Re: Overview of copyright issues

[Joseph Wakeling]

Graham Percival wrote:
> Mao, I missed the flamewar.  I'm very disappointed that this
> happened without me.  :(

:-)

> The manuals include the FDL, so I'd argue that it's clear that the
> sources are under the same license.  I'd argue the same about the
> source files, actually.

This is basically about good (unambiguous) practice as far as I'm
concerned (see e.g. GNU project guidelines).

> Yes.  Including people for whom we lost contact 10 years ago, and
> including the heir(s) of Rune Zedeler, who passed away last year.
> 
> Are you offering to track down those people?  And write to his
> family to find out who owns his software (I'm sure they won't
> know), and ask for their permission?  How good's your German, by
> the way?  I have no clue if his family speaks English well enough
> to understand the nuances of GPLv2 vs. GPLv3.  Or at least the
> notation of changing a software license, where both licenses
> essentially say the same thing[1].
> 
> [1]  yes, you and I know the differences, but normal people have a
> hard enough concept with "I'll share this software with you if you
> share it with others".

Yes, I'm prepared at some point to attempt this task.  That's not a
cop-out; it's just that I want to see how much we can do _without_ that
tracking-down before I go down that particular difficult route.  More on
that to follow.

> Really?  Line 22 says "Version 2, June 1991" to me.  How exactly
> do you propose to change the COPYING file?

I propose to add text closer to the statement recommended by the FSF/GNU
foundation and by the GPL itself:

    GNU Lilypond is free software; you can redistribute it and/or modify
    it under the terms of version 2 of the GNU General Public License as
    published by the Free Software Foundation.

... plus some further explanatory text that will probably be close to
what the existing file says.  Perhaps also a line emphasising the
licensing situation (i.e. v2 only) as the Linux kernel COPYING file
does, and a note explaining how we are attempting to change the
licensing situation.

>>           (v) the link on the main page which (still) points to the
>>               text of GPLv3 on gnu.org (and has ever since v3 was
>>               released -- the first message pointing out this
>>               discrepancy was sent to the -devel mailing list over
>>               2 years ago!).
> 
> This is fixed on the new website.

But not on the current one, which is still live ... :-)

>> In addressing this there are several policies that can be put in place NOW:
>>
>>    (1) All new files added to the code or docs must contain an
>>        unambiguous copyright AND licensing notice: I suggest in this
>>        case GPLv2 or later for code, and the GFDL 1.1 or later for docs.
> 
> I really don't see why we MUST do this.  Is there any legal
> requirement that every single file contain the license?  I'm not
> aware of any.  Material is copyright by default.

Sure; this is just a useful policy to have (and maintain) because it
clarifies the licensing situation on a file-by-file basis.

>>    (2) Contributors of new material to existing files should add
>>        copyright/licensing notices *for their contributions*, again with
>>        appropriate 'or later' bits.
> 
> That's going to get ridiculous.  We should add a name for each
> one-line bugfix?

No.  My statement was not clear enough.  There are guidelines on this in
the 'Information for Maintainers of GNU Software':
http://www.gnu.org/prep/maintain/html_node/Legally-Significant.html#Legally-Significant

    A change of just a few lines (less than 15 or so) is not legally
    significant for copyright. A regular series of repeated changes,
    such as renaming a symbol, is not legally significant even if the
    symbol has to be renamed in many places. Keep in mind, however, that
    a series of minor changes by the same person can add up to a
    significant contribution. What counts is the total contribution of
    the person; it is irrelevant which parts of it were contributed
    when.


>>    (1) How well have the copyright notices for individual files been
>>        maintained?
> 
> Not.
> 
>>  Do they refer only to original authors of files
>>        or all authors over that file's history?  (More precisely: is
>>        there not just a list of who contributed to LP but also who
>>        wrote exactly what?)
> 
> Original authors of files.  Look at the git log for more details.

Yup, as I discovered after a few sessions with git annotate. :-)

>>    (2) Is there a preference for transferring copyright to some third
>>        party (either the FSF or some LP-dedicated organisation)?  If
>>        not, it seems a good idea for future contributions to LP to be
>>        'or later', as it avoids a repeat of this issue in the future.
> 
> This has been discussed privately, and might occur if the
> copyright-fixing issue is undertaken seriously.

Personally I'm not in favour of copyright-transfer agreements, I think
they get in the way of contribution -- it's more important to have the
'or later' GPL option that allows for upgrades if desired.  But I will
help achieve this if it's something the Lilypond community wants.

> Yes, I disagree.  You've done a lot of demanding.  Tracking down
> everybody, especially getting informed consent from the families
> of deceased contributor(s), will be a huge amount of work.

The whole reason I maintained the discussion was because I thought it
was a situation worth fixing and was willing to put time towards fixing
it.  But I wanted to get consensus on what the problem (and desired
solution) was before moving further.

> I repeat what I said to somebody (maybe you) on -user a day or two
> ago: are you prepared to do something like 50 hours of work on
> this?  Or are you just blowing smoke?  If you're willing to spend
> the time to organize everything, then I'll do my part.

Yes, willing to put time and energy towards it.  Lilypond is a project
that is dear to me and that I've had a lot of benefit from, and
contributing on a code level is difficult for me, so working on
something like this (even if it takes a long time) is a nice way to
contribute to the community.

I was grateful for your comments of a few days ago, because they helped
me understand exactly what the situation was and what had been done in
the past.  Now I'm hoping to be able to push that process forward.

> This will be a long, hard, painful process.  First you need to
> figure out how contributed stuff.  After doing the obvious stuff
> from git and old CVS changelogs, you'll probably start asking
> various people for email addresses.  I'm willing to look for
> those, but I'm not going to treat it as a priority -- I have at
> least 50 lilypond-related emails to process that are more
> important (to me), and another 100 or so lower down on my list.  I
> know that you'll be excited, or at least determed, to do this
> task, but I'm not going to rush to keep up; it might take me a
> week to get around to it.  This will, of course, be somewhat
> demoralizing.

Sure.  My first aim is to go along with git annotate and the git logs
and try to work out who should be credited as an author of which file.

At the same time, I'm going to be maintaining a list of contributors who
have given at least email confirmation, to me, on this mailing list,
that they are OK with their contributions being GPLv2 or later (not just
GPLv2 only) and that for the docs they are OK with dual-licensing
GPLv1.1 or later and GPLv2 or later.  I will also be maintaining a list
of identified contributors who have NOT.

Along with that I'll be maintaining a branch of Lilypond to which I'll
be adding appropriate author credits and copyright/licensing notices.
This will NOT be for merging into the mainline or for distribution, but
I will keep the list updated on the proposed patches so that people can
comment and correct them if they are wrong.

> Now, many people have changed email addresses.  To pick a random
> name, can you find Erik Sandberg's current email?  He did a lot of
> work on lilypond in the past while he was a student, but I would
> guess that his student email address is no longer valid.  It might
> take a bit of work to dig it up.  You might have to do this for
> 10-20 contributors.
> 
> If I sound like I'm discouraging you from the project... well, yes
> and no.  I think it would be *great* if we could clear this up.
> But it will be a huge, demoralizing task.  I'd be amazed if it was
> finished this year.  And what do we get at the end of it?  A few
> legal geeks and wannabe lawyers (myself included) will have a nice
> fuzzy feeling.  Honestly, no previous contributor is going to sue
> us.  In some ways, this is just inventing a problem.

Well, yes and no.  I mean, the principal problem I see right now is not
so much that the license needs changing (GPLv2 is fine for Lilypond) but
that there is a lack of clarity in the source code about who wrote what
and its licensing conditions, on a file-by-file basis.

Fixing that is possible -- if arduous, or, well, frankly, boring -- and
can be done without any of the paperwork or tracking-down of people you
describe.  Once that's done you at least have a better idea of who you
have to get in touch with.

> And the most frustrating thing about this project is that it's an
> all-or-nothing affair.  If somebody refuses to agree to GPL2+ or
> GPL3+ or assigning copyright to a LilyPond Foundation, the whole
> thing is screwed.  If you can't find somebody, the whole thing is
> screwed.  If you get frustrated after spending 10 hours trying to
> find Chris Jackson's current email address (random contributor
> from 2002) and give up, the whole thing is screwed.  If you think
> there's any chance that you'd want to give up after starting the
> project, then it would be better for me to de-motivate you before
> you start.

I will be happy if I can get to the point where Lilypond's code is
well-documented with appropriate copyright and licensing notices -- and
where Lilypond has some contribution policies/practices that help
maintain these.  Getting to the point where we can upgrade the license
(if desired) would be a bonus.

> Well, "screwed" other than three possibilities, with various
> degrees of seriousness.
> 
> 1)  We pretend to be an American company.  (see Flight Club: "if
> there's a flaw in my company's products, then we measure the
> expected settlements from being sued, vs. the cost to fix the
> flaw.  If the legal costs would be lower, then we leave the flaw"
> (paraphrased))
> In other words, we just switch the license without consent from
> everybody, and hope that nobody sues us.  Hey, US companies
> (including Microsoft!) include GPL software in closed-source
> applications all the time; they only care if they get caught!
> 
> Of course, this email (in a public, archived format) would be
> pretty good evidence of "bad faith" in this regard.  Hopefully
> you'd sufficiently document your efforts to reach those people
> such that the courts might consider it "good faith" to counter-act
> the bad faith I just bought us, if we actually use this option.

Yes, my efforts will be well-documented and I hope should add up to a
'good faith' effort to track down all contributors.

> 2)  We pretend to be wikipedia.  Hey, they changed from FDL to
> Creative Commons after a vote.  If they can get away with
> something as blatantly illegal as that (I mean, there's almost
> 10,500,000 registered users, so I would guess that a least 10
> million account-holders didn't give permission for Creative
> Commons.  Ok, that probably only means 1 million people... but
> still, surely we can get away with ignoring the rights of 5 or 10
> people?  ;)
> 
> Of course, I'm not aware of any legal term for "but mommy, HE did
> it first!".  And come to think of it, this didn't really help me
> when I was a kid, either.

Wikipedia had some clever help from the FSF.  Their license was GFDL 1.2
or later, so the FSF released 1.3 which included a relicensing option
during a limited time window.

> 3)  If we can't find some people, or if they don't agree to
> whatever relicense/assignment, then we eliminate their patches and
> rewrite that material.
> 
> This could involve a non-trivial amount of extra work, but at
> least it's legally sound.  This also gives you an order to ask
> people -- identify the most active / biggest contributors, and get
> them on board first.  If 95% of the code+docs is covered, then
> it's more feasible to undertake the project.  I mean, if worst
> comes to worst, we can just rewriting the stuff from the missing
> people.

Yup, that's really my principal aim in all this -- to try and get
responsibility for the code well-documented so that we could in
principle do this.  Of course, it's nicer if I can get in touch with the
missing people as well.

I'll write another email tomorrow with a detailed action plan.  The
basic intention is that, if I succeed, Lilypond gains something; if I
fail, then nobody's time will have been wasted but mine, beyond the time
spent in discussion these last couple of days. :-)

Best wishes,

    -- Joe