community.grafana and grafana.grafana merger CLA requirement

[gotmax23]

Summary

The maintainers of community.grafana and grafana.grafana would like to merge community.grafana into grafana.grafana. github.com/grafana requires contributors to sign the Grafana Labs CLA. They are also asking previous contributors to community.grafana to sign the CLA before the merger. In general, I'm against CLAs that requires contributors to reassign copyright to a central entity, but I'm especially against a community collection being replaced by a corporate one that requires contributors to sign a CLA.

As I said in the original discussion (ansible-collections/community.grafana#278):

I am very much unenthused about [the CLA requirement]. I don't think existing contributors should be asked to reassign their copyrights, and I don't think a community collection should be replaced with a corporate collection that requires signing copyrights to said corporation. This takes away the community ownership in multiple ways:

1. This collection will be moved out of the ansible-collections org.
2. Each contributor or their employer owns a part of the project through copyright. When one entity owns the copyrights for the entire project, they are free to re-license the project, make parts of it proprietary, or do other things that may not be in the best interest of the community.
3. Contributors who are unable to sign the CLA for whatever reason are locked out from contributing to the project.

I'm completely in favor of having less duplicate collections in the Ansible package, but I don't like the CLA aspect of this particular collection merger. I don't think this should happen unless the following conditions are met:

1. The CLA requirement must be dropped for current and future contributors. I'd prefer if the new combined collection was moved to the github.com/ansible-collections org where there's no CLA requirement and where the community has access if needed.
2. The existing community maintainers should be invited to co-maintain grafana.grafana if they wish.

@Andersson007 asked me to create a community-topic about this.

/cc @rrey @ishanjainn @webknjaz from the original discussion

[rrey]

Thanks for opening this discussion.
I have not been able to give time to the collection maintenance for several months now and having Grafana involved sounded a good opportunity to avoid its death.

I understand the CLA issue pointed in the discussion, and won't continue the merging effort until it is sorted out.

Last feedback from @ishanjainn on the matter was that we could merge the community content to the Grafana collection without requiring community contributors to sign the Grafana CLA.

I have some doubt about the relicencing issue stated here though, because both collections are GPL3, which is a requirement from Ansible to have the collection bundled in the pip packages anyway and Grafana have initiated (if not already completed when I'm writing this) the request to be included.

I would have no problem leaving Grafana people enter the maintainers group of the community collection (and most likely step back at some point) but the decision to maintain things under their roof or not is theirs.

Super interested in feedbacks and/or guidance on this subject since I don't want to disappoint the community.

[felixfontein]

I think not requiring a CLA for the merged collection would be better. I personally find CLAs very dissuasive for contributors, especially for drive-by contributions (like small fixes, docs improvements, features, ...).

because both collections are GPL3, which is a requirement from Ansible to have the collection bundled in the pip packages anyway

For modules (as opposed to plugins) GPLv3+ is not a requirement, only having a license that is compatible to GPLv3+. For plugins GPLv3+ is required since they are loaded directly by ansible-core (which is GPLv3+). But yeah, licensing everything under GPLv3+ is usually the best.

I disagree that GPLv3+ solves only some of the issues here though - while it makes sure that you can still take the latest GPLv3+ version released and distribute it, there's still the danger that the copyright owner (which thanks to the CLA would be Grafana Labs) starts changing the license of the collection to something else and continues only using that one in the future, which would effectively split the community into the ones who don't mind and the ones who want to fork. (I hope that won't happen, but it could, theoretically :) )

[ishanjainn]

Thanks for opening this discussion.
I just wanted to clarify that the CLA is based on the Apache foundation CLA and that the contributers would still retain all copyright ownership.

[russoz]

Here is a link to the CLA
https://cla-assistant.io/grafana/grafana-ansible-collection?pullRequest=28

IANAL, but

2. Grant of Copyright License
   Subject to the terms and conditions of this Agreement, You hereby grant to Grafana Labs and to recipients of software distributed by Grafana Labs a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Your Contributions and such derivative works.

item 2 seems utterly unnecessary if they go GPLv3 or similar

3. Grant of Patent License
   Subject to the terms and conditions of this Agreement, You hereby grant to Grafana Labs and to recipients of software distributed by Grafana Labs a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by You that are necessarily infringed by Your Contribution(s) alone or by combination of Your Contribution(s) with the Work to which such Contribution(s) were submitted. If any entity institutes patent litigation against You or any other entity (including a cross-claim or counterclaim in a lawsuit) alleging that your Contribution, or the Work to which you have contributed, constitutes direct or contributory patent infringement, then any patent licenses granted to that entity under this Agreement for that Contribution or Work shall terminate as of the date such litigation is filed.

that does not sound like retaining ownership to me.

It would be great to have some legal support here to clarify that. For the time being, I oppose the merge because of the CLA.

[RichiH]

Hi @russoz , @ishanjainn pulled me in to help explain.

NB: I am not a lawyer either.

The first quoted section grants a copyright license, the second quoted section grants a patent license; in both cases, the original authors retains IP ownership, the other rights are merely licensed.

Not trying to push anyone in any direction, just wanted to (try to) clear the question up.

[gotmax23]

Yes, but doesn't this CLA still give Grafana rights to relicense the software under a nonfree license if they so choose?

[felixfontein]

@gotmax23 from the way I read https://cla-assistant.io/grafana/grafana-ansible-collection?pullRequest=28, I think it doesn't grant them these rights. But then, I'm not a lawyer... @anweshadas @Andersson007 you are more familiar with legalese, what do you think?

[felixfontein]

@ishanjainn @RichiH what do you think about moving the collection to the github.com/ansible-collections/ organization and not requiring the CLA there? Is this something that would be acceptable to you? Or require a DCO (https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin) instead of the CLA? That would make it a less higher hurdle to contribute.

[gotmax23]

I opened #221 to consider adding a more general rule about Collection Requirements. @Andersson007 suggested this during today's meeting. We discussed this a bit and there seemed to be some interest amongst the meeting's attendees. I'm not sure what the consensus is about grafana.grafana and the merger in particular.

[ishanjainn]

@ishanjainn @RichiH what do you think about moving the collection to the github.com/ansible-collections/ organization and not requiring the CLA there? Is this something that would be acceptable to you? Or require a DCO (https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin) instead of the CLA? That would make it a less higher hurdle to contribute.

Unfortunately, removing the CLA or moving the collection to a different organization would not be possible as of now. I understand this would mean we cant go ahead with merging the two collection.

[samccann]

Seems like this means we have to start the deprecation process for community.grafana if it's slipping into the unmaintained status?

[mariolenz]

@gotmax23 Please close this issue if done, or open a new forum topic and then close the issue with a pointer to the new discussion: Community-topics: Archiving the repo

[Andersson007]

if relevant, please anyone open a discussion on the forum, thanks everyone!