- legal-discuss - lists.openstack.org

legal affairs committee meeting
by Strottman, Nissa 05 Oct '15

05 Oct '15

The next legal affairs committee meeting will be held Wednesday, October 14 at 4 pm ET/1 pm PT. Join online meeting<https://join.houston.hp.com/meet/nissa.strottman/BQCH66WT> https://join.houston.hp.com/meet/nissa.strottman/BQCH66WT Join by Phone +1-978-289-4114 (USA, Andover, MA) +1-678-367-0003 (USA, Atlanta, GA) +1-512-865-6123 (USA, Austin, TX) +1-208-629-2920 (USA, Boise, ID) +1-970-672-4888 (USA, Fort Collins. CO) +1-281-377-1991 (USA, Houston, TX) +1-650-300-4050 (USA, Palo Alto, CA) 1-855-493-4983 (USA/ Canada HP Customers/Partners) Find a local number<https://join.houston.hp.com/dialin> Conference ID: 437192273 Nissa M. Strottman Software, Cloud and Open Source Office of the General Counsel nissa.strottman(a)hp.com<mailto:nissa.strottman@hp.com> T +1 650 857 6279 M +1 650 387 4987 F +1 650 857 5409 Hewlett-Packard Company 3000 Hanover Street MS 1601 Palo Alto, CA 94304-1112 USA [HP]<http://www.hp.com/>

1 0

Center for Internet Security hardening standards
by Major Hayden 17 Sep '15

17 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello there, I'm currently working on a security hardening spec[1] and blueprint[2] for openstack-ansible. The goal is to bring additional security to OpenStack hosts via openstack-ansible and also to help organizations down the path to various compliance programs (like PCI). One of the firm PCI requirements[2] is PCI DSS Requirement 2.2 (page 30 in the PDF) which states that organizations must adhere to "industry-accepted" hardening standards. A few examples include Center for Internet Security (CIS), ISO, SANS, and NIST. Most of these are geared towards deployments of Red Hat Enterprise Linux and Windows, not Ubuntu. CIS seems to have the most comprehensive security hardening standards available for Ubuntu, and I'm able to port many of their recommendations for RHEL-based systems over to Ubuntu systems. However, their terms of use appears to be fairly strict. Rackspace (my employer) is a CIS member, but the OpenStack Foundation is not (as far as I know). I've reached out to CIS' member services group via our Rackspace account to find out if there's a possibility to license these hardening standards for open source use with OpenStack projects, but I'm not sure who they should get in contact with on the OpenStack side to discuss it. Would anyone be able to advise me on how to proceed? Thanks a bunch! [1] https://review.openstack.org/#/c/222619/ [2] https://blueprints.launchpad.net/openstack-ansible/+spec/security-hardening [3] https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf [4] https://benchmarks.cisecurity.org/downloads/form/index.cfm - -- Major Hayden -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJV+sIhAAoJEHNwUeDBAR+xlqEQAJWZV23yNWV7+XN1Pm7Utb6R D+pwPfN9up7RMhK5OFzvRGSEaGiQPRop+ENKNeBfiRfLCkI6mx2w5Z58E5NQCJEs v4ddxY5LokzOpizDmFl2Dkq3mrPCyC6bAE1tml5KF80vM5Vkt2IHnt7w5Q9QQ4hF UOcKI/4DFB2USO5lQr8jUMILzBUHLB+QO9L4NVxvYiz6LS1xgDRQ7AbmdloldLZb UqbqZ4rswfpSwCMn+h2jpBDwVzIykg22jdYQY61as8I1i7HrZoXBF2TaSyGc4lca FAzMxYBF7swWQ+W+/uk8+SUYOgqVSqslHtDyxKbz03JPlMhkSgAVAF80Q0AGE3Yt eq85QdLHkJnpdZNEfQ/TQHki+2seL+UNM/iSHlx//M+Qa5AZdgk+noEOhGT/dH3I +Bmz/PGBLJM67oow82No28tEo05xVtIGgDt5bUVf0oWCYy0OHjaLJ8w0DBrKXXlX otKsn5Q0Z08WUreX7fL74snb2yhg0BsGuR/NsHkJ2YQbG67v4Cr1QhCL8UAyI+OU MIRG1eswdERZKpBzBO6d+h4GsfEo7fDB6Q0uHe9kiwzVq5gHCI3t/miYwz4vabYR uZ4YVnfNfAmbjhh5I/uSAf2ie4T9h2b+yoqG6Yn51p43aLuZEHcPmc1VVv7M50Dz KDQ5nkxc/3XQcnmrZV7j =u4SR -----END PGP SIGNATURE-----

1 0

Incorporating MIT licensed code
by Major Hayden 08 Sep '15

08 Sep '15

Hello there, I just reviewed the Legal Issues FAQ[1], but I have some more specific questions around adding MIT licensed code to an OpenStack project that has traditionally been Apache licensed. I've already ensured that the file in question has the appropriate header and copyright details, but I'm unsure about how to handle the root LICENSE file within the repository. The FAQ mentions: > Probably the easiest thing to do when incorporating BSD or MIT licensed code is to copy the copyright/license header from the source file into the destination file, as well as copying the copyright notice, license and disclaimer into the toplevel LICENSE file with a brief explanation of which code is under that license. Should I put a divider in the LICENSE file and paste in the MIT license details after that? This may be a silly question (please let me know if it is), but I wanted to make sure I was following the legal instructions very carefully. Thank you! [1] https://wiki.openstack.org/wiki/LegalIssuesFAQ -- Major Hayden

2 2

Legal Affairs Committee Follow Up
by Radcliffe, Mark 28 Jul '15

28 Jul '15

At the last meeting, I stated that I was not aware of any litigation to enforce the Apache Software License. I have done a Westlaw search and have confirmed that there have been no reported cases to enforce the Apache Software License. Please consider the environment before printing this email. The information contained in this email may be confidential and/or legally privileged. It has been sent for the sole use of the intended recipient(s). If the reader of this message is not an intended recipient, you are hereby notified that any unauthorized review, use, disclosure, dissemination, distribution, or copying of this communication, or any of its contents, is strictly prohibited. If you have received this communication in error, please reply to the sender and destroy all copies of the message. To contact us directly, send to postmaster(a)dlapiper.com. Thank you.

1 0

Licensing options for new project (Kolla) entering big tent
by Steven Dake (stdake) 10 Jul '15

10 Jul '15

Hi folks, Kolla is a project for OpenStack with the mission [1]: " Kolla provides production-ready containers and deployment tools for operating OpenStack clouds that are scalable, fast, reliable, and upgradable using community best practices. " We use a set of libraries only available in Ansible v2.0. Shade [2] ASL2.0 uses these Ansible python libraries [3] licensed under a GPLv3 license. We use Shade in Kolla directly. We had planned to fork these libraries in [3] and cherry-pick only the modules we really need until Ansible 2.0 is available. I asked the TC if this approach would be in violation of the governance repository here: https://github.com/openstack/governance/blob/master/reference/new-projects-… To which Robert Collins suggested I speak with legal-discuss in this thread [4]. “ As I understand our current license situation, you won't be eligible for big-tent if you depend on GPLv3 code. >From the requirements " * Project must have no library dependencies which effectively restrict how the project may be distributed or deployed " So I'm also strongly inclined to recommend you speak to the legal list about the implications here. Using a GPLv3 tool via the CLI is very different (by the GPL's design) to using it as a library. -Rob -- Robert Collins <rbtcollins(a)hp.com<mailto:rbtcollins@hp.com>> Distinguished Technologist HP Converged Cloud “ I’d really like a solution that doesn’t involve rewriting all of the Ansible modules from scratch in a different license, but I guess we can do that if necessary. Can the OpenStack legal team provide some guidance for future TC voting around the thread in [4]? Our deadline for this work is July 31, but we need several weeks to make adjustments to our plans, so if appropriate guidance for the Technical Committee (and our community project) could be offered soon, it would be much appreciated. Regards, -steve [1] https://wiki.openstack.org/wiki/Kolla [2] https://github.com/openstack-infra/shade [3] https://github.com/ansible/ansible-modules-core The thread: [4] http://lists.openstack.org/pipermail/openstack-dev/2015-July/068612.html

7 16

Trademark policy page bug report: missing logos
by Dolph Mathews 11 Jun '15

11 Jun '15

(There might be a more appropriate place to send this note, such as a launchpad project or an email.address(a)openstack.org, but I could not find it. I trust that someone here can direct this to the right person!) In reading the OpenStack trademark policy [1], there are three occurrences of the phrase "shown immediately below" which imply that logos are intended to be included within the document, but no logos are included at all (or attempted to be included, according to the HTML source). [1] http://www.openstack.org/brand/openstack-trademark-policy/ -Dolph

2 2

StackForge and IP.
by Joe Marshall (projectcalico.org) 07 May '15

07 May '15

Hello, Following a suggestion from Jeremy Stanley (below), I'm contacting this list. If I understand Jeremy correctly, checking code in to StackForge does not transfer any IP, or grant any rights, other than those granted in the license declaration that we make in our code (in this case, the Apache 2.0 license). Is that correct? Many thanks, Joe Marshall. -----Original Message----- From: Emma Gordon Sent: 06 May 2015 13:06 To: Joe Marshall Subject: FW: [openstack-dev] [Fuel][Plugin] Contributor license agreement for fuel plugin code? -----Original Message----- From: Jeremy Stanley [mailto:fungi@yuggoth.org] Sent: 06 May 2015 12:58 To: OpenStack Development Mailing List (not for usage questions) Subject: Re: [openstack-dev] [Fuel][Plugin] Contributor license agreement for fuel plugin code? On 2015-05-06 11:02:42 +0000 (+0000), Emma Gordon (projectcalico.org) wrote: > If fuel plugin code is checked into a stackforge repository (as > suggested in the fuel plugin wiki > https://wiki.openstack.org/wiki/Fuel/Plugins#Repo) who owns that > code? I am not a lawyer, but my understanding is that the individual copyright holders mentioned in comments at the tops of various files, listed in an AUTHORS file (if included) and indicated within the repository's Git commit history retain rights over their contributions in a project relying on the Apache License (or those rights may belong to their individual respective employers in a work-for-hire situation as well). > Is there a contributor license agreement to sign? (For example, > contributors to OpenStack would sign this > https://review.openstack.org/static/cla.html) If Fuel is planning to apply for inclusion in OpenStack, then it may make sense to get all current and former contributors to its source repositories to agree to the OpenStack Individual Contributor License Agreement. Note that it does _not_ change the ownership of the software (copyrights), it's intended to simply reinforce the OpenStack Foundation's ability to continue to redistribute the software under the Apache License by affirming that the terms of the license are applied correctly and intentionally. More detailed questions are probably best posed to the legal-discuss(a)lists.openstack.org<mailto:legal-discuss@lists.openstack.org> mailing list, or to your own private legal representation. -- Jeremy Stanley

5 7

Legal Affairs Committee meeting
by Strottman, Nissa 01 May '15

01 May '15

Hi- The next meeting of the OpenStack Legal Affairs Committee meeting will be held Wednesday, May 6, 2015, at 1 p.m. PT. Dial-in information, etc., is below. Please let me know if you have any questions . Best, Nissa Join online meeting<https://join.houston.hp.com/meet/nissa.strottman/BQCH66WT> https://join.houston.hp.com/meet/nissa.strottman/BQCH66WT Join by Phone +1-978-289-4114 (USA, Andover, MA) +1-678-367-0003 (USA, Atlanta, GA) +1-512-865-6123 (USA, Austin, TX) +1-208-629-2920 (USA, Boise, ID) +1-970-672-4888 (USA, Fort Collins. CO) +1-281-377-1991 (USA, Houston, TX) +1-650-300-4050 (USA, Palo Alto, CA) 1-855-493-4983 (USA/ Canada HP Customers/Partners) Find a local number<https://join.houston.hp.com/dialin> Conference ID: 437192273 Forgot your dial-in PIN?<https://join.houston.hp.com/dialin> | First online meeting?<http://r.office.microsoft.com/r/rlidOC10?clid=1033&p1=4&p2=1041&pc=oc&ver=4…> Nissa M. Strottman Software, Cloud and Open Source Office of the General Counsel nissa.strottman(a)hp.com<mailto:nissa.strottman@hp.com> T +1 650 857 6279 M +1 650 387 4987 F +1 650 857 5409 Hewlett-Packard Company 3000 Hanover Street MS 1601 Palo Alto, CA 94304-1112 USA [HP]<http://www.hp.com/>

1 0

Re: [legal-discuss] Tracking Openstack Contributions
by Nardozza, Gregg (Gregg) 30 Apr '15

30 Apr '15

Thank you Stefano. I am adding the legal team. Gregg Nardozza [alu-logo-20x20] DMTS - IP Business Development Senior Patent Segment Manager Intellectual Property Business Group Bell Laboratories / Alcatel-Lucent • gregg.nardozza(a)alcatel-lucent.com<mailto:gregg.nardozza@alcatel-lucent.com> This message, intended only for the designated recipient(s), is privileged and confidential. It is intended only for the review of the party to whom it is addressed. If you are not a designated recipient, you may not review, copy or distribute this message. If you receive this in error, please notify the sender by reply e-mail and delete this message. Unintended transmission shall not constitute waiver of the attorney-client privilege or any other privileges. -----Original Message----- From: Stefano Maffulli [mailto:stefano@openstack.org] Sent: Thursday, April 30, 2015 2:25 PM To: Nardozza, Gregg (Gregg) Subject: Re: Tracking Openstack Contributions Hi Gregg, just a clarification: the website stackalytics.com is not managed by OpenStack Foundation nor it's managed by the OpenStack project. Formally the domain is owned by Mirantis and the development is sponsored mostly by the same company. There is an intention to move all the code and data under the wider openstack community umbrella but no plans nor deadlines have been defined. The Foundation extracts records of contributions from the tools used for openstack development (gerrit, launchpad, git, storyboard, mailing lists, etc) and provides that data on http://activity.openstack.org. Regarding the retention policy, I'm not aware of one formal policy for data retention. I would ask the question on legal-discuss(a)lists.openstack.org<mailto:legal-discuss@lists.openstack.org> to get the ball moving towards creating one. Cheers, stef On Thu, 2015-04-30 at 12:07 +0000, Nardozza, Gregg (Gregg) wrote: > Hello Stefano! > > > > I need to know the record retention policy for OpenStack. > > > > We (Alcatel-Lucent) rely on being able to retrieve the information as > shown below from the OpenStack website and need to know the number of > years these records will be publically available and retrievable. > > > > Please let me know who would have this information in the OpenStack > organization or pass this on to whom ever can answer these questions > for me. > > > > Much appreciated. > > > > Gregg Nardozza alu-logo-20x20 > > DMTS - IP Business Development > > Senior Patent Segment Manager > > Intellectual Property Business Group > > Bell Laboratories / Alcatel-Lucent > > *gregg.nardozza(a)alcatel-lucent.com<mailto:*gregg.nardozza@alcatel-lucent.com> > > > > This message, intended only for the designated recipient(s), is > privileged and confidential. It is intended only for the review of the > party to whom it is addressed. If you are not a designated recipient, > you may not review, copy or distribute this message. If you receive > this in error, please notify the sender by reply e-mail and delete > this message. Unintended transmission shall not constitute waiver of > the attorney-client privilege or any other privileges. > > > > > From: MARGOLIN, Udi (Udi) > Sent: Thursday, April 30, 2015 7:53 AM > To: Nardozza, Gregg (Gregg) > Subject: RE: Tracking Openstack Contributions > > > > > You have it all – take for example ‘lbortman’ – follow the link: > > > > > > > > Now you get : > > > > > > > > > > If you follow a specific change ID you get all the details: > > > > > >

4 4

Openstack License Agreement for Users
by Ahmed Ibrahim Al-Oulah 30 Apr '15

30 Apr '15

Dears, Good Day ... We are a openstack user, so what's the license agreement ? Is there another licenses with Apache License 2.0. ________________________________ Ahmed Ibrahem Al Oulah | Systems Engineer | RHCE, VCP-5 | Systems & Platforms, Cloud Services Department STC Advance soultions | P.O. Box 50 | Riyadh 11372 | Saudi Arabia | stcas.com.sa T: +96614600111 ext.1276 | Mob: +966-555449133 | E: aoulah(a)stcas.com.sa Disclaimer: This email communication, and its attachment, may contain confidential information and material and it is intended solely for the use of the addressees listed on it. Un-Authorized Access to this email by anyone else is prohibited. If you are not the intended recipient, please notify us via e-mail at (it(a)stcas.com.sa) and immediately delete the message and its attachments from your system. The views expressed in this email are those of the sender and may not necessarily reflect views of Saudi Telecommunications Company - Advanced Solutions "STCAS". This email communication cannot be guaranteed to be secure or error-free and it is the sole responsibility of the recipient to ensure such. STCAS accepts no liability for any damage caused by any virus transmitted by this email domain.

2 1