10

We have the following BSD license in the LICENSE file:

Copyright (c) 2006-2016 SymPy Development Team All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: a. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. b. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. c. Neither the name of SymPy nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

We manage the source repository by git (https://github.com/sympy/sympy), and thus each author owns the patches that he or she created. We then have an AUTHORS file where we list all the people who contributed patches (currently about ~450 or so). Typically authors fork the repository on github and add patches as git commits.

One author forked the repository, but added his name into the LICENSE file itself as a copyright notice as follows (I changed the name):

Copyright (c) 2006-2015 SymPy Development Team, 2015-2016 John Doe All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: a. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. b. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. c. Neither the name of SymPy nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

The author developed a patch, that fixes a bug. The fix consists of touching just one file and removing 19 characters from one line, and adding 18 characters on another line in the same file. It also adds a 5 line test for this bug into a test file. That's it.

Under what conditions are we legally allowed to apply his patch (by cherry-picking his commits, e.g. preserving the date and author's name + email in the git meta data)?

a) Do we need to modify our LICENSE file to add his copyright notice?

b) Or are we still complying with the BSD license if we keep an up to date AUTHORS file and keep the git repository which specifically tracks which commits were contributed by which authors.

What I don't like about the option a) is that if all 450 or so contributors required this, then we would need to keep essentially the contents of the AUTHORS file in the LICENSE file, together with the Copyright word and the years. Git is much better at keeping the years (and even days and minutes) as well as which lines where modified by each author and how. Then we have a simple LICENSE file that doesn't change and we keep the list of authors in AUTHORS (and we have a script that keeps it synchronized with the list of authors from git).

Improve this question
7
  • 4
    I'm voting to close this question as off-topic because the question asks for legal advice that goes beyond what a programmer can be expected to know. You should ask a layer. Commented Jan 31, 2016 at 17:24
  • 2
    or a lawyer... ;) Commented Jan 31, 2016 at 17:24
  • 8
    Programmers aren't expected to know this but they may. It would be a better idea to remove comments that basically say "you should talk to a lawyer", which is an over used response. Programmers do have an understanding of software licensing, probably more than most every lawyer in the world. My vote is to keep this here. Commented Jan 31, 2016 at 17:43
  • 2
    My understanding is that when someone makes a pull request to SymPy they are implicitly licensing it under the SymPy license. Commented Jan 31, 2016 at 20:30
  • 2
    @asmeurer right. My question is if the author does not create a pull request. I.e. under what conditions can you cherry pick patches posted into a fork of your repository, licensed under the same license, but modified copyright notice. Commented Jan 31, 2016 at 22:37

2 Answers 2

Reset to default
3

You may incorporate any code that has a compatible license to it.

That said, unless the new code is specifically licensed under a compatible license if you are to pull the changes into your codebase, you are opening yourself up to the possibility of some difficulties.

In particular, unless the code specifically states that the new contributions are under a compatible license, the default "all rights reserved" license is applicable to it. Pulling the code would be a copyright infringement.

There is also the possibility that the new code is licensed under a license that is compatible with you (and you would need to maintain that license for the code), but incompatible with many of your users. For example, if you are using BSD 2 clause, and someone licenses the contributions of a fork under BSD 3 clause, you could probably pull that into your code without too much difficulty. However, as BSD 3 clause isn't compatible with the GPL, that would make your project GPL incompatible.

If you should decide change from BSD to GPL at a later time (for example), and the pull requests assign the necessary rights to change the license as part of the contributor license agreement, you pulling code from other projects that haven't agreed to the CLA could cause you some headaches.

Thats the general case...

For the specific case where the the license file changed... I don't know. From the simple reading of the license file:

Copyright (c) 2006-2015 SymPy Development Team, 2015-2016 John Doe All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 

a. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

That bit seems to indicate that if you want to pull those changes in, you will also need to change your license file.

Unfortunately, you don't have a well defined CLA at this time. Fortunately, at this time you only have 450 people to ask.

Improve this answer
9
  • So from reading point "a." it seems that "the above copyright notice" for the original SymPy code is retained by John Doe and that John Doe is licensing the new contributions to the fork under the same license but that the new additions are copyrighted to John Doe. Commented Feb 1, 2016 at 2:35
  • 2
    @moorepants for this instance, that would appear to be the case. And thus, if SymPy wants to license those back into its code, it would also need to follow that statement in the licensing and retain the copyright notice by John Doe. Commented Feb 1, 2016 at 3:59
  • Thanks @MichaelT for the answer. What do I need to ask the 450 people for? It seems that all I need to do is copy the license from the fork (including the John Doe copyright statement), and just append it into NOTICES file, where we would store all 3rd party licenses. Commented Feb 1, 2016 at 16:20
  • 1
    @OndřejČertík if you ever want to change the license on SymPy (this is working on the assumption that everyone who has submitted a pull request is ok with licensing it under the BSD) to say... GPL, you need the permission of everyone who has contributed as only they can decide to relicense it under another license. Apache has a rather involved CLA. Many big projects have a CLA of some sort or another to make sure the project is within its rights to distribute the submitted code Commented Feb 1, 2016 at 16:24
  • 1
    I'd suggest looking at the first bullet point of discourse CLA: You grant to "The Company" (Civilized Discourse Construction Kit, Inc.) a non-exclusive, irrevocable, worldwide, royalty-free, sublicenseable, relicenseable, transferable license under all of Your relevant intellectual property rights, to use, copy, prepare derivative works of, distribute and publicly perform and display "The Contributions" on any licensing terms, including without limitation: (a) open source licenses like the GNU General Public (v2.0) license; ... Commented Feb 1, 2016 at 16:27
2

If there is BSD licensed source code and someone forks it adding additional patches, then this new source code in the new repo should include the exact BSD license file from the original repo and the new patches should be licensed under a new license (or the even the same license). Thus, the fork should have one or two licenses in the repository. It isn't acceptable to edit the original license, as that violates the BSD license terms.

Now if the original repo wants to cherry pick patches from the fork, then a copy of the fork's new license must be added to the original repo. Ultimately both repositories will have each license, one covering the each set of patches.

SymPy should also be requiring that contributors give up their copyright to the SymPy project. It is potentially very problematic to let contributors retain their copyright to individual patches on submission. A contributor agreement spelling this out is needed to be clear what is happening.

Improve this answer
2
  • Of course, if there is no additional license on the fork, then the contributions are, well, not licensed under anything other than the default all rights reserved license. Commented Feb 1, 2016 at 1:30
  • 1
    I don't believe that is necessarily true. If no license is specified on the new patches in the fork, then there is potential ambiguity. By default in US law, the creator of the content owns the copyright if nothing is stated. So if no additional license is listed, it is possible that the creator of the patches in the fork owns the copyright to the new patches. But it is ambiguous because the creator had to leave the original license in the fork, so that may apply to all of their patches. Per file license statements help clear up that ambiguity some, but you rarely see a "per patch" statement. Commented Feb 1, 2016 at 2:06

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.