- legal-discuss - lists.openstack.org

Re: [legal-discuss] [all][tc][kolla]is it OK to modify python code in OpenStack project?
by Jeffrey Zhang 27 Dec '16

27 Dec '16

not simple override the _read() method. I also copied some code from ConfigParser.py(more than 80%, i think). is that OK? is there any difference between override method and copy codes? On Tue, Dec 27, 2016 at 3:12 AM, Monty Taylor <mordred(a)inaugust.com> wrote: > On 12/26/2016 07:27 AM, Davanum Srinivas wrote: > > PSF is ok per (https://governance.openstack.org/tc/reference/licensing. > html) > > Though the overriding the _read() seems like something that could > > break easily > > Yah - you can't relicense it - but you can include it with the PSF > license. It might be worth adding a PSF license header to that file and > a note that the code is copied from [0] > > That said - I agree with dims, overriding the _read() method like that > seems prone to sadness. > > > On Mon, Dec 26, 2016 at 12:13 PM, Michał Jastrzębski <inc007(a)gmail.com> > wrote: > >> Added all and tc tags, as it might affect everyone really. > >> > >> On 25 December 2016 at 23:04, Jeffrey Zhang <zhang.lei.fly(a)gmail.com> > wrote: > >>> Recently, Kolla project has requirement to modify[1] the python's > >>> ConfigParser.py code[0]. > >>> > >>> Python is using PSF license[3], which is GPL compatible. But OpenStack > >>> is using Apache License. > >>> > >>> Here is the diff view[2]. > >>> > >>> I want to make sure: is it OK to re-license ConfigParser.py? If not, > what > >>> the solution? > >>> > >>> [0] https://github.com/python/cpython/blob/2.7/Lib/ConfigParser.py > >>> [1] https://review.openstack.org/412101 > >>> [2] > >>> https://gist.github.com/jeffrey4l/2258b276cbd038e73797cfa0952da3 > 71/revisions?diff=split > >>> [3] https://docs.python.org/3/license.html > >>> > >>> > >>> -- > >>> Regards, > >>> Jeffrey Zhang > >>> Blog: http://xcodest.me > >>> > >>> _______________________________________________ > >>> legal-discuss mailing list > >>> legal-discuss(a)lists.openstack.org > >>> http://lists.openstack.org/cgi-bin/mailman/listinfo/legal-discuss > >>> > >> > >> _______________________________________________ > >> legal-discuss mailing list > >> legal-discuss(a)lists.openstack.org > >> http://lists.openstack.org/cgi-bin/mailman/listinfo/legal-discuss > > > > > > > > > _______________________________________________ > legal-discuss mailing list > legal-discuss(a)lists.openstack.org > http://lists.openstack.org/cgi-bin/mailman/listinfo/legal-discuss > -- Regards, Jeffrey Zhang Blog: http://xcodest.me

1 0

AGPLv3+ acceptable for third party dependencies?
by Ade Lee 12 Nov '16

12 Nov '16

Hi, Just a quick question: Is AGPLv3+ an acceptable license for a third party library that is a dependency for an Openstack project? I read: (from http://governance.openstack.org/reference/licensing.html) In order to be acceptable as dependencies of OpenStack projects, external libraries (produced and published by 3rd-party developers) must be licensed under an OSI-approved license that does not restrict distribution of the consuming project. The list of acceptable licenses includes ASLv2, BSD (both forms), MIT, PSF, LGPL, ISC, and MPL. Licenses considered incompatible with this requirement include GPLv2, GPLv3, and AGPL. Is AGPL the same as AGPLv3 (and therefore not acceptable)? Thanks, Ade Lee

5 7

[tc][kolla] Ansible module with GPLv3
by Michał Jastrzębski 08 Nov '16

08 Nov '16

Cross-post from [1] Hello everyone, I'm looking for legal advice about having GPLv3 file in Kolla repository. Our use case doesn't seem to be derivative, so I think that should be possible to pull off - having an single gpl v3 module within Kolla without affecting general Kolla license, but it's highly unorthodox so I would like to have second opinion on that front. Regards, Michal inc0 Jastrzebski [1] http://lists.openstack.org/pipermail/openstack-dev/2016-November/106761.html

3 4

Adding license header to autogenerated content
by Steve Martinelli 22 Oct '16

22 Oct '16

I recently came across a patch [1] that is trying to add the Apache license to an autogenerated file. We've recently had issues with contributors finding patches that apply to all the projects; this would definitely be one of those. My quick search [2] is showing that around 350 repositories have the license in the file. Out of the 1000+ we have in openstack (not including what's in openstack-infra or openstack-dev) Yes, it's a python file, there is some "code" there, but it's auto-generated, either from sphinx or our cookiecutter (which now includes the license [3]). So before we use up resources in merging a bunch of patches, I wanted to know if the license was actually necessary. Thanks for reading, Steve [1] https://review.openstack.org/#/c/377170/1 [2] http://codesearch.openstack.org/?q=Apache&i=nope&files=doc%2Fsource%2Fconf.… [3] https://github.com/openstack-dev/cookiecutter/blob/master/%7B%7Bcookiecutte…

4 6

Question on the ICLA
by Michael Latchmansingh 20 Oct '16

20 Oct '16

Hi OpenStack legal community I have a question on the purpose of the ICLA. In attempting to setup my local Git repository with the OpenStack Gerrit system, I ran into an issue where I was asked to sign the ICLA. My submissions to OpenStack are on behalf of the company I work for, and we have already a signed CCLA. Our general counsel does not want me to sign an individual CLA because I do not own any of the IP being submitted. Can you clarify, in legal terms for my general counsel, why there is this requirement? Thanks and Regards, Michael Latchmansingh | Director, Product Development 954-377-6058 t 561-927-5754 c michael.latchmansingh.datacore (skype) DataCore Software Corporation Corporate Park 6300 NW 5th Way Ft. Lauderdale, FL 33309 http://www.datacore.com<http://www.datacore.com/>

7 6

Trademark for a specific OpenStack project
by Davanum Srinivas 18 Oct '16

18 Oct '16

Hi, Does the foundation hold trademarks for any of the big tent projects? Does the policy cover any such marks? [1] What are the options if someone active in the community decides to continue their work outside the foundation using the same project name? Thanks, Dims [1] http://www.openstack.org/brand/openstack-trademark-policy/ -- Davanum Srinivas :: https://twitter.com/dims

2 2

Legal Affairs Committee Meeting, September 30, 1:15 PDT
by Strottman, Nissa 22 Sep '16

22 Sep '16

Hi- The Legal Affairs Committee will be meeting Friday, September 30, at 1:15 PDT to discuss Facebook's additional patent license grant in addition to the BSD license for ReactJS, which is being used in at least two projects (Fuel-UI and TripleO). The text for the patent grant may be viewed here: https://github.com/facebook/react/blob/master/PATENTS Call-in number: 1-702-696-4520 Passcode: 7612918876 Best, Nissa Nissa M. Strottman Associate General Counsel Software, Cloud and Open Source Office of the General Counsel +1 650 857 6279 Office +1 650 387 4987 Mobile Palo Alto, CA hpe.com [HPE logo]<http://www.hpe.com/>

1 0

Docker Inc. trademark guidelines
by Steven Dake (stdake) 20 Sep '16

20 Sep '16

It has come to my attention that Docker Inc has published trademark guidelines. The OpenStack Kolla community wishes to comply with the trademark guidelines Docker has published. I humbly request a legal review of the following change from a foundation attorney: https://review.openstack.org/#/c/372133/ Note the term “website” in the published guidelines could be parsed in multiple ways which I find confusing. Some guidance here would be helpful as well. (CCs are self-nominated PTLs for the Ocata cycle). Regards -steve

2 1

Technical Committee Member Policy - possible error?
by John Davidge 13 Sep '16

13 Sep '16

Hello, I happened to be reading the Technical Committee Member Policy[1] today, and I noticed what I think could be an error. Paragraph 3, subsection (b)(I) states that: "An Individual Member is an ATC who has had a contribution approved for inclusion..." I believe this should read: "An ATC is an Individual Member who has had a contribution approved for inclusion..." Generally speaking, ATCs are a subset of Individual Members, so the definition given doesn't seem right. Approved contributions are not a requirement for Individual Membership. Can anybody confirm? Thanks, John [1] http://www.openstack.org/legal/technical-committee-member-policy/ ________________________________ Rackspace Limited is a company registered in England & Wales (company registered number 03897010) whose registered office is at 5 Millington Road, Hyde Park Hayes, Middlesex UB3 4AZ. Rackspace Limited privacy policy can be viewed at www.rackspace.co.uk/legal/privacy-policy - This e-mail message may contain confidential or privileged information intended for the recipient. Any dissemination, distribution or copying of the enclosed material is prohibited. If you receive this transmission in error, please notify us immediately by e-mail at abuse(a)rackspace.com and delete the original message. Your cooperation is appreciated.

3 2

Re: [legal-discuss] [openstack-dev] [javascript] [fuel-ui] Is ReactJS OSI Compliant?
by Monty Taylor 11 Sep '16

11 Sep '16

Hey legal discuss folks ... On 09/07/2016 07:06 AM, Michael Krotscheck wrote: > Preface: IANAL (I-am-not-a-lawyer). > > ReactJS claims to be BSD licensed. However, it has a non-BSD patent > rider with a very aggressive "Strong Retaliation Clause", meaning that > if there's ever a patent dispute between [React Project] and Facebook, > the patents are revoked. > > This might be fine. It might not. If possible, I'd like one of the > foundation lawyers to weigh in on this, as one of our projects (Fuel-UI) > is using it. > > Some discussion on the matter: > https://news.ycombinator.com/item?id=12108158 > > Our own guidelines. > http://governance.openstack.org/reference/licensing.html > > Historically, OpenStack has avoided projects that make custom > modifications to a license (see the do-no-evil license on JSLint/JSHint). > > Michael > > > __________________________________________________________________________ > OpenStack Development Mailing List (not for usage questions) > Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev >

3 2

Fwd: [openstack-dev] [javascript] [fuel-ui] Is ReactJS OSI Compliant?
by Davanum Srinivas 07 Sep '16

07 Sep '16

Fwd'ing to legal-discuss from openstack-dev ---------- Forwarded message ---------- From: Michael Krotscheck <krotscheck(a)gmail.com> Date: Wed, Sep 7, 2016 at 8:06 AM Subject: [openstack-dev] [javascript] [fuel-ui] Is ReactJS OSI Compliant? To: "OpenStack Development Mailing List (not for usage questions)" <openstack-dev(a)lists.openstack.org> Preface: IANAL (I-am-not-a-lawyer). ReactJS claims to be BSD licensed. However, it has a non-BSD patent rider with a very aggressive "Strong Retaliation Clause", meaning that if there's ever a patent dispute between [React Project] and Facebook, the patents are revoked. This might be fine. It might not. If possible, I'd like one of the foundation lawyers to weigh in on this, as one of our projects (Fuel-UI) is using it. Some discussion on the matter: https://news.ycombinator.com/item?id=12108158 Our own guidelines. http://governance.openstack.org/reference/licensing.html Historically, OpenStack has avoided projects that make custom modifications to a license (see the do-no-evil license on JSLint/JSHint). Michael __________________________________________________________________________ OpenStack Development Mailing List (not for usage questions) Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev -- Davanum Srinivas :: https://twitter.com/dims

1 0

Re: [legal-discuss] retention policy for old docs [WAS: [OpenStack-docs] Change of doc publishing]
by Lana Brindley 29 Aug '16

29 Aug '16

On 29/08/16 10:32, Lana Brindley wrote: > Hi everyone, > > Docs is planning some infrastructure changes, which would mean we need to consider our retention policy for old documentation on developer.openstack.org and docs.openstack.org. In the course of the discussion (some relevant bits below), we considered it prudent to ask the legal team to find out if Foundation have a retention policy in place for documentation on these sites that we should be aware of. > > Do you know of anything that might be relevant here? > > Thanks, > Lana > > > -------- Forwarded Message -------- > Subject: Re: [OpenStack-docs] Change of doc publishing > Date: Fri, 26 Aug 2016 17:36:53 -0700 > From: Anne Gentle <annegentle(a)justwriteclick.com> > To: Jeremy Stanley <fungi(a)yuggoth.org> > CC: openstack-docs(a)lists.openstack.org <openstack-docs(a)lists.openstack.org> > > > > > > On Fri, Aug 26, 2016 at 10:41 AM, Jeremy Stanley <fungi(a)yuggoth.org <mailto:fungi@yuggoth.org>> wrote: > > On 2016-08-26 05:40:31 -0700 (-0700), Anne Gentle wrote: > [...] > > I'd be comfortable with an archive policy that keeps all documents > > (project repos, openstack-manuals, api-site) for two years and > > then backs them up to a storage area that is not accessible from > > the web. > > Probably the closest thing we have to this is our server backups > (implemented using software called "bup"). Their purpose is to be > able to restore the previous state of our important systems in the > event of loss or compromise of service, so possibly not the same > thing you're desiring here. Also, identifying which documents are > "older" than a certain date is nontrivial (we can delete files last > modified before a certain date, but does that actually achieve the > same result?). > > How about taking this from the revision control perspective... we > (presumably) have the source used to build that rendered form of the > documentation all the way back to the beginning, and if someone > really needs (for legal reasons) a copy of it then they can expend > the resources to figure out how to render it again? > > > Lana, I believe you should review that with legal and the Foundation. > > There's the legal-discuss mailing list to get that started. > [...] > > [I am not a lawyer and I'm responding as a concerned member of the > community, not representing the opinions of my employer.] > > I won't object to anyone consulting lawyers, but I'm pretty sure the > Foundation (the only legal entity we really have in this context) is > under no contractual obligation to maintain documentation at all for > software produced by the community. It's probably best to start out > asking them from that angle, rather than soliciting their opinions > on how long they think old releases of software should have rendered > documentation on a Web site (that latter question is something the > community and in particular the community members working on that > content and those systems should be free to decide). > > I can understand the sort of legal paranoia which infects business > uses for documentation, but meeting those requirements falls on > those businesses. For example, Rackspace almost certainly retains > old versions of any documentation they've produced and published on > their site, some of which may be derived from old versions of > OpenStack upstream documentation, but meeting their document > retention requirements is not the legal responsibility of the > OpenStack community at large (how would any court even be able to > enforce such a requirement on our community itself?). > > > This phrasing is a bit strong (paranoia, infection, yikes). I want to be sure to represent that this is clearly an entirely new context, and all I have to draw from is past experiences. We'll need to listen to various representatives in the community to decide what outcomes we want here. > > > > If the OpenStack Foundation really is somehow legally responsible > for keeping and publishing old copies of OpenStack software > documentation, that's something they would need to do directly as > well. They have no authority to impose those requirements on the > community, and to my knowledge not even any mechanisms in place > through which they could ensure it's happening anyway. > > > Okay, this separation of Foundation from infra-team-members helps me understand your perspective in this policy shaping. > > I also want to add that this type of project is a cool opportunity to innovate in docs publishing. You'd learn a ton by helping out, and Andreas is a fantastic teacher, plus the infra team is super lively. At a scale of hundreds of thousands of pages this type of work is crucial, cool, and at a scale that you can have bragging rights on for years to come. :) > > Anne > > > -- > Jeremy Stanley > > _______________________________________________ > OpenStack-docs mailing list > OpenStack-docs(a)lists.openstack.org <mailto:OpenStack-docs@lists.openstack.org> > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-docs <http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-docs> > > > > -- Lana Brindley Technical Writer Rackspace Cloud Builders Australia http://lanabrindley.com

1 0

license issue with barbican
by Thomas Bechtold 29 Jul '16

29 Jul '16

Hi, Barbican has a plugin called dogtag[1]. This plugin imports "pki". While I tried to add pki as an extras requirement[2] I realized that it's dogtag-pki[3] that is required and not pki[4]. Using pki leads to an import error because there is code from dogtag-pki needed that is not in pki. So I started to look into dogtag-pki and wanted to add it to the global requirements repository but while doing that I realized that dogtag-pki's license is GPLv2. And according to[5] this is incompatible. How to handle this? Should the dogtag plugin be removed from barbican's source tree? Best, Tom [1] http://git.openstack.org/cgit/openstack/barbican/tree/barbican/plugin/dogta… [2] https://review.openstack.org/#/c/344232/ [3] https://pypi.python.org/pypi/dogtag-pki [4] https://pypi.python.org/pypi/pki [5] http://governance.openstack.org/reference/licensing.html

2 1

[keystone][murano][trove][imm] Changing OpenStack LLC to OpenStack Foundation
by Amrith Kumar 26 Jul '16

26 Jul '16

Bug 1214176 seeks to "Fix copyright headers to be compliant with Foundation policies" and one of the changes being made is to substitute "OpenStack Foundation" in places where the code said "OpenStack LLC". Someone just pushed changes to Keystone, Murano and Trove today and I have some concerns about this change. Consider the following changes, [2], [3], [4], and [5]. They assert a copyright in 2011 or 2010 of an entity called "OpenStack Foundation" that was only established in 2012 [6]. Are these changes legally accurate? -amrith [1] https://bugs.launchpad.net/bugs/1214176 [2] https://review.openstack.org/#/c/346675/1/keystone/policy/backends/rules.py [3] https://review.openstack.org/#/c/346673/1/tools/install_venv.py [4] https://review.openstack.org/#/c/346669/1/murano/common/cf_config.py [5] https://review.openstack.org/#/c/346669/1/murano/common/config.py [6] http://www.businesswire.com/news/home/20120919005997/en/OpenStack-Launches-…

4 3

Re: [legal-discuss] [openstack-dev] [keystone][murano][trove][imm] Changing OpenStack LLC to OpenStack Foundation
by Amrith Kumar 25 Jul '16

25 Jul '16

Dinesh, With the required disclaimer that I'm not a lawyer, and I don't play one on TV, I believe that the changes proposed to Trove in [1] do not make sense. I am not, I do not believe, competent to answer the question of whether or not the earlier changes to cinderclient or ironic must be reverted. -amrith [1] https://review.openstack.org/#/c/346673/ > -----Original Message----- > From: Bhor, Dinesh [mailto:Dinesh.Bhor@nttdata.com] > Sent: Monday, July 25, 2016 8:44 AM > To: OpenStack Development Mailing List (not for usage questions) > <openstack-dev(a)lists.openstack.org> > Subject: Re: [openstack-dev] [keystone][murano][trove][imm] Changing > OpenStack LLC to OpenStack Foundation > > Hi amrith, > > I can see the patches got merged against that bug with similar changes: > > [python-cinderclient] > https://review.openstack.org/#/c/47453/2/cinderclient/base.py > [ironic] > https://review.openstack.org/#/c/47451/2/ironic/common/image_service.py > > Do you think these changes needs to be reverted ? > > Thank you, > Dinesh Bhor > > -----Original Message----- > From: Amrith Kumar [mailto:amrith@tesora.com] > Sent: Monday, July 25, 2016 4:30 PM > To: legal-discuss(a)lists.openstack.org > Cc: OpenStack Development Mailing List (not for usage questions) > Subject: [openstack-dev] [keystone][murano][trove][imm] Changing OpenStack > LLC to OpenStack Foundation > > Bug 1214176 seeks to "Fix copyright headers to be compliant with > Foundation policies" and one of the changes being made is to substitute > "OpenStack Foundation" in places where the code said "OpenStack LLC". > > Someone just pushed changes to Keystone, Murano and Trove today and I have > some concerns about this change. > > Consider the following changes, [2], [3], [4], and [5]. > > They assert a copyright in 2011 or 2010 of an entity called "OpenStack > Foundation" that was only established in 2012 [6]. > > Are these changes legally accurate? > > -amrith > > [1] https://bugs.launchpad.net/bugs/1214176 > [2] > https://review.openstack.org/#/c/346675/1/keystone/policy/backends/rules.p > y > [3] https://review.openstack.org/#/c/346673/1/tools/install_venv.py > [4] https://review.openstack.org/#/c/346669/1/murano/common/cf_config.py > [5] https://review.openstack.org/#/c/346669/1/murano/common/config.py > [6] http://www.businesswire.com/news/home/20120919005997/en/OpenStack- > Launches-Independent-Foundation-Begins-Work-Protecting > > > __________________________________________________________________________ > OpenStack Development Mailing List (not for usage questions) > Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev > > ______________________________________________________________________ > Disclaimer: This email and any attachments are sent in strictest > confidence > for the sole use of the addressee and may contain legally privileged, > confidential, and proprietary data. If you are not the intended recipient, > please advise the sender by replying promptly to this email and then > delete > and destroy this email and any attachments without any further use, > copying > or forwarding. > > __________________________________________________________________________ > OpenStack Development Mailing List (not for usage questions) > Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev

1 0

Fwd: [tc][ansible][ironic] Reusing Ansible code in OpenStack projects
by Pavlo Shchelokovskyy 20 May '16

20 May '16

Hi all, I have a question re FOSS licenses interplay. I am pretty sure that OpenStack community (e.g. openstack-ansible) has already faced such questions and I would really appreciate any advice. We are developing a new ansible-based deployment driver for Ironic [0] and would like to use some parts of ansible-lib Python API to avoid boilerplate code in custom Ansible modules and callbacks we are writing, and in the future probably use Ansible Python API to launch playbooks themselves. The problem is Ansible and ansible-lib in particular are licensed under GPL v3 [1] "or later" [2]. According to [3] Apache 2.0 license is only one way compatible with GPL v3 (GPL v3-licensed code can include Apache 2.0-licensed code, but not vice versa). I am by far not a legal expert, so my questions are: Does it mean that the moment I do "from ansible import ..." in my Python code, which AFAIU means I am "linking" to it, I am required to use a GPLv3-compliant license for my code too (in particular not Apache 2.0)? What problems might that imply in respect with including such code in an OpenStack project (e.g. submitting it to Ironic repo) and distributing the project? If there are indeed problems with that, would it be safer to keep the code in a separate project and also distribute it separately? Even when distributed separately, will merely using (dynamically importing at run-time) a GPLv3-licensed driver from ApacheV2-licensed Ironic constitute any license violation? Note that technically we could avoid re-using Ansible code for Ansible modules and callbacks, just that it would be much-much less convenient. [0] https://review.openstack.org/#/q/topic:bug/1526308 [1] https://github.com/ansible/ansible/blob/devel/COPYING [2] https://github.com/ansible/ansible/blob/devel/lib/ansible/__init__.py#L8 [3] http://www.apache.org/licenses/GPL-compatibility.html Best regards, Dr. Pavlo Shchelokovskyy Senior Software Engineer Mirantis Inc www.mirantis.com

4 3

[keystone] ldappool - using MPL licensed code in-tree
by Steve Martinelli 13 May '16

13 May '16

A bit of background: - In order to make keystone py3 compatible, we have to make our LDAP code compatible - We use two libraries for our LDAP code: python-ldap and ldappool, both are not actively maintained - python-ldap has a py3 port called pyldap. Great! - ldappool does not have a py3 port. With all that said, ldappool is only a few hundred lines of code. Can we pull it in-tree? It looks like ldappool is MPL licensed: Version: MPL 1.1/GPL 2.0/LGPL 2.1 Exact license for ldappool is here: https://github.com/mozilla-services/ldappool/blob/master/ldappool/__init__.… We have a patch that pulls it in tree up for review (with a few changes to make it py3 friendly): https://review.openstack.org/#/c/311827/3/keystone/common/ldap/ldappool.py stevemar

1 1

Licensing for specs repos
by Ben Swartzlander 10 May '16

10 May '16

I started a thread [1] on the dev mailing list but wasn't able to get any helpful answers... The Manila project is creating a new repo for specs, and while looking at what other projects have done for specs repos, I could not figure out which license was being used. It seems that most specs repos (nova, cinder, neutron, contain a mixture of Apache 2.0 licensed stuff and CCBY (Creative Commons) licensed stuff. Some of these repos contain apparently-conflicting license declarations, with CCBY specified in the LICENSE file, but Apache 2.0 specified in the setup.cfg file. In all cases, individual files contain their own license declarations at the top and all of these repos contain some clearly Apache 2.0 licensed files (the python code in the repo) and some CCBY licensed files (the specs themselves). It seems unavoidable that we will have a similar situation in Manila, so I'm trying to figure out what to do at the top level for the LICENSE file and what license to point to in setup.cfg. Is there a way to explain to users that the project contains a mixture of 2 licenses? Is that acceptable or desirable? -Ben Swartzlander Manila PTL [1] http://lists.openstack.org/pipermail/openstack-dev/2016-May/094065.html

2 1

legal affairs committee meeting
by Strottman, Nissa 05 Oct '15

05 Oct '15

The next legal affairs committee meeting will be held Wednesday, October 14 at 4 pm ET/1 pm PT. Join online meeting<https://join.houston.hp.com/meet/nissa.strottman/BQCH66WT> https://join.houston.hp.com/meet/nissa.strottman/BQCH66WT Join by Phone +1-978-289-4114 (USA, Andover, MA) +1-678-367-0003 (USA, Atlanta, GA) +1-512-865-6123 (USA, Austin, TX) +1-208-629-2920 (USA, Boise, ID) +1-970-672-4888 (USA, Fort Collins. CO) +1-281-377-1991 (USA, Houston, TX) +1-650-300-4050 (USA, Palo Alto, CA) 1-855-493-4983 (USA/ Canada HP Customers/Partners) Find a local number<https://join.houston.hp.com/dialin> Conference ID: 437192273 Nissa M. Strottman Software, Cloud and Open Source Office of the General Counsel nissa.strottman(a)hp.com<mailto:nissa.strottman@hp.com> T +1 650 857 6279 M +1 650 387 4987 F +1 650 857 5409 Hewlett-Packard Company 3000 Hanover Street MS 1601 Palo Alto, CA 94304-1112 USA [HP]<http://www.hp.com/>

1 0

Center for Internet Security hardening standards
by Major Hayden 17 Sep '15

17 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello there, I'm currently working on a security hardening spec[1] and blueprint[2] for openstack-ansible. The goal is to bring additional security to OpenStack hosts via openstack-ansible and also to help organizations down the path to various compliance programs (like PCI). One of the firm PCI requirements[2] is PCI DSS Requirement 2.2 (page 30 in the PDF) which states that organizations must adhere to "industry-accepted" hardening standards. A few examples include Center for Internet Security (CIS), ISO, SANS, and NIST. Most of these are geared towards deployments of Red Hat Enterprise Linux and Windows, not Ubuntu. CIS seems to have the most comprehensive security hardening standards available for Ubuntu, and I'm able to port many of their recommendations for RHEL-based systems over to Ubuntu systems. However, their terms of use appears to be fairly strict. Rackspace (my employer) is a CIS member, but the OpenStack Foundation is not (as far as I know). I've reached out to CIS' member services group via our Rackspace account to find out if there's a possibility to license these hardening standards for open source use with OpenStack projects, but I'm not sure who they should get in contact with on the OpenStack side to discuss it. Would anyone be able to advise me on how to proceed? Thanks a bunch! [1] https://review.openstack.org/#/c/222619/ [2] https://blueprints.launchpad.net/openstack-ansible/+spec/security-hardening [3] https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf [4] https://benchmarks.cisecurity.org/downloads/form/index.cfm - -- Major Hayden -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJV+sIhAAoJEHNwUeDBAR+xlqEQAJWZV23yNWV7+XN1Pm7Utb6R D+pwPfN9up7RMhK5OFzvRGSEaGiQPRop+ENKNeBfiRfLCkI6mx2w5Z58E5NQCJEs v4ddxY5LokzOpizDmFl2Dkq3mrPCyC6bAE1tml5KF80vM5Vkt2IHnt7w5Q9QQ4hF UOcKI/4DFB2USO5lQr8jUMILzBUHLB+QO9L4NVxvYiz6LS1xgDRQ7AbmdloldLZb UqbqZ4rswfpSwCMn+h2jpBDwVzIykg22jdYQY61as8I1i7HrZoXBF2TaSyGc4lca FAzMxYBF7swWQ+W+/uk8+SUYOgqVSqslHtDyxKbz03JPlMhkSgAVAF80Q0AGE3Yt eq85QdLHkJnpdZNEfQ/TQHki+2seL+UNM/iSHlx//M+Qa5AZdgk+noEOhGT/dH3I +Bmz/PGBLJM67oow82No28tEo05xVtIGgDt5bUVf0oWCYy0OHjaLJ8w0DBrKXXlX otKsn5Q0Z08WUreX7fL74snb2yhg0BsGuR/NsHkJ2YQbG67v4Cr1QhCL8UAyI+OU MIRG1eswdERZKpBzBO6d+h4GsfEo7fDB6Q0uHe9kiwzVq5gHCI3t/miYwz4vabYR uZ4YVnfNfAmbjhh5I/uSAf2ie4T9h2b+yoqG6Yn51p43aLuZEHcPmc1VVv7M50Dz KDQ5nkxc/3XQcnmrZV7j =u4SR -----END PGP SIGNATURE-----

1 0

Incorporating MIT licensed code
by Major Hayden 09 Sep '15

09 Sep '15

Hello there, I just reviewed the Legal Issues FAQ[1], but I have some more specific questions around adding MIT licensed code to an OpenStack project that has traditionally been Apache licensed. I've already ensured that the file in question has the appropriate header and copyright details, but I'm unsure about how to handle the root LICENSE file within the repository. The FAQ mentions: > Probably the easiest thing to do when incorporating BSD or MIT licensed code is to copy the copyright/license header from the source file into the destination file, as well as copying the copyright notice, license and disclaimer into the toplevel LICENSE file with a brief explanation of which code is under that license. Should I put a divider in the LICENSE file and paste in the MIT license details after that? This may be a silly question (please let me know if it is), but I wanted to make sure I was following the legal instructions very carefully. Thank you! [1] https://wiki.openstack.org/wiki/LegalIssuesFAQ -- Major Hayden

2 2

Legal Affairs Committee Follow Up
by Radcliffe, Mark 28 Jul '15

28 Jul '15

At the last meeting, I stated that I was not aware of any litigation to enforce the Apache Software License. I have done a Westlaw search and have confirmed that there have been no reported cases to enforce the Apache Software License. Please consider the environment before printing this email. The information contained in this email may be confidential and/or legally privileged. It has been sent for the sole use of the intended recipient(s). If the reader of this message is not an intended recipient, you are hereby notified that any unauthorized review, use, disclosure, dissemination, distribution, or copying of this communication, or any of its contents, is strictly prohibited. If you have received this communication in error, please reply to the sender and destroy all copies of the message. To contact us directly, send to postmaster(a)dlapiper.com. Thank you.

1 0

Licensing options for new project (Kolla) entering big tent
by Steven Dake (stdake) 10 Jul '15

10 Jul '15

Hi folks, Kolla is a project for OpenStack with the mission [1]: " Kolla provides production-ready containers and deployment tools for operating OpenStack clouds that are scalable, fast, reliable, and upgradable using community best practices. " We use a set of libraries only available in Ansible v2.0. Shade [2] ASL2.0 uses these Ansible python libraries [3] licensed under a GPLv3 license. We use Shade in Kolla directly. We had planned to fork these libraries in [3] and cherry-pick only the modules we really need until Ansible 2.0 is available. I asked the TC if this approach would be in violation of the governance repository here: https://github.com/openstack/governance/blob/master/reference/new-projects-… To which Robert Collins suggested I speak with legal-discuss in this thread [4]. “ As I understand our current license situation, you won't be eligible for big-tent if you depend on GPLv3 code. >From the requirements " * Project must have no library dependencies which effectively restrict how the project may be distributed or deployed " So I'm also strongly inclined to recommend you speak to the legal list about the implications here. Using a GPLv3 tool via the CLI is very different (by the GPL's design) to using it as a library. -Rob -- Robert Collins <rbtcollins(a)hp.com<mailto:rbtcollins@hp.com>> Distinguished Technologist HP Converged Cloud “ I’d really like a solution that doesn’t involve rewriting all of the Ansible modules from scratch in a different license, but I guess we can do that if necessary. Can the OpenStack legal team provide some guidance for future TC voting around the thread in [4]? Our deadline for this work is July 31, but we need several weeks to make adjustments to our plans, so if appropriate guidance for the Technical Committee (and our community project) could be offered soon, it would be much appreciated. Regards, -steve [1] https://wiki.openstack.org/wiki/Kolla [2] https://github.com/openstack-infra/shade [3] https://github.com/ansible/ansible-modules-core The thread: [4] http://lists.openstack.org/pipermail/openstack-dev/2015-July/068612.html

7 16

Trademark policy page bug report: missing logos
by Dolph Mathews 12 Jun '15

12 Jun '15

(There might be a more appropriate place to send this note, such as a launchpad project or an email.address(a)openstack.org, but I could not find it. I trust that someone here can direct this to the right person!) In reading the OpenStack trademark policy [1], there are three occurrences of the phrase "shown immediately below" which imply that logos are intended to be included within the document, but no logos are included at all (or attempted to be included, according to the HTML source). [1] http://www.openstack.org/brand/openstack-trademark-policy/ -Dolph

2 2

StackForge and IP.
by Joe Marshall (projectcalico.org) 07 May '15

07 May '15

Hello, Following a suggestion from Jeremy Stanley (below), I'm contacting this list. If I understand Jeremy correctly, checking code in to StackForge does not transfer any IP, or grant any rights, other than those granted in the license declaration that we make in our code (in this case, the Apache 2.0 license). Is that correct? Many thanks, Joe Marshall. -----Original Message----- From: Emma Gordon Sent: 06 May 2015 13:06 To: Joe Marshall Subject: FW: [openstack-dev] [Fuel][Plugin] Contributor license agreement for fuel plugin code? -----Original Message----- From: Jeremy Stanley [mailto:fungi@yuggoth.org] Sent: 06 May 2015 12:58 To: OpenStack Development Mailing List (not for usage questions) Subject: Re: [openstack-dev] [Fuel][Plugin] Contributor license agreement for fuel plugin code? On 2015-05-06 11:02:42 +0000 (+0000), Emma Gordon (projectcalico.org) wrote: > If fuel plugin code is checked into a stackforge repository (as > suggested in the fuel plugin wiki > https://wiki.openstack.org/wiki/Fuel/Plugins#Repo) who owns that > code? I am not a lawyer, but my understanding is that the individual copyright holders mentioned in comments at the tops of various files, listed in an AUTHORS file (if included) and indicated within the repository's Git commit history retain rights over their contributions in a project relying on the Apache License (or those rights may belong to their individual respective employers in a work-for-hire situation as well). > Is there a contributor license agreement to sign? (For example, > contributors to OpenStack would sign this > https://review.openstack.org/static/cla.html) If Fuel is planning to apply for inclusion in OpenStack, then it may make sense to get all current and former contributors to its source repositories to agree to the OpenStack Individual Contributor License Agreement. Note that it does _not_ change the ownership of the software (copyrights), it's intended to simply reinforce the OpenStack Foundation's ability to continue to redistribute the software under the Apache License by affirming that the terms of the license are applied correctly and intentionally. More detailed questions are probably best posed to the legal-discuss(a)lists.openstack.org<mailto:legal-discuss@lists.openstack.org> mailing list, or to your own private legal representation. -- Jeremy Stanley

5 7