Project legal ownership

[glennawatson]

There seems to be a lot of confusion about legal ownership.

Back in the original days of the foundation, there were two models a project could use to assign.

In the original agreement, there was wording such as

Projects may join the .NET Foundation in one of two ways and you should chat with your .NET Foundation contact to discuss the best mechanism for your project. You can either assign the copyright of the project's source code to the .NET Foundation or contribute the project source code to the .NET Foundation under an open-source

Assignment is the preferred approach, but licensing a project to the Foundation may be more appropriate for longer running open source projects that have not previously had a contribution license agreement and have accepted contributions from many different sources.

Many viewed the contribution license as the project still retained rights to the source code, packages and have the ability to withdraw if they needed to.

[glennawatson]

I know Claire in her apology statement said there would be more clarification incoming about this one as well.

[Pilchard123]

As I understand it, part of the reason for giving the foundation a measure of control over member projects is to ensure continuity if the project maintainers are no longer maintaining the project (whether that is by choice or by necessity).

Rather than giving @dnfadmin owner access to each member project, could a project nominate a successor or successors, to be given owner access only in the event of some criteria being met? Perhaps if a project has had no maintainer activity (what "maintainer activity" means could be decided while choosing a successor) for some period, then the project will be handed over to the nominated successor(s). Perhaps there could also be an option to pre-emptively hand over the project, if the maintainers know that they will soon be unable to continue. Until such time as the succession process is triggered, the project should stay owned by the original maintainers.

I think it would also be important for a projects original maintainer to be able to reclaim the project at a later date. Imagine some project has a single maintainer who is unable to support the project for a period of time - perhaps they are ill and will need long-term treatment; perhaps they have other responsibilities that must take priority for a while; perhaps they've even been arrested and will be incarcerated for an extended period - once they return, they should be able to take up the reins of the project with exactly the same authority as they had before.

I realise this would perhaps require some changes to GitHub rather than to the foundation itself (it may even be possible already, or it may only be possible in the event of an individual user's death, I'm not sure), and the foundation is not GitHub so probably cannot push such a change through. I'm sure someone has the ear of the GitHub team within Microsoft or knows someone who does, though - it could be a good marketing point for such a project succession function to be available to every project, member of the foundation or not.

If such an arrangement is in place, it could be a requirement of membership that the foundation is a project successor - the membership eligibility criteria already says it is preferable (though not mandatory) that the project source is available on GitHub.

[Pilchard123]

I've thought a bit more on this last paragraph and about requiring the foundation to be the successor. I think it would be better phrased as "requiring the foundation to be a successor". I'll edit above, and add details below.

If the succession system would allow multiple successors, each one could be given a priority. When a project is considered to need succession triggered, each of the possible successors are asked to say whether they can take up the project (give them a reasonably-long period to decide and to reply, in case they are not immediately available when the triggering condition is met). The highest-priority successor that replies positively is the one that is given the project.

An example:

1. Alice and nominates possible successors Bob, Carol and David, prioritised alphabetically.
2. Alice is goes dark for six months and the succession process is triggered. All possible successors are contacted.
   1. Bob does not reply.
   2. Carol replies and says she can take over.
   3. David replies and says he can take over.
3. The project is given to Carol, the highest-priority successor who answered positively.

In a similar way, a member project of the foundation could be required to have the foundation somewhere in that list, even if it's the lowest-priority successor. That way if a project is owned by A and also frequently worked on by B, who is trusted in the project's community, then B could be offered the project so there is still a closer link to the original maintainers before falling back to the foundation which may have no strong link to the project's community.

[Pilchard123]

@jmiddour had a similar idea in another thread.

[nathan-alden-sr]

It's a mistake to assume that the backdoor administrator access is in place solely due to succession contingencies. The reasoning likely includes the possibility of a maintainer "going rogue" in some way, selling maintainer access to their repository, or similar, leading to potential supply chain attacks for code and NuGet packages that are in some way officially tied to Microsoft.

The directors need to create an official document that describes the reasoning behind the administrator access that is comprehensive and honest. Then people won't be left to speculate about it.

[gortok]

There are a few major categories of questions that we need the foundation's answers to:

1. Who owns the name of the project in each model (contribution and assignment)? Who is allowed to use that name? Is the use of the project name revocable if the project leaves the foundation?
2. Who owns the copyright of the source code in the assignment model? In the contribution model? If .NET Foundation does not own the source code in the contribution model, then why should we put (C) 2021 .NET Foundation and contributors as the copyright in the source code and project files? Doesn't that plainly give .NET Foundation the copyright since that's the only named party?
3. since the strong name signing is tied to the project's name, what happens if the project leaves the foundation? Can they no longer use that name?
4. What is the effect of putting (C) 2021 .NET foundation and contributors in the header file for the contribution model?? Since that's the only part that travels with the code; then how would anyone know who the copyright owner is and understand that it actually isn't the .NET Foundation?

[BillWagner]

I've been reading the signed agreements, and collecting questions.

First, some of the basics are covered in the onboarding doc on the website. (See the section on "Signing the CLA". It answers many of the questions in this and other discussions regarding ownership.

My comments below use the text of the current master agreement, not the signed agreement for any given project. The agreement that was signed for each project applies to that project. Also, many of the signed agreements included addendums that list items specifically included or specifically excluded. (Mostly this applies to trademarks, as noted in the master agreement below). That may be the source of some confusion.

That said, here's what the master agreement states:

The agreement only affects assets listed in the agreement.

First, let's address one principle concern. Both agreements include this text:

Other Rights Reserved. Each party reserves all rights not expressly granted in this Agreement. No additional licenses or rights whatsoever (including, without limitation, any implied licenses) are granted by implication, exhaustion, estoppel or otherwise.

My interpretation: twitter handles, websites, etc. don't transfer. Neither agreement mentions them.

Copyright license and assignment

• There are and have always been two versions of the master agreement (Contribution and Assignment). The assignment version does transfer ownership of the copyright of the code to the foundation, and grants a license to the copyright back to the contributor. The contribution version grants a license to the foundation.

The assignment agreement states:

a. Copyright Assignment and License.

• i. To the extent Contributor owns the copyright interests in the Submission, Contributor hereby assigns, agrees to assign, transfers, sets over, and delivers unto .NET Foundation all of Contributor’s rights, title, and interest throughout the world in and to the Submission, and

• ii. To the extent Contributor has a license to the copyright interests in the Submission from contributors to the Project or other third parties, Contributor hereby grants to .NET Foundation, and those who receive the Submission directly or indirectly from .NET Foundation, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license in the Submission to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the Submission and such derivative works, and to sublicense any or all of the foregoing rights to third parties.

Contributor shall execute and deliver to .NET Foundation any additional instruments and documents to transfer Contributor’s full and complete right, title, and interest in and to an assigned Project’s copyrighted material to .NET Foundation. In the event that Contributor retains any interest in any copyrightable assets that are required for the assigned Project, Contributor covenants and agrees to assign its rights in such assets to .NET Foundation (and use commercially reasonable efforts to obtain any required consent of other relevant parties including from contributors to the Project) upon request to the extent such rights relate to the assigned Project.

The assignment version also includes this clause that covers copyright grantback (clauses b and c relate to trademark and patent, and are covered below).

d. Copyright License Grantback. Contributor’s assignments and licenses under Sections 4(a)-(c) are conditioned upon and subject to a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license to Contributor from the .NET Foundation to all Submissions to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the Submission and such derivative works, and to sublicense any or all of the foregoing rights to third parties (the “Grantback”). The Grantback shall permit the Contributor to do and authorize all acts described in Section 106 of Title 17 of the United States Code.

The contribution version follows:

a. Copyright License. Contributor hereby grants .NET Foundation, and those who receive the Code directly or indirectly from .NET Foundation, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license in the Submission to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the Submission and such derivatives works, and to sublicense any or all of the foregoing rights to third parties.

My interpretation: It depends which version a project signed. In both versions, the project maintainers and the foundation can both use the copyrighted material.

Patent licenses

Both versions grants patent license rights to the foundation. The pertinent language is the same in both agreements:

Patent License. Contributor grants .NET Foundation, and those who receive the Submission directly or indirectly from .NET Foundation, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license under Contributor’s patent claims that are necessarily infringed by the Submission or the combination of the Submission with the Project being Submitted to make, have made, use, offer to sell, sell and import or otherwise dispose of the Submission alone or with the Project.

My interpretation: No patent ownership was transferred to the foundation. The foundation, and anyone else using the project can use the project even if it includes submitter's patented work.

Trademark rights

The contribution and assignment versions have different language with respect the trademarks. The assignment version states:

Trademark Rights. Nothing in this Agreement or its performance shall grant .NET Foundation any right, title, interest, or license in or to Contributor’s names, logos, logotypes, trade dress, designs, or other trademarks (collectively, the “Contributor Marks”). Notwithstanding the foregoing, Contributor may elect, from time to time and in its sole discretion, to grant .NET Foundation a license to use certain Contributor Marks owned by Contributor for an assigned Project. Any such Contributor Mark(s) will be specified in the applicable Project Assignment, together with any style specifications and other guidelines for use of such Contributor Mark(s), and .NET Foundation’s right to use any such Contributor Mark(s) will be subject to the terms of the Trademark Usage Addendum. If no Contributor Mark is identified in the Project Assignment, then Contributor reserves all rights to any trademarks owned by Contributor and does not grant .NET Foundation any rights to use such trademarks for the assigned Project.

The version in the contribution agreement states the following:

Trademark Rights. Contributor grants .NET Foundation rights to use certain Project trademarks owned by Contributor. The specific grant of rights in those trademarks (if any) is specified by the election to disclaim or license those trademark rights as denoted in the signature block below. By electing to disclaim such rights the Contributor is agreeing to the terms of the “Contributor Marks Disclaimer” in the Trademarks Use Addendum. By electing to license such rights the Contributor is agreeing to the terms of the “Contributor Marks License” in the Trademarks Use Addendum.

My interpretation: The foundation can use a submitter's trademarks with permission. The scope of that permission should be in the specific addendum for that project.

[glennawatson]

Maybe the main template should be but the signed contracts I wouldn't want mine public per say.

[gortok]

@glennawatson What's the difference between the two?

[rprouse]

I agree that the contract templates should be public, but like @glennawatson, I do not want the signed agreement between NUnit and the foundation public (if just to protect our signatures from copying). If people are curious, NUnit is under a contribution agreement. I think that discussion is available in our project's governance repo if I remember correctly?

[jnm2]

I believe this is the NUnit discussion: nunit/governance#27
In which Jon Galloway links the (at the time) current contract templates: https://github.com/dotnet-foundation/foundation/tree/master/guidance

[JimBobSquarePants]

Maybe…. Maybe they shouldn’t be stuffed to the brim with unparsable legalese which requires reinterpretation years later?

Use plain, understandable language for documentation! We are not lawyers!!!