Add Common Cure Rights Commitment

pup-0005.md

@@ -0,0 +1,148 @@
+---
+title: Common Cure Rights Commitment
+author: Richard Fontana
+created: 13-Apr-2018
+status: Approved
+---
+
+## Summary
+
+This proposal adopts the Common Cure Rights Commitment (CCRC) for the
+Pulp project.
+
+## Motivation
+
+GPLv2 features an "automatic termination" provision, triggered by any
+license violation, which may in some cases cause even well-meaning
+users to lose their rights under the GPL if they fail to comply fully
+with the requirements of the license. In recent years, one GPLv2
+project developer in one jurisdiction has based an enforcement
+strategy around taking advantage of automatic termination in ways that
+many in the technology industry see as abusive.
+
+Concern about the harshness of the GPLv2 termination policy led the
+Free Software Foundation to modify it in GPLv3 by adding a 60-day
+period of repose and a 30-day cure provision for first-time violators,
+giving users an opportunity to correct noncompliance and get their
+licenses automatically reinstated.
+
+In October 2017 the Linux Foundation Technical Advisory Board adopted
+a statement on GPLv2 enforcement policy, containing a commitment to
+extend the cure and repose provisions of GPLv3 to users of the Linux
+kernel. As of this date over 100 Linux kernel developers have signed
+on to this
+[statement](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/kernel-enforcement-statement.rst).
+
+In November 2017, a coalition of companies led by Red Hat
+[announced](https://www.redhat.com/en/about/press-releases/technology-industry-leaders-join-forces-increase-predictability-open-source-licensing)
+that they were adopting a similar commitment, the CCRC, for all of
+their copyrighted code that was licensed under GPLv2, LGPLv2.0 and
+LGPLv2.1. Red Hat persuaded an additional set of companies to
+[adopt](https://www.redhat.com/en/about/press-releases/momentum-builds-new-wave-technology-industry-leaders-join-efforts-increase-predictability-open-source-licensing)
+the CCRC in March 2018.
+
+Red Hat would like to encourage projects to adopt the CCRC as
+well. The issue is relevant for projects maintained or led by Red Hat
+developers for a few reasons: (1) GPLv2 and LGPLv2.x are licenses that
+many Red Hat developers continue to prefer; (2) projects led by Red
+Hat developers accept contributions under the project license (as
+opposed to an asymmetrical contributor license agreement); and (3)
+traditionally Red Hat developers have exercised broad discretion on
+project licensing policy.
+
+Pulp is a good candidate for adoption of the CCRC at the project
+level. Pulp is a GPLv2-licensed community project of commercial
+significance to Red Hat, and Pulp has been making significant efforts
+to build a community around the project, which over time will
+encourage contributions to the project from various copyright holders.
+
+## Common Cure Rights Commitment, version 1.0
+
+Common Cure Rights Commitment, version 1.0
+
+Before filing or continuing to prosecute any legal proceeding or claim
+(other than a Defensive Action) arising from termination of a Covered
+License, we commit to extend to the person or entity ('you') accused
+of violating the Covered License the following provisions regarding
+cure and reinstatement, taken from GPL version 3. As used here, the
+term 'this License' refers to the specific Covered License being
+enforced.
+
+    However, if you cease all violation of this License, then your
+    license from a particular copyright holder is reinstated (a)
+    provisionally, unless and until the copyright holder explicitly
+    and finally terminates your license, and (b) permanently, if the
+    copyright holder fails to notify you of the violation by some
+    reasonable means prior to 60 days after the cessation.
+
+    Moreover, your license from a particular copyright holder is
+    reinstated permanently if the copyright holder notifies you of the
+    violation by some reasonable means, this is the first time you
+    have received notice of violation of this License (for any work)
+    from that copyright holder, and you cure the violation prior to 30
+    days after your receipt of the notice.
+
+We intend this Commitment to be irrevocable, and binding and
+enforceable against us and assignees of or successors to our
+copyrights.
+
+Definitions
+
+'Covered License' means the GNU General Public License, version 2
+(GPLv2), the GNU Lesser General Public License, version 2.1
+(LGPLv2.1), or the GNU Library General Public License, version 2
+(LGPLv2), all as published by the Free Software Foundation.
+
+'Defensive Action' means a legal proceeding or claim that We bring
+against you in response to a prior proceeding or claim initiated by
+you or your affiliate.
+
+'We' means each contributor to this repository as of the date of
+inclusion of this file, including subsidiaries of a corporate
+contributor.
+
+This work is available under a [Creative Commons Attribution-ShareAlike 4.0 International license](https://creativecommons.org/licenses/by-sa/4.0/).
+
+## Displaying the CCRC
+
+A file named COMMITMENT will be added to the root of the Pulp git
+repository, in the same directory as the LICENSE file. Other Pulp
+project repositories using GPLv2 or LGPLv2.1 are encouraged to
+include a copy of the same file.
+
+## Drawbacks
+
+None.
+
+## Alternatives
+
+### Continue use of GPLv2 without the CCRC
+
+The Pulp project can continue to use GPLv2 without adding the
+CCRC. Addition of the CCRC provides a reduction in risk of unfair GPL
+enforcement against users of Pulp, but this was not a large risk to
+begin with. The major expected impact of adoption of the CCRC is its
+influence on general norms around GPLv2 interpretation and enforcement
+in the larger open source community.
+
+### Relicense Pulp to an open source license with a cure provision
+
+The Pulp project could relicense from GPLv2 to GPLv3, which would
+eliminate any point in adopting the CCRC since GPLv3 already has the
+cure and repose provisions. Such relicensing is probably possible
+though might take some time to effectuate, and may not be preferred by
+the Pulp developers or community.
+
+The Pulp project could also relicense to a mainstream open source
+license with a cure provision outside the GPL family, which would
+basically mean the Eclipse Public License 2.0 or the Mozilla Public
+License 2.0. However this would signify a significant change in
+license policy (comparable to switching to LGPL).
+
+### Relicense Pulp to a noncopyleft license
+
+Noncopyleft licenses like the Apache License 2.0 and the MIT license
+do not address termination at all (and currently see no known active
+license enforcement). Relicensing Pulp to such a license may be
+possible but would represent a major change in project licensing
+policy.