Request for Comments: Fedora Project Contributor Agreement Draft (Replacement for Fedora Individual Contributor License Agreement)

[Tom Callaway]

Hello Fedora! (Is this thing on?)

Sorry for the very wide net, but we wanted to make sure as many members
of our community could see this as possible.

For some time now, Fedora has been working with Red Hat Legal to come up
with a replacement for the Fedora Individual Contributor License
Agreement (aka, the Fedora ICLA). As a result, the Fedora Project
Contributor Agreement (FPCA) has been approved by Red Hat Legal, and is
now being presented to the Fedora Community for comments and discussion.

The full text of the FPCA, along with a FAQ, can be found here:

https://fedoraproject.org/wiki/Legal:Revised_Fedora_CLA_Draft

Please, take a moment and read the FPCA and the FAQ. It is not a long,
or overly complicated document, as legal documents go, but it is
important that all Fedora Contributors read it over and make sure they
understand it and like it (or can at least agree to it).

Fedora Legal wishes to give the Fedora community a window of time for
discussion and review of the FPCA. This window is open until May 18,
2010 (2010-05-18). After that point, either a revised FPCA will be
released for review, or we will begin the process of phasing in the FPCA
and phasing out the Fedora ICLA.

Thanks in advance,

Tom "spot" Callaway, Fedora Legal

P.S. Fedora Legal would like to give a huge thank you to the people
involved behind the scenes to make the FPCA possible. The primary author
was Richard Fontana, with feedback from Tom Callaway, Pamela Chestek,
Paul Frields, and Robert Tiller. Feel free to give them gifts (for
example, drinks or tasty snacks) as thank yous, although, this is not a
requirement (legal or otherwise). ;)
_______________________________________________
devel-announce mailing list
devel-announce(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel-announce

[Charles Zeitler]

Do what thou wilt
shall  be the whole  of the Law.

On 4/19/10, Tom "spot" Callaway <tcallawa(a)redhat.com&gt; wrote:
>  Hello Fedora! (Is this thing on?)
>
>  Sorry for the very wide net, but we wanted to make sure as many members
>  of our community could see this as possible.
>
>  For some time now, Fedora has been working with Red Hat Legal to come up
>  with a replacement for the Fedora Individual Contributor License
>  Agreement (aka, the Fedora ICLA). As a result, the Fedora Project
>  Contributor Agreement (FPCA) has been approved by Red Hat Legal, and is
>  now being presented to the Fedora Community for comments and discussion.
>
>  The full text of the FPCA, along with a FAQ, can be found here:
>
>  https://fedoraproject.org/wiki/Legal:Revised_Fedora_CLA_Draft
>
>  Please, take a moment and read the FPCA and the FAQ.
>
>  Thanks in advance,
>
>  Tom "spot" Callaway, Fedora Legal
> l
>  
i looked at this (and the MIT license) didn't see any explicit reference
to source code! (e.g. , that it must be made available.)

charles zeitler


Love is the law, love under will.

[Matt McCutchen]

On Wed, 2010-04-21 at 16:15 -0500, charles zeitler wrote:
>  i looked at this (and the MIT license) didn't see any explicit
> reference
>  to source code! (e.g. , that it must be made available.) 
Indeed.  For an MIT licensing regime to be considered "free", the
original author must provide the source.  But being non-copyleft, the
license does not require distributors of derived works to provide
source.

I can't imagine Fedora accepting a contribution in binary form, so I
believe this is a non-issue.

-- 
Matt

[Neal Gompa]

But it should be explicitly stated anyway. Legalese isn't English.
Note: IANAL

On Wed, Apr 21, 2010 at 4:28 PM, Matt McCutchen <matt(a)mattmccutchen.net&gt;wrote:

>  On Wed, 2010-04-21 at 16:15 -0500, charles zeitler wrote:
>  > i looked at this (and the MIT license) didn't see any explicit reference
>  > to source code! (e.g. , that it must be made available.)
>
>  Indeed.  For an MIT licensing regime to be considered "free", the
>  original author must provide the source.  But being non-copyleft, the
>  license does not require distributors of derived works to provide
>  source.
>
>  I can't imagine Fedora accepting a contribution in binary form, so I
>  believe this is a non-issue.
>
>  --
>  Matt
>
>  --
>  devel mailing list
>  devel(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/devel
>

[Tom Callaway]

On 04/22/2010 01:45 AM, Sir Gallantmon (ニール・ゴンパ) wrote:
>  But it should be explicitly stated anyway. Legalese isn't
> English.
>  Note: IANAL 
Well, there is nothing in the FPCA that says we will accept or use your
contribution, even if it is acceptably licensed. :)

I'm not sure there is a lot of merit in writing out all of the possible
permutations of what consists of a contribution that Fedora will accept,
outside of licensing.

For example, stating "no binaries", wouldn't be true, as we might have a
situation where we would have a bootstrapped binary contributed along
with the source, but for bootstrapping reasons, needs to be included as
a starter.

Stating "no binaries without matching source" wouldn't be true either,
as content isn't always required to have matching source (what is the
"source" for a PNG file?).

This road leads to pages and pages of conditionals and cases, which are
inevitably going to be incomplete, and to which we will need to make
revisions overtime, and everytime we make a revision here, we'll have to
open a new discussion period on a new draft which has to clear through
Red Hat Legal, and then we have to revoke the old FPCA for everyone and
have everyone sign the new one. We're desperately trying to avoid that
by keeping it as simple and direct as possible.

We already have separate guidelines which we enforce independent of the
FPCA that say:

"All software in Fedora must be under licenses in the  Fedora licensing
list." (https://fedoraproject.org/wiki/Licensing#Overview)

and

"All program binaries and program libraries included in Fedora packages
must be built from the source code that is included in the source
package." (... and several notable paragraphs documenting exceptions there)
(https://fedoraproject.org/wiki/Packaging/Guidelines#No_inclusion_of_pre-b...)

These guidelines are much easier for us to change in the format that
they exist in today.

When the FPCA is boiled down, it amounts to this:

You, the individual agreeing to the FPCA is promising Fedora (and Red
Hat) that:

* If you aren't the copyright holder for a work that you are submitting
to Fedora as a contribution, that you have received appropriate
permission from the copyright holder(s) of that work to submit it to
Fedora (and if that work is under a Fedora acceptable license, that
counts as appropriate permission.) [Clause 1]

* If you are the copyright holder for a work that you are submitting to
Fedora as a contribution, but you have not put a license on it, you are
agreeing to let Fedora use it under specific, defined Fedora Acceptable
licenses (MIT if it is code, CC-BY-SA with section 4d waived if it is
content) [Clause 3]

* You agree to give Fedora the right to change the default licenses for
unlicensed contributions, from the list of Fedora Acceptable licenses,
and have that new license also apply to your contributions.
[Clause 3]

The Fedora Project is promising to You (and everyone) that:

* If a contribution comes to us under a Fedora acceptable license, and
we decide to accept it, we will use it under the terms of that license.
[Clause 2]

******
And to be honest, we really didn't want to overreach with the FPCA.
Thats all we really felt that we needed to have you explicitly agree to.

~spot

Bootstrapping binaries

[Matt McCutchen]

On Thu, 2010-04-22 at 09:25 -0400, Tom "spot" Callaway wrote:
>  For example, stating "no binaries", wouldn't be true,
> as we might have a
>  situation where we would have a bootstrapped binary contributed along
>  with the source, but for bootstrapping reasons, needs to be included as
>  a starter. 
In such cases, we should seriously consider trying to repeat the entire
bootstrapping process purely from source code.  Otherwise, there is no
way to ever know whether the binary contains a heritable trojan, a la
"Reflections on Trusting Trust", short of auditing the disassembly.

-- 
Matt

Bootstrapping binaries

[Kevin Kofler]

Matt McCutchen wrote:
>  In such cases, we should seriously consider trying to repeat the
> entire
>  bootstrapping process purely from source code. 
In many of the problematic cases (where the compiler can only be 
bootstrapped with itself), this involves either going up an extremely long 
chain of old versions of the same compiler, which may not be available 
anymore and which may not build anymore on current Fedora, or bootstrapping 
from a proprietary compiler, which may not be available for Fedora and which 
may not be available anymore at all, or even both. Unfortunately, bootstrap 
binaries are often the only viable solution.

Unfortunately, many compiler writers write their compiler in its own 
language, probably because that's what they know best and/or what they 
believe to be the best language to write programs in. The bootstrapping 
issue is given little consideration in that kind of decision. :-(

        Kevin Kofler