[MISSION] on Forgejo accepting copyleft contributions #20

earl-warren commented 2023年04月18日 09:54:10 +02:00

This agreement proposal follows the discussion on licensing Forgejo under copyleft. It is a first step and does not include the choice of the license which is left for later.

It is an agreement on principle that copyleft contributions are welcome going forward.

The rationale for such an agreement has been developed in a a draft blog post and is copied here for the record.

---

Developers who choose to publish their work under a copyleft license are excluded from participating in software that is published under a permissive license. That is at the opposite of the core values of the Forgejo project.

Forgejo users already welcome copyleft

Forgejo is a software forge, an online development environment, based on Git. Both Forgejo and Git must be installed together, either as individual binaries or bundled into the official container images. The license of Git is GNU GPLv2 which is a copyleft license. Although the Forgejo codebase includes basic support for gogit, a Go package distributed under a permissive license that can be used in place of Git, it is not supported or packaged because it is not fully compatible and could corrupt git repositories.

There are legal obligations attached to copyleft software which are, in a nutshell, to offer the source code with the binary under the same license. For instance, if an employee was to distribute a Git binary to someone else, the organization can be required to also provide the "complete and corresponding source code". And if they fail to do so, they may loose all their rights under the license, at least until the copyright holders agree to grant them back. For this reason some organizations exclude copyelfted software entirely. However, when they use Git, it means the legal counsel has no objection to copylefted software.

What will change in Forgejo?

The license of Forgejo will change to be copyelft when a copylefted work is merged. The most likely candidate is the adapter for the F3 file format which is a rather isolated package within the codebase.

Before it happens a decision will be made by the community to choose a copyleft license, in accordance to the Forgejo decision making process. The chosen license will apply to Forgejo as a whole (binary and sources) but each file within the codebase will retain its own license. This is nothing new as Forgejo already includes various licenses and contributors are expected to agree to the Developer Certificate of Origin.

Developers who feel strongly about exclusively publishing their work under a permissive license can keep doing so when working on Forgejo in the Git repository. By the terms of this permissive license, they accept that their work can be sublicensed and redistributed under a proprietary license. And they also accept that it can be sublicensed and redistributed as part of Forgejo, under a copyleft license.

The choice of a copyleft license is a delicate balance and it is expected that different opinions will be voiced within the Forgejo community. There already were debates comparing the merits of the AGPL which was designed for online services and the GPL which was designed before the internet age. The least controversial choice would be to choose the same license as Git since there already is a de facto consensus because all developers and users agree on it.

This agreement proposal follows the [discussion](https://codeberg.org/forgejo/discussions/issues/6#issuecomment-858607) on licensing Forgejo under copyleft. It is a first step and does not include the choice of the license which is left for later. It is **an agreement on principle that copyleft contributions are welcome going forward**. The rationale for such an agreement has been developed in a [a draft blog post](https://codeberg.org/forgejo/website/pulls/204/files) and is copied here for the record. --- Developers who choose to publish their work under a copyleft license are excluded from participating in software that is published under a permissive license. That is at the opposite of the [core values](https://codeberg.org/forgejo/governance/src/branch/main/MISSION.md#values) of the Forgejo project. ## Forgejo users already welcome copyleft Forgejo is a [software forge](<https://en.wikipedia.org/wiki/Forge_(software)>), an online development environment, based on [Git](https://en.wikipedia.org/wiki/Git). **Both Forgejo and Git must be installed together**, either as individual binaries or bundled into the [official container images](https://codeberg.org/forgejo/-/packages/container/forgejo/1.19-rootless). The license of Git is [GNU GPLv2](https://git-scm.com/about/free-and-open-source) which is a [copyleft license](https://www.gnu.org/licenses/copyleft.html). Although the Forgejo codebase includes basic support for [gogit](https://github.com/go-git/go-git), a Go package distributed under a permissive license that can be used in place of Git, it is not supported or packaged because it is [not fully compatible](https://github.com/go-git/go-git/blob/master/COMPATIBILITY.md) and could corrupt git repositories. There are legal obligations attached to copyleft software which are, in a nutshell, to offer the source code with the binary under the same license. For instance, if an employee was to distribute a Git binary to someone else, the organization can be required to also provide the "complete and corresponding source code". And if they fail to do so, they may loose all their rights under the license, at least until the copyright holders agree to grant them back. For this reason some organizations exclude copyelfted software entirely. However, **when they use Git, it means the legal counsel has no objection to copylefted software.** ## What will change in Forgejo? The license of Forgejo will change to be copyelft when a copylefted work is merged. The most likely candidate is [the adapter](https://codeberg.org/forgejo/forgejo/commits/branch/forgejo-f3) for the [F3 file format](https://lab.forgefriends.org/friendlyforgeformat/gof3) which is a rather isolated package within the codebase. Before it happens a decision will be made by the community to choose a copyleft license, in accordance to the [Forgejo decision making process](https://codeberg.org/forgejo/governance/src/branch/main/DECISION-MAKING.md). The chosen license will apply to Forgejo as a whole (binary and sources) but each file within the codebase will retain its own license. This is nothing new as Forgejo [already includes various licenses](https://code.forgejo.org/assets/js/licenses.txt) and contributors are expected to agree to the [Developer Certificate of Origin](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/CONTRIBUTING/DCO.md). Developers who feel strongly about exclusively publishing their work under a permissive license can keep doing so when working on Forgejo in the Git repository. By the terms of this permissive license, they accept that their work can be sublicensed and redistributed under a proprietary license. And they also accept that it can be sublicensed and redistributed as part of Forgejo, under a copyleft license. The choice of a copyleft license is a delicate balance and it is expected that different opinions will be voiced within the Forgejo community. There already were debates comparing the merits of the [AGPL](https://en.wikipedia.org/wiki/GNU_Affero_General_Public_License) which was designed for online services and the [GPL](https://en.wikipedia.org/wiki/GNU_General_Public_License) which was designed before the internet age. The least controversial choice would be to choose the same license as Git since there already is a de facto consensus because all developers and users agree on it.

oliverpool commented 2023年04月18日 14:18:41 +02:00

I have mixed feelings about this agreements.
As you write It is an agreement on principle and I really think this agreement should define some "acceptable licenses" from the start.

Deferring the license discussion until after a first merge would mean:

• the first copyleft contribution will restrict the copyleft license choices (since not all copyleft licenses are compatible), somehow bypassing any agreement.
• choosing a license after the merge means that until a consensus is reached (which can last some time as we see...) the codebase will be in some awkward status-quo, as @dachary pointed out.

---

Based on the wikipedia compatibility graph, I would suggest accepting the following copyleft licenses within this agreement:

• MPL-2.0
• LGPL
• GPL-2.0-or-later
• GPL-3.0-only
• GPL-3.0-or-later

Since they all allow the whole Forgejo software to be distributed under GPL-3.0-only or AGPL-3.0.

Other licenses could be added with dedicated agreements.

AFAIK accepting GPL-2.0-only (which I did not list) contributions would imply that Forgejo can only be release under GPL-2.0-only license (and not accept LGPL-3.0-only contributions for instance).

I have mixed feelings about this agreements. As you write `It is an agreement on principle` and I really think this agreement should define some "acceptable licenses" from the start. Deferring the license discussion until after a first merge would mean: - the first copyleft contribution will restrict the copyleft license choices (since not all copyleft licenses are compatible), somehow bypassing any agreement. - choosing a license after the merge means that until a consensus is reached (which can last some time as we see...) the codebase will be in some awkward status-quo, as @dachary pointed out. --- Based on the [wikipedia compatibility graph](https://en.wikipedia.org/wiki/License_compatibility#/media/File:Floss-license-slide-image.svg), I would suggest accepting the following copyleft licenses within this agreement: - MPL-2.0 - LGPL - GPL-2.0-or-later - GPL-3.0-only - GPL-3.0-or-later Since they all allow the whole Forgejo software to be distributed under `GPL-3.0-only` or `AGPL-3.0`. Other licenses could be added with dedicated agreements. AFAIK accepting `GPL-2.0-only` (which I did not list) contributions would imply that Forgejo can only be release under `GPL-2.0-only` license (and not accept LGPL-3.0-only contributions for instance).

earl-warren commented 2023年04月18日 16:23:34 +02:00

You are correct, the wording suggests a scenario that is problematic. I tried an approach that avoids listing specific licenses and hopefully address this concern by clarifying that the decision regarding the license must happen before the merge:

The Forgejo community agrees on principle that original works published under a copyleft license can be merged into the codebase. Before that happens, the Forgejo community will decide on a copyleft license in accordance to the decision making process.

Does that sound like a sensible approach?

You are correct, the wording suggests a scenario that is problematic. I tried an approach that avoids listing specific licenses and hopefully address this concern by clarifying that the decision regarding the license must happen **before** the merge: > The Forgejo community agrees on principle that original works published under a copyleft license can be merged into the codebase. Before that happens, the Forgejo community will decide on a copyleft license in accordance to the decision making process. Does that sound like a sensible approach?

oliverpool commented 2023年04月18日 16:30:18 +02:00

Since it does not seem enforceable until explicit licenses are listed, I would suggest instead to add such statement the MISSION document (under Values maybe?)

Since it does not seem enforceable until explicit licenses are listed, I would suggest instead to add such statement the [MISSION document](https://codeberg.org/forgejo/governance/src/branch/main/MISSION.md) (under Values maybe?)

Ghost commented 2023年04月18日 17:51:04 +02:00

Since this is a very important agreement, I would suggest no less than three or four weeks before this is merged.

Since this is a very important agreement, I would suggest no less than three or four weeks before this is merged.

earl-warren commented 2023年04月18日 21:25:26 +02:00

I moved the update to MISSION.md instead as suggested, under Values.

I moved the update to MISSION.md instead as suggested, under Values.

earl-warren commented 2023年05月10日 11:51:55 +02:00

It has been three weeks and there were no objections or concerns, let's do that.

It has been three weeks and there were no objections or concerns, let's do that.