[License-review] Approval: BSD + Patent License

[Richard Fontana]

On Wed, Jan 13, 2016 at 06:57:00PM +0000, Smith, McCoy wrote:
> We believe that this license is non-duplicative (for the reasons set
> forth above), as it solves an issue all but one OSI-approved license
> solves (permissive, express patent license grant, GPLv2
> compatibility).  The license itself is a combination of language
> from the BSD 2-clause license, the Apache 2.0 license, and the
> Eclipse Public License (all of which are already OSI-approved, and
> all of which are in the category of “Licenses that are popular and
> widely used or with strong communities”).  It therefore should meet
> all the criteria of the OSD.

Hi McCoy,

I basically like this proposed license.  I do have one concern. You
have understandably reused text from the Apache License 2.0.

The patent license language is granted by "Each copyright holder and
contributor". Later on, however, I note that the language fixing the
claims that are licensed assumes that anyone granting the patent
license is a copyright holder.

The latter language is fine; there's a specific reason why the
references to "contributors" bothers me.

OpenStack is an Apache License 2.0 project. Over the past couple of
years the OpenStack Foundation and OpenStack technical community
discussed the issue of whether and to what extent to replace the CLAs
used by OpenStack with the DCO (recently resolved through a compromise
whereby the individual CLA has been eliminated but the corporate CLA
retained). Mostly in the context of my role at Red Hat, I happened to
be a strong supporter of the view that OpenStack would be better off
without either of those CLAs.

Mark Radcliffe, general counsel of the OpenStack Foundation[1], has
argued that the text and drafting history of the Apache License 2.0
indicate that it was intended to be used with (Apache-style)
CLAs. The use of the term 'contributor' in the Apache License is, I
think, a partial basis of this argument. (At a later stage Mark
actually recommended the compromise approach which the OpenStack
Foundation adopted, under which non-affiliated individuals
contributing to OpenStack would not be required to sign a CLA.)

I do not agree with Mark's interpretation of the Apache License (or,
the way I might put it is, any basis for the interpretation has been
nullified by years of entrenched industry practice around use of the
Apache License, as most Apache License code is directly released by
copyright holders under the Apache License rather than via a CLA-based
sublicensable license to a foundation[2]).

I also happen to believe that *if* a license actually requires the use
of a CLA to be operative, it is inconsistent with the Open Source
Definition. This would suggest that if Mark's interpretation of the
Apache License is correct, and if my interpretation of the OSD is
correct, the OSI would need to de-list the Apache License.

So my concern is that by using the 'contributor' language,
unnecessarily I believe, from the Apache License, you are setting up
the possibility that someone will argue down the road that this BSD +
Patent license must normally be used with a CLA, and in particular a
CLA that has certain features in common with those used by the Apache
Software Foundation. 

Richard

[1]Mark is also general counsel to the OSI.

[2]Also I believe this interpretation is largely inconsistent with the
Apache Software Foundation's own practice, whatever the original
drafters of the Apache License 2.0 may have been contemplating.