[License-discuss] BSD 3-clause and copyright notices

[Zluty Sysel]

Hi there,

Thanks for the reply.

On Wed, Sep 30, 2015 at 10:33 PM, Henrik Ingo <henrik.ingo at avoinelama.fi> wrote:
> On Tue, Sep 29, 2015 at 5:13 PM, Zluty Sysel <zluty.sysel at gmail.com> wrote:
>> Hi all,
>>
>> After conquering many hurdles along the way, it looks like the company
>> I am a part of is willing to release a good part of the source code we
>> own as open source software. Before we do that though there are a
>> couple of outstanding issues that I was hoping someone on this mailing
>> list could clarify. We want to use a BSD 3-clause and immediately
>> publish the source code on a public code repository allowing
>> contributions from users. The questions that have arisen are the
>> following:
>>
>> 1) Clause 2 requires users that distribute the software in binary form
>> to reproduce the copyright notice. Since the holder of the copyright
>> notice is the very same company that makes the source code available
>> to them, would it be possible to selectively waiver this obligation to
>> a particular set of users without infringing on the Open Source
>> definition or the BSD license itself?
>
> Yes and no.
>
> Since your employer owns the copyright to this software, they of
> course have the right to issue any licenses to it that they want. One
> such license could bd BSD+waiver, to a specific list of recipients. If
> these recipients are your customers, you would probably send them a
> letter with such text. Alternatively you could publish the waiver on
> your website, etc. Doing this would not be unheard of.
>
> However, since you intend to receive outside contributions, this
> becomes trickier. You cannot issue a waiver on behalf of the other
> developers who will own copyrights to the code they have contributed.

And that's exactly the company's fear. As another reply in this thread
mentioned, waivers are complicated and we'd be thrilled not to have to
issue any or even think about them. But the reality is that, although
we do want the project to become open source we need to care about
customers who might not want to mention that they use "our" open
source software.

>
>> If the answer was negative, would including the existence of such a
>> waiver in the license itself preclude it from being considered an open
>> source software license?
>
> Well, it would no longer be the BSD license and hence it would not be
> an OSI approved open source license.
>
> A license with such a waiver may still be open source in the sence
> that it would conform to the Open Source Definition. However, if you
> wanted general approval for it, you would have to submit it to OSI
> review as a new license. I think it's a fair estimate that you might
> not succeed in having such a modified license approved though.

I  feared so. And that's why ideally we'd use an already approved OSI
license, but one that doesn't force binary distributions to reproduce
the license. Perhaps a zlib license would be better for us?

>> 2) When accepting contributions to the source code repository from
>> external sources, I have seen that is sometimes customary to include
>> an additional copyright line to the license text included at the top
>> of the source file, crediting the person or company that contributed
>> the new code or file.
>> Would then the waiver mentioned in question 1) be in violation of the
>> additional copyright holder(s)' rights?
>
> Yes, as I explained above.
>
> There are some practices in the open source community that could still
> help you get around this. For example sometimes a central copyright
> holder may require other contributors to assign their rights to the
> central entity. (This can be either a for-profit or non-profit
> corporation.) In this case the problem goes away, since your employer
> would continue to own rights to 100% of the code. Note however that
> such contributor agreements / IPR assignments are somewhat unpopular
> in the community. The main reasons behind that are that a) they add
> bureacratic overhead to the act of contributing, and b) they add
> inequality to the contributor community, for example the central
> entity may use its right to include the contributed code in closed
> source products. In your case, since the code is BSD licensed anyway,
> the b) concern may not be so important.

>From what I gather it should be then possible to keep the copyright
entirely the company's but then "acknowledge" the rest of contributors
in a file or on the website. Perhaps that would actually be a
possibility for us given that we expect most contributors to submit
changes for their own benefit and not for ours.

> You could also simply say that contributors must accept the waiver,
> otherwise you won't receive their contribution. For added legal
> safety, you should probably require some kind of signed acceptance of
> this. Thus the bureucratic overhead is equivalent to a contributor
> agreement anyway.

Well if we forbade to add copyright notices in the source files
themselves and instead only allowed contributors to add themselves in
an "AUTHORS" or even "ACKNOWLEDGEMENTS" file, that would be
automatically the case I would assume? Or would there still be the
need for a formal document that contributors would have to sign?

>
>> 3) When reproducing the copyright notice in binary distributions, must
>> one parse all source code files to find out all of the contributors'
>> names and include them in full? Or is it enough to simply provide a
>> LICENSE file that only credits the original author (the company that
>> made the source code available originally) so that users of the source
>> code can simply reproduce that particular file in their binary
>> distributions?
>
> Yes, I suppose. I don't think this is commonly done though. I've seen
> Oracle do it for a short while when they acquired MySQL, but I don't
> think they do it anymore.
>
> The BSD requires one to reproduce "The above copyright notice". One
> way to avoid this problem would be to enforce a style where the
> copyright notice is always the same, such as "The Foo project" or
> "MyCompany and contributors". This way it doesn't matter which
> individual contributed to each source file. You should of course in
> that case maintain some other file, perhaps CONTRIBUTORS.TXT, to
> credit the contributors to the project.

Or, as mentioned above: (c) The Company and then a CONTRIBUTORS file
that actually lists the contributors without assigning them any
ownership rights. If that is indeed possible of course, but I already
asked the question above.

> Note that losing track of who contributed what code might again be
> considered bad practice for other reasons.

Version Control should help out with that.

Zluty