Contributor Agreement

[lukego]

Is there an important problem that the Contributor Agreement solves? Or is everything already covered by the MS-PL license?

I am nervous about signing contracts with strangers on the internet to be adjudicated in unfamiliar foreign legal systems 😁 but maybe that's fine if there is a good reason that we need one while (say) R and Julia don't.

EDIT to add: What's the context? are there other projects using this same agreement? where does the text come from?

[snunez1]

The Contributor Agreements essentially solves the problem of managing the IP risk, e.g. patent claims, warranty, ownership, etc. The description from contributoragreements.org says the agreements

... enable open source collaborative projects to receive, use, and share in-kind contributions from participants while eliminating or minimizing the legal risk therefrom to the projects and those who depend on them.

That's basically all there is to it. Good project management / corporate hygiene.

Most projects in started in recent years use them. A Google search for 'contributor license' will turn up many hits. I don't recall exactly where this one came from, and am open to comments on the contents. Several of the projects I participate in have them, a few with automatic integration into Github, like Google. (Nice, but too difficult to set up for one project).

[snunez1]

Thanks, the feedback is appreciated.

On jurisdiction, unless the project owner happens to reside in the same country that you do, any CLA is going to be with a foreign legal entity. 😄 Symbolics is a corporate sponsor, and a lot of time goes into the project, and we want the ability to have a clean legal paper trail if/when we ever get to deliver this as part of a project.

Also keep in mind that nothing prohibits creation and distribution of add-on projects under a different license. For example a summary system (see data-frame issue 4 could be built on top of Lisp-Stat and under a different license.

Perhaps I'll look at ways to ease the process. I've seen some repos where an agreement is checked into a specific directory and the act of submitting the agreement file along with the pull request constitutes agreement. I don't like the level of friction now, but a signature is the only thing that is valid in all countries.

[lukego]

Can't the base license include everything so that you can be comfortable, and everyone else can be too, on equal terms? Does your company really need to be given different, separate terms from everybody else? If so then it seems worth explaining why. I'm concerned that I don't understand what your expectations and intentions are around the future of the project.

Aside: The name "Symbolics" strongly connotes Lisp code being encumbered with legal problems for me, after your American namesake!

[snunez1]

Can't the base license include everything so that you can be comfortable, and everyone else can be too, on equal terms? Does your company really need to be given different, separate terms from everybody else? If so then it seems worth explaining why. I'm concerned that I don't understand what your expectations and intentions are around the future of the project.

The reason there are two agreements is because they are between different parties. I think by 'base license' you are referring to the MS-PL, which applies between the project and the end user. The CLA applies between the contributor and the project.

As for the reasons: by default, the originator of the code retains all rights to that code unless they agree otherwise. The purpose of the CLA is to give the project permission to use and distribute the code. The contributor also agrees that the code is theirs to give (i.e. it isn't their employers code), is free from patents, etc. At its simplest, the code is owned by the contributor and the CLA grants permission to the project to use it. Legally, without the contributors permission, the project can't use the code.

Generally the CLA covers three things:

• Contributor gives permission for the project to use the source code
• Contributor gives permission to use any patented 'stuff' that might be in the code
• Contributor actually has the authority to give above permissions

Here's Google's CLA policy with more information on the reasons a CLA is required, and an excerpt:

Standard inbound license

Using one standard inbound license that grants the receiving company broad permission to use contributed code in products is beneficial to the company and downstream users alike.

Technology companies will naturally want to make productive use of any code made available to them. However, if all of the code being received by a company was subject to various inbound licenses with conflicting terms, the process for authorizing the use of the code would be cumbersome because of the need for constant checks for compliance with the various licenses. Whenever contributed code were to be used, the particular license terms for every single file would need to be reviewed to ascertain whether the application would be permitted under the terms of that code’s specific license. This would require considerable human resources and would slow down the engineers trying to utilize the code.

The benefits that a company receives under a standard inbound license pass to downstream users as well. Explicit patent permissions and disclaimers of obligations and warranties clarify the recipients’ rights and duties. The broad grant of rights provides code recipients opportunities to make productive use of the software. Adherence to a single standard license promotes consistency and common understanding for all parties involved.

[lukego]

Thanks for the explanation. I understand your point of view.

From my potential-contributor perspective this creates work for me. I want to understand the license terms, know that all participants have equal rights, and know that Symbolics Pte is not a legal single point of failure for the project. To do this I will have to read the text of the MS-PL and read the text of the CA and check that they both say substantially the same thing. This will probably take less than an hour but it's a barrier to joining the community.

Maybe this is irrational but "Symbolics" and "Microsoft" are both names that I associate with legal problems for software. That is probably why I am so concerned about dotting my i's and crossing my t's here.

[snunez1]

I understand. I wish it were different, but I don't make the laws. Hopefully the amount of ceremony can be reduced. I can't speak to the reputation of Symbolics and Microsoft have. We choose Symbolics thinking that there were few left working who would remember them, and I'm a bit surprised that you do; your picture makes you much younger. As for Microsoft, they sure seem to be open source friendly these days. A remarkable turn-around, ranking up there with Gerstner's work on IBM.

FYI, I've put an FAQ in the new docs (the ones that will go out with data frame v2).

[lukego]

Thanks for your time. I suppose that making the project terms acceptable to everyone is not necessarily a goal anyway. Filtering potential participants is a legitimate function of licenses, contributor agreements, codes of conduct, etc. Just like the way you and the CLML developers are not collaborating due to differences uncovered in licensing discussions.

For me the counter-party to the contract is too unknown. I don't know you, or who you are referring to by "we", or anything about your company. This is at least as important to me as the terms of the contract itself. So although the license text looks fine to me I'm not willing to sign it.

I'll use DATA-TABLES and CL-CSV to dump data for analysis in R because that is the path of least resistance.

[Symbolics]

For anyone that finds this thread: we've decided on cla-assistant to manage 'click-through' CLAs. This seems to be the most popular CLA manager for open-source project. Python is (slowly) migrating over to this, so it is probably a good choice for Lisp-Stat too. The contributing page of the documentation site has been updated.

CLA assistant will automatically prompt you to sign upon opening a pull request, if you haven't already. You need sign only once for any of the Lisp-Stat projects.