Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing open-source contributor presents a dilemma when accepting their PR

bettersoftware.uk

Post reply on HN
Print view View original

61–70 of 73 posts

Re: Missing open-source contributor presents a dilemma when accepting their PR

#61

Post by diggan »

In order to open a PR to a repository, you need to push the commit somewhere, usually your own fork. And since that fork already contains the same LICENSE as the upstream project (your project), the author of the PR has essentially already licensed the code under the same LICENSE you use.

So I'd get rid of the bot asking people to confirm the change is copyright-free (since it's already implicitly copyright-free, they've pushed it to GitHub already), and merge the PRs without making contributors jump through additional hoops.

But it seems like when corps like Microsoft et al does open source, they like to sprinkle in a bit of bureaucracy to the process for the sake of bureaucracy, should hardly come as a surprise to anyone.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#62

Post by diggan »

rty32 wrote: post #30

> The contribution bot asks for confirmation the code change is copyright-free A confirmation is simply unnecessary. Can't it work like, writing this somewhere that says, by creating a pull request, you agree all your code and the discussions around the pull request is now copyright free? Saves everybody time and avoid hassles like this. The other side of this is I get very annoyed by CLAs -- there have been a number…

> Can't it work like, writing this somewhere that says, by creating a pull request, you agree all your code and the discussions around the pull request is now copyright free?

It already does, implicitly. If Author A has a repository with a MIT LICENSE and Author B forks that to their own GitHub account (which they must do in order to open the PR), that fork already has a LICENSE file (usually) together with their change, so the change already been made copyright free.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#63

Post by FrankRay78 »

politelemon wrote: post #15
ndiddy wrote: post #14

The author didn't link to the actual PR so I can't see the full context, but I don't see the point in setting up a bot to make contributors agree to copyright terms if the maintainers just ignore it when someone does a PR and then doesn't engage with the bot. It seems like a waste of time for all parties.

I think it might be this one: https://github.com/spectreconsole/spectre.console/pull/991 though, it's dealing with a zero input rather than null

It was this one. I glossed over the description of the exact change above, given the issue is broader than just the PR in question.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#65

Post by veggieroll »

diggan wrote: post #61

In order to open a PR to a repository, you need to push the commit somewhere, usually your own fork. And since that fork already contains the same LICENSE as the upstream project (your project), the author of the PR has essentially already licensed the code under the same LICENSE you use. So I'd get rid of the bot asking people to confirm the change is copyright-free (since it's already implicitly copyright-free, the…

The problem is that licensing under the same terms is not enough for most corporate open source stewards. They want copyright assignment, meaning you give them all of your rights.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#66

Post by diggan »

veggieroll wrote: post #65
diggan wrote: post #61

In order to open a PR to a repository, you need to push the commit somewhere, usually your own fork. And since that fork already contains the same LICENSE as the upstream project (your project), the author of the PR has essentially already licensed the code under the same LICENSE you use. So I'd get rid of the bot asking people to confirm the change is copyright-free (since it's already implicitly copyright-free, the…

The problem is that licensing under the same terms is not enough for most corporate open source stewards. They want copyright assignment , meaning you give them all of your rights.

My understanding is that if that was the bot would be asking for, they'd ask for a CLA/DCO or similar, which doesn't seem to be what it currently asks for

> The contribution bot asks for confirmation the code change is copyright-free, but the contributor doesn’t respond.

Maybe the author is summarizing though and the bot asks the author to confirm it's copyright free and also to sign the CLA/DCO. If so, unlikely their corporate overlord would be OK with them just merging the PR without explicitly signed CLA/DCO.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#67

Post by veggieroll »

diggan wrote: post #66
veggieroll wrote: post #65

Earlier quoted context omitted.

The problem is that licensing under the same terms is not enough for most corporate open source stewards. They want copyright assignment , meaning you give them all of your rights.

My understanding is that if that was the bot would be asking for, they'd ask for a CLA/DCO or similar, which doesn't seem to be what it currently asks for > The contribution bot asks for confirmation the code change is copyright-free, but the contributor doesn’t respond. Maybe the author is summarizing though and the bot asks the author to confirm it's copyright free and also to sign the CLA/DCO. If so, unlikely thei…

Absolutely. In this case, CLA isn't an issue. But I bring it up, because it seems to me that this article is a consequence of the prevalence of CLA's in projects advised by professional legal advice.

This issue of "how can we ensure this code is under copyright terms XYZ" seems to have been popularly solved by CLA's. And thus a pall has been cast over the traditional open source dynamic, where there'd normally be no question that a fork with a license in the repo is obviously licensed under the same terms.

I've heard this on legal podcasts as well. Where lawyers spend like 30+ minutes talking about whether a license in the project root counts. To the traditional free software / open source movement, this seems really silly, because that's how software projects worked for almost the entire existence of free software / open source software until the last 5-ish years.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#68

Post by WorldMaker »

ndiddy wrote: post #14

The author didn't link to the actual PR so I can't see the full context, but I don't see the point in setting up a bot to make contributors agree to copyright terms if the maintainers just ignore it when someone does a PR and then doesn't engage with the bot. It seems like a waste of time for all parties.

The extra useful context I spotted at the top of the blog post was that the project falls under the auspices of the .NET Foundation [0]. The .NET Foundation like several of the other FLOSS foundations/conservatories/archive/consortiums requires a CLA as a CYA in extra part because of the legality concerns that for a project in the Foundation they want to make sure that you understand you are contributing not just to that specific project, but in general as a collective effort towards the Foundation.

This may be an interesting discussion for the author to have more directly with Foundation leadership and legal on what the expectations are.

There's also yes, the larger discussion on if Foundations such as this are possibly too conservative in their FLOSS bureaucracy/red-tape for smaller contributions to smaller projects. Under the good for the goose/gander assumption it's easy to add the same bots to every project and assume that's good enough, but does it stifle innovation or bug fixes on projects with fewer eyes?

[0] https://dotnetfoundation.org/

Re: Missing open-source contributor presents a dilemma when accepting their PR

#69

Post by NegativeK »

lupusreal wrote: post #50
NegativeK wrote: post #28

Earlier quoted context omitted.

Python has a CLA that allows the PSF board to relicense the code to "any other open source license approved by unanimous vote".

Legally speaking, once they own the copyright, is there anything stopping the PSF from selling out and changing their policy to permit proprietary licensing? I have this same concern with GNU. I can imagine a future where some key figures have died or retired and the new org sells out and changes the license to something RMS never would have agreed to.

To go along with the other response, they don't own your copyright -- but I don't know if the language in the Python CLA actually holds them to the "we can only relicense to open source licenses" if challenged in a court.

But that's not really a risk I care about. The PSF is a nonprofit that's clearly aimed at being a nonprofit, and a Future Evil Board is beyond what I'm going to worry about.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#70

Post by thayne »

noirscape wrote: post #55
thayne wrote: post #36

Earlier quoted context omitted.

A DCO [1] would serve that purpose better. It's possible that the desire to have the flexibility to change the license at some point in the future is initially well-intentioned (for example you may start out as GPL, but want the option to change to Apache 2.0 later), so having a CLA doesn't necessarily imply they plan on doing a rug pull. And of course there is probably also some cargo cult of using a CLA because tha…

Keep in mind that a DCO is not the same thing as a CLA; kemitchell has written about the subject[0]. In short - the DCO is specifically written to meet the needs of the Kernel and some of it's expectations assume the workflow of the LKML and the code style of the kernel. He lists 6 conditions that you'd need to meet before the DCO is useful for your project. The most notable ones are that or-later licenses aren't a g…

> rather than existing to unify the copyright of the Kernel behind one entity

Unifying the copyright behind one entity is the problem with a CLA. Especially if that entity is a company that might have pressures to change the license to a proprietary license.

Post reply on HN