New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Contributor License Agreement #205

Closed
lminiero opened this Issue Apr 9, 2015 · 36 comments

Comments

Projects
None yet
@lminiero
Copy link
Member

lminiero commented Apr 9, 2015

@DamonOehlman @ancorgs @megawac @EvanDotPro @yultide @uxmaster @gatecrasher777 @sashton-stoneware @mingewang @giavac @mrauhu @mporrato @dsoprea @leonuh @Computician @nowylie @davibe @mpromonet @ploxiln @leighman @saghul @pwithnall

Hi guys, sorry for the mass mention. Each of you contributed to Janus more or less recently (thanks again for that!), and since our legal team prepared us a Contributor License Agreement to discipline any upcoming contribution, they also asked me to get back to you and ask you to sign it for what you already helped us on:

https://www.clahub.com/agreements/meetecho/janus-gateway

As explained in the CLA introduction, this is common practice for several open source projects like ours: you basically give us a license to use your code (and acknowledge that it’s really something you wrote), but you still own the copyright of course, which means you can obviously still modify your code and use it in other projects, if you want.

Let me know if you have any question or issue with this: I'm no lawyer, and I'm sure many of you know more of this stuff than I do, but if I can help clarify something that puzzles you I'm all for that!

Thanks!

@lminiero lminiero added the question label Apr 9, 2015

@saghul

This comment has been minimized.

Copy link
Contributor

saghul commented Apr 9, 2015

@lminiero I can sign it if you need me to, but is it really necessary? See https://www.joyent.com/blog/broadening-node-js-contributions

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 9, 2015

@saghul interesting article, thanks for sharing!
About it being really necessary or not, I wish I knew :-) When it comes to such legal shores, I'm pretty much at sea, which explains why I never considered this an issue so far in the first place. I guess that, in principle, for a company like ours it's better to have one than not have anything at all, but that's just my two cents.

@davibe

This comment has been minimized.

Copy link
Contributor

davibe commented Apr 9, 2015

Done.

On Thu, Apr 9, 2015 at 1:04 PM, Lorenzo Miniero notifications@github.com
wrote:

@saghul https://github.com/saghul interesting article, thanks for
sharing!
About it being really necessary or not, I wish I knew :-) When it comes to
such legal shores, I'm pretty much at sea, which explains why I never
considered this an issue so far in the first place. I guess that, in
principle, for a company like ours it's better to have one than not have
anything at all, but that's just my two cents.


Reply to this email directly or view it on GitHub
#205 (comment)
.

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 9, 2015

@davibe thanks!

@saghul

This comment has been minimized.

Copy link
Contributor

saghul commented Apr 9, 2015

@lminiero signed.

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 9, 2015

@saghul thanks!

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 9, 2015

Ops, forgot @xenyou @LetsVape @scottmas, for some reason they don't appear in the list of contributors github builds automatically although they had pull requests accepted.

@LetsVape

This comment has been minimized.

Copy link

LetsVape commented Apr 9, 2015

Signed it!
Wasn't expecting a mention as it was such a small fix. But hope to work on some more meaningful pull requests in the future anyway :)!

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 9, 2015

@LetsVape looking forward to that! thanks :-)

@nowylie

This comment has been minimized.

Copy link
Contributor

nowylie commented Apr 9, 2015

@lminiero getting an error when I attempt to sign:
"We're sorry, but something went wrong."

@ancorgs

This comment has been minimized.

Copy link
Contributor

ancorgs commented Apr 9, 2015

Same error here.

@xenyou

This comment has been minimized.

Copy link

xenyou commented Apr 10, 2015

I got the same error.

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 10, 2015

@nowylie @ancorgs @xenyou not sure what that may be, probably an issue (temporary?) in CLAHub. Have you already tried again to see if it was fixed in the meanwhile? I guess trying to sign out and then open the CLA page again could be worth an attempt. Thanks!

@nowylie

This comment has been minimized.

Copy link
Contributor

nowylie commented Apr 10, 2015

@lminiero I just tried signing out of everything and giving it another go. Same issue.

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 10, 2015

I've just opened an issue on the CLAHub repo, hopefully they'll provide us with some guidance on what to do: clahub/clahub#109

@nowylie

This comment has been minimized.

Copy link
Contributor

nowylie commented Apr 10, 2015

I was just looking at their repo. It appears other's have had a similar issue: clahub/clahub#56

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 10, 2015

@nowylie when you signed out, did you try sign out from github or CLAHub? Apparently in one of earlier, similar issues, doing the latter did the trick: https://clahub.com/sign_out

@nowylie

This comment has been minimized.

Copy link
Contributor

nowylie commented Apr 10, 2015

The first time I tried it, I signed out of github.
I just tried signing out of CLAHub and still got the same error.

@pwithnall

This comment has been minimized.

Copy link
Contributor

pwithnall commented Apr 11, 2015

Sorry, I am not signing a CLA for my contributions, given happily under GPLv3, which would allow you to relicence them under a proprietary licence.

Matthew Garrett sums this up quite well: http://mjg59.dreamwidth.org/29160.html.

About it being really necessary or not, I wish I knew :-) When it comes to such legal shores, I'm pretty much at sea, which explains why I never considered this an issue so far in the first place. I guess that, in principle, for a company like ours it's better to have one than not have anything at all, but that's just my two cents.

I strongly suggest you research what you are asking people to do before asking them to do it. CLAs for patent grants and affirmation of copyright ownership are different to the one you are asking people to sign; they either don’t affect the outbound code licence, or require the outbound licence to be compatible with the inbound one. Patent granting and affirmation of copyright ownership can just as easily be handled using a Developer Certificate of Origin system like the Linux kernel: https://www.kernel.org/doc/Documentation/SubmittingPatches, §11.

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 11, 2015

@pwithnall thanks for the clarification: as I said, I'm new to this. And I want to strongly restate that, from my point of view, nothing is supposed to change: we want to and will keep Janus GPLv3 forever (just so that we don't pass like the evil schemers, now...).

We don't want to definitely relicense it to something else, proprietary or not, but allow for alternative licensing mechanisms for those who ask for it: we were told that, since we accepted contributions, a CLA would allow for that. We did a bit of research and found many OS projects doing the same (see Asterisk, for instance, but that's just the first that comes to mind) which convinced us it was indeed the approach most take from a legal standpoint. Not pretty, apparently, but ostensibly safe.

From what @saghul and you told by providing those examples, that may not be necessary. I'm unfortunately not a lawyer and have no idea whether that's the case or not: I definitely would like it to be, as it would allow us to keep on going on the way we did since day one! But if it's not, what's the catch? We're a very small company, devoted on this and other efforts with the few resources we have: should we provide alternative licenses to those who ask for it and then it turns out we couldn't, what happens? We're not Cisco, we don't stand any chance in any court.

Anyway, we'll keep on looking into this. Right now CLAHub doesn't seem to be working anyway :-)

@pwithnall

This comment has been minimized.

Copy link
Contributor

pwithnall commented Apr 11, 2015

we want to and will keep Janus GPLv3 forever (just so that we don't pass like the evil schemers, now...).

Then please state as much in your CLA!

But if it's not, what's the catch?

Alienating contributions from third parties: even if people are willing to sign a CLA, it’s an extra barrier to contribution which many drive-by contributors will not bother dealing with.

@ploxiln

This comment has been minimized.

Copy link
Contributor

ploxiln commented Apr 11, 2015

The catch, if you do not use a CLA in the form you originally proposed, is that you can't distribute a closed-source version of janus or plugins, you must offer the source to those who receive the binary, and it must be under the GPLv3. And you can't allow your customers to distribute a closed-source version of janus or plugins, it's the same situation. This is considered not a strong position to be in from a business and lawyer point of view, it means your company will be worth less to investors or acquirers, it means you'll have less leverage in legal disputes.

The catch, if you do use this CLA, is that savvy contributors will be uncomfortable with the asymmetrical relationship, they're contributing to your company's private success, and possibly even to proprietary software, sometime in the future.

Also notice that, if you hadn't switched from AGPLv3 to GPLv3 in June 2014, one couldn't write a closed-source plugin and then run it themselves to offer services to customers / public users, but since you did switch, one can (as long as one does not distribute the plugin).

I hope this doesn't come off as strongly one way or the either. But it looks like you should hope that your lawyer is satisfied with something that just asks for explicit confirmation of what was implicit before, which is that contributions to janus-gateway must be licensed compatibly with the project's license, GPLv3.

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 13, 2015

@ploxiln thanks for your thoughts. As I anticipated, I'd be absolutely ok with the only requirements to the contributions to be GPLv3 as the project, if that indeed allowed us to double license the project when needed. We're not interested in releasing a closed version to someone and not provide them with the source: as I said, we'll keep on working on Janus here. What we want is the ability to provide that someone with a commercial license, if we're asked, which should allow them to modify what they need and not disclose the source.

As far as I've understood (and your first paragraph seems to confirm that, please correct me if I'm wrong), that's unfortunately not the case. Again, we're a small company, and so those points are indeed important to us. We've probably been too naive when we started for not considering something like this since the beginning. If you guys have any suggestion on how to change/improve that CLA feel free to share.

@pwithnall

This comment has been minimized.

Copy link
Contributor

pwithnall commented Apr 13, 2015

What we want is the ability to provide that someone with a commercial license, if we're asked, which should allow them to modify what they need and not disclose the source.

I’m afraid that means I will definitely not be signing the CLA. Unfortunately you are going to have to rewrite my (few, small) contributions in the case that you do provide the code under a different licence to someone.

@mingewang

This comment has been minimized.

Copy link
Contributor

mingewang commented Apr 14, 2015

tried to sign, got error
"We're sorry, but something went wrong."

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 16, 2015

@pwithnall it saddens me to hear that, but of course I respect your decision. I'll make sure to address those changes in the next few weeks, should that happen.

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 16, 2015

Since CLAHub still isn't working, and they don't seem to respond on the issues page, we have to assume the project isn't that followed, actually... for this reason, we reimplemented a similar feature ourselves. You can find the new CLA page here:

https://cla.conf.meetecho.com/janus/

I already imported the signatures of those who signed before, so no need to do that again for those for which it worked. Let me know if you encounter any issue here as well.

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 16, 2015

Mentioning @ancorgs @xenyou @nowylie and @mingewang in particular, as you confirmed you tried with CLAHub and it failed.

@mingewang

This comment has been minimized.

Copy link
Contributor

mingewang commented Apr 18, 2015

just signed

@xenyou

This comment has been minimized.

Copy link

xenyou commented Apr 19, 2015

Signed.

@gatecrasher777

This comment has been minimized.

Copy link
Contributor

gatecrasher777 commented Apr 19, 2015

I would sign if i could retain some anonymity, but it seems to fail if you skip any fields.

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 19, 2015

@mingewang @xenyou thanks!
@ancorgs of course I understand, keep us posted :-)
@gatecrasher777 fields are not validated, so you're free to put placeholders in the ones that you want skipped (e.g., especially the last textarea in case it doesn't apply).

@gatecrasher777

This comment has been minimized.

Copy link
Contributor

gatecrasher777 commented Apr 19, 2015

Signed.

@ancorgs

This comment has been minimized.

Copy link
Contributor

ancorgs commented Apr 21, 2015

@lminiero Signed just in my very own personal behalf. Just mentioning that because I want you to know that my employer's lawyers consider that CLA dangerous (or at least risky) for a company (or anyone having registered patents).

@lminiero

This comment has been minimized.

Copy link
Member Author

lminiero commented Apr 21, 2015

@gatecrasher777 and @ancorgs thanks! And thanks for sharing those considerations.

@leighman

This comment has been minimized.

Copy link
Contributor

leighman commented May 1, 2015

Like @pwithnall I'm not prepared to sign this.
Thanks.

@lminiero lminiero closed this Jul 19, 2015

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment