4 ms·

You are technically correct but I do see a difference between signing a CLA with The Linux Foundation, Eclipse, ASF etc. and a purely commercial corporate entit

You are technically correct but I do see a difference between signing a CLA with The Linux Foundation, Eclipse, ASF etc. and a purely commercial corporate entity.

Pannoniae 3y ago
You are entirely right; it's nowhere comparable. I'm just talking about the theoretical impacts. (after all, the re-licencing was also a theoretical problem, i.e. Hashicorp might abuse the non-compete clause so Terraform is not safe to use) I just find it interesting to mention - after all, the important details the ones which are not talked about.
- hyperpape 3y ago
  For at least a few years now, companies relicensing their open source software has not been just a theoretical possibility, but a plausible thing that could happen any time. I don’t know what happens to the Linux Foundation when we’re all in the nursing home, but them relicensing everything is not currently plausible. It is a merely theoretical possibility.
riku_iki 3y ago
> signing a CLA with The Linux Foundation, Eclipse, ASF etc. what is the reason those require CLA? Why underlying license is not enough?
- koolba 3y ago
  If there’s no intention of ever changing the license, then there is no need for a CLA. A CLA is required when the repo owner wants the ability to change the license down the road without contacting N contributors.
  - n42 3y ago
    yes, but it's not always malicious. one example is to dual license the code. for example, Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses. a good CLA in this instance would guarantee you that your code cannot be relicensed exclusively away from GPL. the software is still free as in freedom, but the organization can fund itself by courting businesses that would not touch GPL software.
    - lars_francke 3y ago
      Another example is OpenStreetMap which changed its license because we learned that the old one wasn't adequate for the purpose intended. We have no idea how today's licenses will be challenged in the future and I believe it's a good practice to keep a door open to being able to change the license going forward. That it's not done maliciously is a purpose for foundations which serve as trust anchors.
      - freedomben 3y ago
        that's an interesting point, thanks. I'm still skeptical of a CLA for such a project since a ton (currently all) of the copyright is held by Hashicorp meaning they would have to consent to the future license change as well, regardless of the CLA or foundation membership. In general I think that makes a point for a CLA, but in this case I don't think it does.
    - riku_iki 3y ago
      > Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses. but that's exactly the case which happened in case of Hashi, so CLA allowed them to continue working on commercial product only, with all 3p contributions being under their proprietary license.
      - detaro 3y ago
        Qt's situation is different, since they have contractual obligations to continue releasing under (L)GPL - failure to do so allows the KDE Project to release Qt under MIT.
  - jen20 3y ago
    A CLA is not required for that. A copyright assignment is. A CLA is not necessarily a copyright assignment, and a copyright assignment is not necessarily a CLA.
ghaff 3y ago
For what it's worth, the CNCF is not big on CLAs in general although, as far as I know, they don't specifically prohibit them. In general, they prefer to use a developer certificate of origin.
- lars_francke 3y ago
  Doesn't Kubernetes require a CLA?
  - mdaniel 3y ago
    it does, they even have a label for it: https://github.com/kubernetes/kubernetes/pulls?q=label%3A%22cncf-cla%3A+yes%22 https://github.com/kubernetes/kubernetes/pulls?q=label%3A%22...
  - justincormack 3y ago
    Yes. A small number of CnCF projects do. Google originally had a CLA in k8s and this was kept.
- pests 3y ago
  Are you sure of the CNCF not being big on CLAs? According to the link below: > Anyone who is contributing any code to any CNCF project must have the CLA signed. https://contribute.cncf.io/resources/glossary/#:~:text=Contributor%20License%20Agreement https://contribute.cncf.io/resources/glossary/#:~:text=Contr...
  - ghaff 3y ago
    That's a bit surprising to read because here's what @cra of the Linux Foundation said a couple years ago: It’s [a Developer Certificate of Origin] how the Linux kernel works, where basically it takes all the basic things that most CLAs do, which would be like, ‘Did I write this code? Did I not copy it elsewhere? Do I have the rights to give this to you, and you sign off on?’ It’s been a very successful model played out in the kernel and many other ecosystems. I’m generally not really supportive of having CLAs unless there’s a real strict business need." https://opensource.com/article/20/2/open-source-projects-governance https://opensource.com/article/20/2/open-source-projects-gov...
sanderjd 3y ago
Yeah this makes sense. "CLAs (or DCOs) assigning copyright to foundations are good, CLAs assigning copyright to corporate entities are questionable" does seem like a pretty good rule of thumb for contributors who care about this kind of thing (which I agree most people should).

You are technically correct but I do see a difference between signing a CLA with The Linux Foundation, Eclipse, ASF etc. and a purely commercial corporate entity.

Pannoniae 3y ago

You are entirely right; it's nowhere comparable. I'm just talking about the theoretical impacts. (after all, the re-licencing was also a theoretical problem, i.e. Hashicorp might abuse the non-compete clause so Terraform is not safe to use) I just find it interesting to mention - after all, the important details the ones which are not talked about.

hyperpape 3y ago
For at least a few years now, companies relicensing their open source software has not been just a theoretical possibility, but a plausible thing that could happen any time. I don’t know what happens to the Linux Foundation when we’re all in the nursing home, but them relicensing everything is not currently plausible. It is a merely theoretical possibility.

riku_iki 3y ago

> signing a CLA with The Linux Foundation, Eclipse, ASF etc. what is the reason those require CLA? Why underlying license is not enough?

koolba 3y ago
If there’s no intention of ever changing the license, then there is no need for a CLA. A CLA is required when the repo owner wants the ability to change the license down the road without contacting N contributors.
- n42 3y ago
  yes, but it's not always malicious. one example is to dual license the code. for example, Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses. a good CLA in this instance would guarantee you that your code cannot be relicensed exclusively away from GPL. the software is still free as in freedom, but the organization can fund itself by courting businesses that would not touch GPL software.
  - lars_francke 3y ago
    Another example is OpenStreetMap which changed its license because we learned that the old one wasn't adequate for the purpose intended. We have no idea how today's licenses will be challenged in the future and I believe it's a good practice to keep a door open to being able to change the license going forward. That it's not done maliciously is a purpose for foundations which serve as trust anchors.
    - freedomben 3y ago
      that's an interesting point, thanks. I'm still skeptical of a CLA for such a project since a ton (currently all) of the copyright is held by Hashicorp meaning they would have to consent to the future license change as well, regardless of the CLA or foundation membership. In general I think that makes a point for a CLA, but in this case I don't think it does.
  - riku_iki 3y ago
    > Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses. but that's exactly the case which happened in case of Hashi, so CLA allowed them to continue working on commercial product only, with all 3p contributions being under their proprietary license.
    - detaro 3y ago
      Qt's situation is different, since they have contractual obligations to continue releasing under (L)GPL - failure to do so allows the KDE Project to release Qt under MIT.
- jen20 3y ago
  A CLA is not required for that. A copyright assignment is. A CLA is not necessarily a copyright assignment, and a copyright assignment is not necessarily a CLA.

ghaff 3y ago

For what it's worth, the CNCF is not big on CLAs in general although, as far as I know, they don't specifically prohibit them. In general, they prefer to use a developer certificate of origin.

lars_francke 3y ago
Doesn't Kubernetes require a CLA?
- mdaniel 3y ago
  it does, they even have a label for it: https://github.com/kubernetes/kubernetes/pulls?q=label%3A%22cncf-cla%3A+yes%22 https://github.com/kubernetes/kubernetes/pulls?q=label%3A%22...
- justincormack 3y ago
  Yes. A small number of CnCF projects do. Google originally had a CLA in k8s and this was kept.
pests 3y ago
Are you sure of the CNCF not being big on CLAs? According to the link below: > Anyone who is contributing any code to any CNCF project must have the CLA signed. https://contribute.cncf.io/resources/glossary/#:~:text=Contributor%20License%20Agreement https://contribute.cncf.io/resources/glossary/#:~:text=Contr...
- ghaff 3y ago
  That's a bit surprising to read because here's what @cra of the Linux Foundation said a couple years ago: It’s [a Developer Certificate of Origin] how the Linux kernel works, where basically it takes all the basic things that most CLAs do, which would be like, ‘Did I write this code? Did I not copy it elsewhere? Do I have the rights to give this to you, and you sign off on?’ It’s been a very successful model played out in the kernel and many other ecosystems. I’m generally not really supportive of having CLAs unless there’s a real strict business need." https://opensource.com/article/20/2/open-source-projects-governance https://opensource.com/article/20/2/open-source-projects-gov...

sanderjd 3y ago

Yeah this makes sense. "CLAs (or DCOs) assigning copyright to foundations are good, CLAs assigning copyright to corporate entities are questionable" does seem like a pretty good rule of thumb for contributors who care about this kind of thing (which I agree most people should).