9

We have the following BSD license in the LICENSE file:

Copyright (c) 2006-2016 SymPy Development Team

All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

  a. Redistributions of source code must retain the above copyright notice,
     this list of conditions and the following disclaimer.
  b. Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
  c. Neither the name of SymPy nor the names of its contributors
     may be used to endorse or promote products derived from this software
     without specific prior written permission.


THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
DAMAGE.

We manage the source repository by git (https://github.com/sympy/sympy), and thus each author owns the patches that he or she created. We then have an AUTHORS file where we list all the people who contributed patches (currently about ~450 or so). Typically authors fork the repository on github and add patches as git commits.

One author forked the repository, but added his name into the LICENSE file itself as a copyright notice as follows (I changed the name):

Copyright (c) 2006-2015 SymPy Development Team,
              2015-2016 John Doe

All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

  a. Redistributions of source code must retain the above copyright notice,
     this list of conditions and the following disclaimer.
  b. Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
  c. Neither the name of SymPy nor the names of its contributors
     may be used to endorse or promote products derived from this software
     without specific prior written permission.


THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
DAMAGE.

The author developed a patch, that fixes a bug. The fix consists of touching just one file and removing 19 characters from one line, and adding 18 characters on another line in the same file. It also adds a 5 line test for this bug into a test file. That's it.

Under what conditions are we legally allowed to apply his patch (by cherry-picking his commits, e.g. preserving the date and author's name + email in the git meta data)?

a) Do we need to modify our LICENSE file to add his copyright notice?

b) Or are we still complying with the BSD license if we keep an up to date AUTHORS file and keep the git repository which specifically tracks which commits were contributed by which authors.

What I don't like about the option a) is that if all 450 or so contributors required this, then we would need to keep essentially the contents of the AUTHORS file in the LICENSE file, together with the Copyright word and the years. Git is much better at keeping the years (and even days and minutes) as well as which lines where modified by each author and how. Then we have a simple LICENSE file that doesn't change and we keep the list of authors in AUTHORS (and we have a script that keeps it synchronized with the list of authors from git).

  • 4
    I'm voting to close this question as off-topic because the question asks for legal advice that goes beyond what a programmer can be expected to know. You should ask a layer. – Bart van Ingen Schenau Jan 31 '16 at 17:24
  • 1
    or a lawyer... ;) – Erik Eidt Jan 31 '16 at 17:24
  • 6
    Programmers aren't expected to know this but they may. It would be a better idea to remove comments that basically say "you should talk to a lawyer", which is an over used response. Programmers do have an understanding of software licensing, probably more than most every lawyer in the world. My vote is to keep this here. – moorepants Jan 31 '16 at 17:43
  • 2
    My understanding is that when someone makes a pull request to SymPy they are implicitly licensing it under the SymPy license. – asmeurer Jan 31 '16 at 20:30
  • 2
    @asmeurer right. My question is if the author does not create a pull request. I.e. under what conditions can you cherry pick patches posted into a fork of your repository, licensed under the same license, but modified copyright notice. – Ondřej Čertík Jan 31 '16 at 22:37
3

You may incorporate any code that has a compatible license to it.

That said, unless the new code is specifically licensed under a compatible license if you are to pull the changes into your codebase, you are opening yourself up to the possibility of some difficulties.

In particular, unless the code specifically states that the new contributions are under a compatible license, the default "all rights reserved" license is applicable to it. Pulling the code would be a copyright infringement.

There is also the possibility that the new code is licensed under a license that is compatible with you (and you would need to maintain that license for the code), but incompatible with many of your users. For example, if you are using BSD 2 clause, and someone licenses the contributions of a fork under BSD 3 clause, you could probably pull that into your code without too much difficulty. However, as BSD 3 clause isn't compatible with the GPL, that would make your project GPL incompatible.

If you should decide change from BSD to GPL at a later time (for example), and the pull requests assign the necessary rights to change the license as part of the contributor license agreement, you pulling code from other projects that haven't agreed to the CLA could cause you some headaches.

Thats the general case...

For the specific case where the the license file changed... I don't know. From the simple reading of the license file:

Copyright (c) 2006-2015 SymPy Development Team,  
              2015-2016 John Doe

All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

a. Redistributions of source code must retain the above copyright notice,
   this list of conditions and the following disclaimer.

That bit seems to indicate that if you want to pull those changes in, you will also need to change your license file.

Unfortunately, you don't have a well defined CLA at this time. Fortunately, at this time you only have 450 people to ask.

  • So from reading point "a." it seems that "the above copyright notice" for the original SymPy code is retained by John Doe and that John Doe is licensing the new contributions to the fork under the same license but that the new additions are copyrighted to John Doe. – moorepants Feb 1 '16 at 2:35
  • 2
    @moorepants for this instance, that would appear to be the case. And thus, if SymPy wants to license those back into its code, it would also need to follow that statement in the licensing and retain the copyright notice by John Doe. – user40980 Feb 1 '16 at 3:59
  • Thanks @MichaelT for the answer. What do I need to ask the 450 people for? It seems that all I need to do is copy the license from the fork (including the John Doe copyright statement), and just append it into NOTICES file, where we would store all 3rd party licenses. – Ondřej Čertík Feb 1 '16 at 16:20
  • 1
    @OndřejČertík if you ever want to change the license on SymPy (this is working on the assumption that everyone who has submitted a pull request is ok with licensing it under the BSD) to say... GPL, you need the permission of everyone who has contributed as only they can decide to relicense it under another license. Apache has a rather involved CLA. Many big projects have a CLA of some sort or another to make sure the project is within its rights to distribute the submitted code – user40980 Feb 1 '16 at 16:24
  • 1
    I'd suggest looking at the first bullet point of discourse CLA: You grant to "The Company" (Civilized Discourse Construction Kit, Inc.) a non-exclusive, irrevocable, worldwide, royalty-free, sublicenseable, relicenseable, transferable license under all of Your relevant intellectual property rights, to use, copy, prepare derivative works of, distribute and publicly perform and display "The Contributions" on any licensing terms, including without limitation: (a) open source licenses like the GNU General Public (v2.0) license; ... – user40980 Feb 1 '16 at 16:27
2

If there is BSD licensed source code and someone forks it adding additional patches, then this new source code in the new repo should include the exact BSD license file from the original repo and the new patches should be licensed under a new license (or the even the same license). Thus, the fork should have one or two licenses in the repository. It isn't acceptable to edit the original license, as that violates the BSD license terms.

Now if the original repo wants to cherry pick patches from the fork, then a copy of the fork's new license must be added to the original repo. Ultimately both repositories will have each license, one covering the each set of patches.

SymPy should also be requiring that contributors give up their copyright to the SymPy project. It is potentially very problematic to let contributors retain their copyright to individual patches on submission. A contributor agreement spelling this out is needed to be clear what is happening.

  • Of course, if there is no additional license on the fork, then the contributions are, well, not licensed under anything other than the default all rights reserved license. – user40980 Feb 1 '16 at 1:30
  • 1
    I don't believe that is necessarily true. If no license is specified on the new patches in the fork, then there is potential ambiguity. By default in US law, the creator of the content owns the copyright if nothing is stated. So if no additional license is listed, it is possible that the creator of the patches in the fork owns the copyright to the new patches. But it is ambiguous because the creator had to leave the original license in the fork, so that may apply to all of their patches. Per file license statements help clear up that ambiguity some, but you rarely see a "per patch" statement. – moorepants Feb 1 '16 at 2:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.