Special CLA Minutes 2006-09-08
From MemberWiki
Contents |
Minutes from special one-time meeting on CLA approaches
Attendees
- Adam Peller <apeller@us.ibm.com>
- Anil Sharma <anil@vertexlogic.com>
- Chris Schalk <chris.schalk@oracle.com>
- Coach Wei <coach@nexaweb.com>
- David Boloker <boloker@us.ibm.com>
- David Frankel <david.frankel@sap.com>
- Eddie O'Neil <ekoneil@bea.com>
- James Margaris <jmargaris@nexaweb.com>
- Jeffrey Thompson <jthom@us.ibm.com>
- John Janetos <jjanetos@laszlosystems.com>
- Jon Ferraiolo <jferrai@us.ibm.com>
- Joonas Lehtinen <joonas.lehtinen@itmill.com>
- Kin Blas <jblas@adobe.com>
- Victor Leith <vsleith@us.ibm.com>
Meeting Announcement
(The following is copy/paste of the email that announced this meeting)
Hi everyone, I am writing to announce a special joint one-time meeting among the two technical committees (Interoperability and Declarative Markup). Here is the call-in information:
Subject: Contributor agreements for code contributors to SourceForge project Date/Time: Friday, 8 September, 9am-California, noon-NewYork, 6pmParis Phone#: 1-888-227-9220 Passcode: 871757
The general subject is how to deal with the issue of ensuring that all contributions to our SourceForge project are all clean and proper from a legal perspective such that people who download from that project are able to use those downloads in a royalty-free and unemcumbered manner (i.e., consistent with Apache v2.0 licensing).
In attendance will be Jeffrey Thompson, the IBM lawyer who is the primary author of the OpenAjax Alliance Members Agreement. Jeff believes that the Members Agreement already includes appropriate language that covers our requirements for code contributions. Here is his proposal:
(1) There is only one document that says what the IPR rules are for Contributions to the SourceForge project - the OpenAjax Alliance Members Agreement (http://www.openajaxalliance.org/member/wiki/Members_Agreement). (Actually, the IPR section of the Members Agreement.) In particular, we don't need to have a separate Individual Contributor License Agreement or a separate Corporate Contributor License Agreement.
(2) The home page for the SourceForge project will say that the project is managed by the OpenAjax Alliance and that all material within the project is covered by the Alliance's IPR policy within the Members Agreement (with URL to the Members Agreement).
(3) From the home page of the SourceForge project, there is a standard form that any Contributor (Member or Non-Member) to the SourceForge project must fill out and send via email to the Project Admin that states the following:
(a) Whether he is contributing material as a representative of a Member company or not (i.e. he is a Non-Member). If a Member, identify the company.
(b) Confirm that all of his contributions are subject to the Alliance's IPR policy (with URL to the Members Agreement).
(c) Confirm that he is the original author of all contributions that he is submitting.
(4) We can start work on the SourceForge project immediately by simply having all Contributors fill out the form discussed in #3 above. This is independent of the timing of when his company signs the Members Agreement. The form simply states that his contributions to the SourceForge project are under the terms of the IPR sections of the Members Agreement.
One of the main topics of discussion (the only topic of discussion if we are lucky) is whether Jeff's approach satisfies our requirements.
Thanks everyone. Hope you can make it. If you can't make it and you have questions or opinions on the subject, feel free to send public email (to the lists above) or private email to me. It is important to get this issue behind us so we can rev up the open source project.
Jon
Other background information
This section contains relevant background information that was not part of the meeting, but is included here for the sake of posterity. The following two section describe alternative approaches that have been discussed within the alliance in the past.
Alternate approach: have a separate Contributor License Agreement like Apache and Dojo
Adopt a process whereby all contributors to the project must fill out and sign an appropriate Contributor License Agreement, similar to what exists at Apache (http://www.apache.org/licenses/icla.txt and http://www.apache.org/licenses/cla-corporate.txt) and Dojo (http://dojotoolkit.org/icla.txt), before the Project Admin will allow them to join the open source project.
This might manifest itself similar to what Dojo has done, which is to clone the Apache Contributor License Agreement(s) and replace "Apache Foundation" with "OpenAjax Alliance", but this solution still requires discussion. For OpenAjax Alliance, which has some large companies as members, we might want to provide both an individual CLA and a corporate CLA.
Once we have addressed the issue of contributor license agreements, then we should be able to check in code and begin feverish work on completing the OpenAjax Hub version 1.
Alternate approach: dual approach where only non-members have to sign a CLA
Discussed in Interoperability Minutes 2006-08-30. Here is an excerpt from those minutes:
alex: hybrid where member agreement is a shortcut, but CLA is still an option
jon: will take that back to IBM lawyers
Discussion during the meeting
Jeff: Apache has a CLA. Same IP grants as Apache v2 license, plus a few extra structural things such as additional warranties. But we have these in our Members Agreement already, and all members will have already signed the Members Agreement. By using my proposed approach, we avoid having two agreements that might be considered different with different IPR policies. Possible confusion about which document and which rules apply. Instead of having a separate CLA, send email that confirms whether a member or non-member. If member, acknowledge understanding that contributions are under terms of MA's IPR policy. If non-member, send note that not a member but nevertheless contributions are under IPR policy.
Jeff: SourceForge web site's home page should state the project's IPR policy. Contributors send email indicating they acknowledge. Exposure is minimal but straightforward and efficient.
Coach: If contribution from someone who is not a member yet, does email cover it?
Jeff: Same as any other sourceforge project. If you send email saying you are contributing under a set of terms, how do you later explain you didn't understand this given record of your contribution email?
Coach: Individual contributors must send email?
Jeff: Yes. But for non-members, I would be happier if there was a signed doc somewhere.
Coach: We hope outsiders will contribute down the road.
Jeff: Definitely would want an indication of where code came from with confirmation of understanding of IPR terms. I would be OK with hardcopy, possibly scanned into PDF. But is this a burdern?
Coach: Good to avoid people signing but is email confirmation sufficient from a legal perspective?
Jeff: The more clearly you can demonstrate contributor understanding the better. It's a tradeoff. Best if there are witnesses observing the signature. But doesn't happen much these days. Instead, now we are sending contracts scanned as PDFs and conducting business on that basis. We don't want to make it too complicated. But a signature is stronger than an email.
DavidB: Does Apache require a signature?
Coach/Jeff: Yes.
Jeff: Apache creates files in TIFF right out of their fax machine and stored them electronically.
Jeff: Single-line contributors for Apache don't require CLAs, but we (IBM?) are encouraging more signatures.
Coach: To me, sending email is sufficient.
Jeff: But if we require externals to sign, our members should sign, too. Not that big of a deal.
Jon: Anyone feel email acknowledgement is insufficient?
(No objections raised)
Jeff: We should ask first whether anyone sees the need for a separate CLA versus the Member Agreement's IPR policy
Coach: Can you give high-level overview of IPR policy?
Jeff: Text put into specs - essential technologies are royalty free and members say they will not assert patents. Code is covered under Apache license, which states royalty free and patents will not be asserted. Also, statements about not violating copyrights or trade secrets.
Coach: IPR policy covers what we need. Second question - do we need a separate CLA?
Jeff: I do not think so.
Coach: My experience, some open source projects have separate CLAs, others don't. I think it is OK not to have a separate CLA.
Jeff: IPR policy is equivalent to what you would put into a CLA.
Coach: Yes.
Jeff: So next question is what evidence will people provide that they understand the IPR policy?
Coach: Good question. I don't have a clear answer. As a member, I think email is sufficient. Your company has signed.
Jeff: Yes, it is more of a reminder.
Coach: In other case, non-member, more complicated. Higher-level requirement for committers. I think they need a signature. For lesser contributors, email ok.
Adam: Can individuals join the alliance?
Jeff: Not sure if Members Agreement leads one way or another. Steering Committee decides who can join.
Adam: People want to sign a CLA like in other projects and then start contributing code.
Jon: Non-members sending a signature is OK with me.
Jeff: The more evidence the better. But this is fine.
Coach: Email evidence works in court?
Jeff: Not a large number of cases in court. But look at everyone's behavior. Lots of contracts exchanged via email, with paper copies sent later usually.
Coach: Still believe what I said earlier. OK for there to be non-member committers.
DavidF: Not an official legal opinion, but I agree with Coach. Best to be careful with non-members.
Davidb: Agree with you and Jeff.
Jeff: OK, let's proceed.
RESOLUTION: Contributors who are working in SourceForge project on behalf of Members (i.e., Members who have signed the Members Agreement and had that agreement accepted by Steering Committee) can just send an email with boilerplate language available from the SourceForge project's home page stating that they are contributing on behalf of Member company <enter-company-name-here> and understand that their contributions are being made under the terms of the IPR policy from the Members Agreement. Non-member committers must print boilerplate language available from the SourceForge project's home page stating that contributions are made under the terms of the IPR policy from the Members Agreement, and then sign the hardcopy and send it to the Alliance.
(EDITORIAL NOTE: We did not reach a decision about what happens with contributions from people who are non-members and non-committers. Two subcategories here: substantial contributions from non-member non-committers, and small contributions from non-member non-committers.)
(EDITORIAL NOTE: These open issues were resolved during Interoperability Minutes 2006-09-13 and approved by Interim Steering Committee later that day as follows: Resolution: Non-members have to sign. OK to fax. Exception is trivial contributions such as 3 lines or less. Committers will have requirements to review all contributions to determine if contributor has sent in signed agreement and if not whether contribution is trivial and without patentable algorithms.
DavidF: I will send minutes to our attorney.
Chris: Will need to send it to our attorney, also.
Adam: Agrees with Coach.
Joonas: Would it be possible to have the IPR policy explained in layman's terms?
Jeff: Don't ask me, I'm a lawyer, I already think it is clear.
Jon/Jeff: Dangerous to offer alternative language. Opens possibility of two sets of binding definitions for the same thing.
Joonas: OK. I fully agree.
