License Headers in source files]
by Mark McLoughlin 02 May '13

02 May '13

Hey Definitely a good topic for legal-discuss, I think. To catch on the thread to date, the archives are here: http://lists.openstack.org/pipermail/openstack-tc/2013-May/thread.html#215 Cheers, Mark. -------- Forwarded Message -------- > From: Mark Washenberger <mark.washenberger(a)markwash.net> > To: openstack-tc(a)lists.openstack.org > <openstack-tc(a)lists.openstack.org> > Subject: [openstack-tc] Copyrights and License Headers in source files > Date: Wed, 1 May 2013 14:57:45 -0700 > > Hi folks, > > > I was looking into the ASL-2.0, and chanced across the fact that in > Apache projects, they require that source files only have the License > Header, and may not have any copyright notices [1]. It occurred to me > that we waste a fair amount of time on copyrights in license headers, > and it would be nice not to have to do that anymore. > > > I also noticed a previous conversation [2] on this subject. I have not > found any policy that actually requires us to include copyrights with > each source file license header. > > > Feel free to suggest that this is more trouble than it is worth, but > I'd like to propose that we discourage new contributions from > including copyright attribution, and provide a process to work with > the various parties we have to remove the copyrights from existing > files. Somewhere along the line, somebody (maybe even me!) could write > some appropriate hooks to ensure the (now identical) license header is > present in every file for every submission. > > > Also, feel free to suggest that I'm plain wrong and am still wet > behind the ears--I won't be terribly surprised! > > > [1] http://www.apache.org/legal/src-headers.html#headers > [2] http://markmail.org/message/eawha7pjiqoslm66?q=openstack+license > +source+header > > _______________________________________________ > OpenStack-TC mailing list > OpenStack-TC(a)lists.openstack.org > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-tc

1 0

Wiki pages
by Mark McLoughlin 30 Apr '13

30 Apr '13

Hey I've just taken a stab at starting a FAQ and a wiki page for the Legal Affairs Committee: https://wiki.openstack.org/wiki/Governance/Foundation/LegalAffairsCommittee https://wiki.openstack.org/wiki/LegalIssuesFAQ Edit at will! :) Cheers, Mark.

2 1

Re: [legal-discuss] NOTICE files
by Monty Taylor 30 Apr '13

30 Apr '13

(Top posting. Phone. Sorry.) What if we were to generate a NOTICE file? We treat the got repo as the true source of record, and we put copyright attribution into each file. What if, same as AUTHORS and ChangeLog, we generate NOTICE at sdist time to include information collected from the individual files? Richard Fontana <rfontana(a)redhat.com> wrote: >On Fri, Apr 26, 2013 at 10:50:56AM +0100, Mark McLoughlin wrote: >> Hmm, so we had a case recently where we were considering incorporating >> (2 clause) BSD licensed code in a project: >> >> https://review.openstack.org/25531 >> >> What I wondered about was how to best comply (or rather, enable >> distributors of OpenStack in "binary form" to comply) with the second >> clause of the license: >> >> 2. Redistributions in binary form must reproduce the above copyright notice, >> this list of conditions and the following disclaimer in the documentation >> and/or other materials provided with the distribution. >> >> Do we just include that license (along with the copyright notice) in the >> project's LICENSE file? Does a NOTICE file serve do anything to help >> with this case? > >The two ways to deal with this are to include the license information >in the file incorporating the third-party code or to include it in >some global file. > >The ASF, as noted, is (or at least seems to be) using NOTICE files not >just for attribution but also for global collection of third-party >legal notices. Sphinx itself (just checking now) apparently uses its >global LICENSE file similarly to store third-party license notices. > >If one cares about theoretically making life as easy as possible for >downstream distributors of 'binary form' versions, I suppose this >global-legal-file approach is a preferable way to do that. The other >approach (putting, or retaining, a notice in the source file) is the >one I've tended to recommend (I suppose because it generally conveys >more information, and because I consider it the responsibility of the >downstream distributor to ensure that it is in compliance with all >licenses). There's no right or wrong answer, but a consistent approach >is a good idea. > >Sphinx uses notices in individual source files that point to the >global LICENSE file, which means if you're using excerpts of code from >a Sphinx file you'd have to do more work than you would if the actual >license text were already in the file, at least the way I see it. So >here it would have been just as much work to make sure the file(s) in >question had the 2-clause BSD license from Sphinx, as it would have >been to put the same information in a global LICENSE or NOTICE file. > >> > So the question raised by Dims boils down to whether OpenStack >> > projects should include an *OpenStack* attribution notice in top-level >> > NOTICE files. This would presumably be something analogous to standard >> > ASF attribution notices, like: >> > >> > This product includes software developed by >> > the OpenStack Foundation (http://www.openstack.org/) >> >> I'm not sure "developed by the OpenStack Foundation" rings true to >> me ... maybe "developed by the OpenStack project". The Foundation >> doesn't develop the code, it empowers/protects/promotes the project >> which develops the code. > >That was my intuition too (though from someone who's still really an >outside observer of OpenStack, so I wasn't sure I was right), and what >I was alluding to at the end of my message. By contrast, to most ASF >project developers, the wording of the ASF attribution notice >presumably rings true. > >> > But perhaps contributors to OpenStack projects feel >> > otherwise. In a project like OpenStack that does not aggregate >> > copyright ownership (and in which copyright ownership is getting >> > increasingly diverse), perhaps some perceive a value to having an >> > OpenStack-specific attribution notice. >> >> Yes, you could imagine a case would be made for it, but it would be a >> new departure for the project. I'd rather such a move to be made as a >> reaction to us feeling we're not getting credit for our work rather than >> a "the ASF does it, maybe we should too?" discussion. > >For a Red Hat perspective, FWIW, increasingly the Apache License 2.0 >is being used for projects initiated by or maintained principally by >Red Hat developers, but AFAICR we've thus far never used the NOTICE >file attribution mechanism. The one case I can think of where we've >considered adding it was for a project where the developers were >miffed at a downstream proprietary commercial derivative product >making significant reuse of the upstream code but apparently not >giving any credit. > > - RF > >_______________________________________________ >legal-discuss mailing list >legal-discuss(a)lists.openstack.org >http://lists.openstack.org/cgi-bin/mailman/listinfo/legal-discuss >

6 9

NOTICE files
by Richard Fontana 29 Apr '13

29 Apr '13

Hi, Thanks Stefano and Mark for setting up this list. Since I appear to be indirectly to blame for its creation I thought I would provide an initial contribution by addressing the issue Dims asked a couple of days ago on openstack-dev: http://lists.openstack.org/pipermail/openstack-dev/2013-April/007778.html As noted by Dims NOTICE files are specifically referred to in the Apache License 2.0 section 4d. I won't quote the whole provision but it begins by saying: If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file .... So it is understood that upstream projects might not use NOTICE files, but in case they do, and they include attribution notices in such a file, then distributed 'Derivative Works' must preserve or include those attribution notices in one of certain specified ways. ASF projects routinely use NOTICE files. The ASF uses them as a centralized place for not just an ASF attribution notice but also any legal notices that must be preserved under third-party licenses. Older ASF projects also include an Apache Software Foundation copyright notice (AIUI the ASF ceased this practice at some point as it came to be seen as controversial since the ASF didn't hold any significant copyright interest in any particular project). It is my experience, however, that very few non-ASF projects using the Apache License 2.0 make use of the NOTICE file mechanism. While there are some nice things about having a centralized file for collecting *third-party* legal notices, such a thing is not necessary (this assumes that any legal notices that have to be preserved in a source distribution are preserved in individual source files). An important exception, probably not relevant and unlikely to be relevant to OpenStack, is if your source code incorporates code from an Apache-licensed project that itself used a NOTICE file. You could use a centralized file to contain any copyright notices from *OpenStack* contributors; this has not been the approach of OpenStack thus far, and is really a separate question. So the question raised by Dims boils down to whether OpenStack projects should include an *OpenStack* attribution notice in top-level NOTICE files. This would presumably be something analogous to standard ASF attribution notices, like: This product includes software developed by the OpenStack Foundation (http://www.openstack.org/) The policy goal in the ASF's case has been to make sure the ASF gets visible credit in cases where downstream distributed products are based in part on ASF code. For OpenStack, thus far it has not been thought important to have any such attribution notice, as with most other non-ASF Apache-licensed projects. I myself don't think it is important so I see no reason to begin deviating from historical OpenStack practice to emulate what the ASF does. But perhaps contributors to OpenStack projects feel otherwise. In a project like OpenStack that does not aggregate copyright ownership (and in which copyright ownership is getting increasingly diverse), perhaps some perceive a value to having an OpenStack-specific attribution notice. I see occasional uses of "Copyright OpenStack Foundation" in source files and I am not clear on whether this signifies code that was originally copyrighted by OpenStack LLC or, instead, some sort of attempt (like the deprecated ASF practice) to provide attribution to the OpenStack Foundation regardless of whether it is actually in any interesting sense a copyright holder. It is also not clear to me that it is *proper* to give attribution to the OpenStack *Foundation*, but that's a project-specific cultural question and I don't have good insight into that. - RF

5 7