Contributor agreement (was Re: what I did on my patch-pilot week)

[Martin Pool]

Alexander asked about this, so I wanted to give at least a bit of an
interim and unofficial update on it.  Karl has put together a good
summary and Canonical is working on improving the agreement text
and/or the explanation of it.

2009/12/2 David Ingamells <david.ingamells at mapscape.eu>:

> Item 1:
>
>   * "Assigned Contributions" is "quoted" in the last sentence when the
>     term has already been used in the first sentence, and is explained
>     only in item 4 Canonical is not explained in this item instead
>     only being introduced in item 3. It is general practice in legal
>     documents to introduce all such terms before using them ( not just
>     I and Me), usually in the preamble.

This seems reasonable but I have no particular comment on stylistic
things; they're with the legal department.

>
> Item 1 and 2 together:
>
>   * MAJOR ISSUE: If I assign something to Canonical it is because it
>     is my intention that my contribution is to be made freely
>     available to the public, however this agreement does not constrain
>     Canonical to not use the contribution unless they have made even
>     one release to the public domain. Item 6 only talks about
>     "ordinarily" which is much less than "always" or even "once". I
>     would be very annoyed if Canonical, having gained copyright under
>     this agreement, used my contribution solely for commercial gain.
>     Item 2 does allow me perpetual rights of distribution, but these
>     rights do not extend to others. There needs to be a constraint
>     that the assignment of copyright lapses if the contribution is
>     never released into the public domain with a free license - e.g.
>     Canonical has no right to use the contribution or enforce the
>     copyright unless it is first released with a Free software License.

Clause 2 does ensure you can do what you want with your own
contributions, including distributing them to others under your choice
of terms.  (Obviously this applies only to your own particular
contributions, not code written by others.)  If for whatever reason
Canonical doesn't merge your code, or doesn't release it, or doesn't
release it under a satisfactory licence, you have the option to
release it yourself.  This should probably at least be clarified in
the faq.

>>> 2. Canonical grants to Me a world-wide, non-exclusive, royalty-free and perpetual right to use, copy, modify, communicate and make available to the public (including without limitation via the Internet) and distribute, in each case in an original or modified form, the Assigned Contributions as I wish.

> Items 3 and 4:
>
>   * These are definitions of terms and not actually anything that has
>     to be agreed. They should be introduced in a preamble, and
>     Canonical also included (see item 1 above).
>
> Item 5:
>
>   * MAJOR ISSUE: Apparently this point is already under discussion.
>     This item places an onerous burden. For example what constitutes
>     an expense? Would it include my man-hours at commercial rates for
>     my professional level? "Acts" could include me being required to
>     travel to England or elsewhere and stay there for a lengthy court
>     case during which time I could not perform my professional
>     function and earn my wages.

No, you will not be asked to do onerous acts.  What this clause
contemplates is for example signing a paper document confirming that
you agreed to the assignment by email.  Apparently to a lawyer this is
obvious, but I think we should/will make it more clear.

>
> Item 7:
>
>   * This as worded includes violation of patents that are not used
>     within my Assigned Contribution. It should be limited to patents
>     infringed by the contribution only. Suppose I have a patent that
>     is not related to my contribution, but that another portion of the
>     software that is unknown to me violates my patent, or later
>     another party makes such a contribution, then I must retain the
>     right to enforce my patent. [I might add that I personally don't
>     own patents and am in general opposed to software patents.]
>
> Item 8:
>
>   * Should be reworded as "If I am or become aware that any of my
>     Assigned Contributions infringe any patent ..." . One may be aware
>     of a patent without realising that the contribution infringes it.
>     If you've ever read patent documents you would realise that they
>     are often deliberately written to be very difficult to understand
>     and interpret.

These seem like reasonable things to fix.

>
> Item 13:
>
>   * Why agree to something that can only be binding by having sent the
>     agreement? Use "I agree that this agreement is binding if it is
>     sent attached to an email which contains my name typed in full
>     which shall constitute ...".

To a programmer this looks like a kind of layering inversion, like the
instructions on how to use it should be outside of the agreement.  I
don't know if it matters much in practice.

>   * MAJOR ISSUE: This requirement is open to abuse, as anyone could
>     send such an email with my name in it without my knowledge and it
>     is easy to falsify sender's addresses in email as huge amounts of
>     spam can prove.

As Karl(?) mentioned, if a miscreant forges mail purporting to be from
you, you obviously are not accountable for what they say.

The risk here is to Canonical: we may think you have agreed when in
fact you have not.  It is a tradeoff against the relative weakness of
email, against the relative difficulty for a contributor of signing a
paper document (as the fsf do) or signing with a well-connected
trusted gpg key.  As technology develops we may do something stronger.

If you look at the social context of people having an ongoing email
conversation about a patch, attempts to exploit this would probably be
obvious: you submit a proposal, we ask you to do the agreement, we
then say "thanks!" and merge your patch --> you say "hey, I didn't
sign it (yet)!"

There is also a gap that I have no idea whether the person reading
this email is called "David Ingamells" by his government or by his
mother.  It is a bit of a philosophical question whether it matters.
The same kind of gap is present in paper assignment unless you require
it to be witnessed by a justice of the peace, which becomes a bit
onerous and even then is not bulletproof...

-- 
Martin <http://launchpad.net/~mbp/>