Hi,

On Tue, Jan 1, 2013 at 7:06 PM, Jesse Noller <jnoller@gmail.com> wrote:
On Jan 1, 2013, at 11:54 AM, Ezio Melotti <ezio.melotti@gmail.com> wrote:
Hi,

[...]

We also discussed about the contributor agreement and IIUC:
 1) he signed it already 1.5 years ago but apparently it got lost (that wouldn't be too surprising if it really happened);
 2) he thinks the current agreement is "invalid" because the PSF doesn't follow the terms and requirements of the linked Apache 2 license (and while he doesn't seem against signing in, that would be quite pointless if it was indeed invalid);
 3) he said that an electronic signature like the one at the bottom of http://code.google.com/legal/individual-cla-v1.0.html should be used instead of printing/scanning/mailing the agreement (this (or some similar suggestion) already came up a few times here).

Best Regards,
Ezio Melotti


All of this is moot; we have a new admin; we are working towards electronic signatures,

That's good news.
 
but it uses the same CLA as before; the terms and licenses are not different.

If he refuses to sign and send in the current CLA then that's his choice, and his contributions will not be included.


IIUC he's also saying that a CLA doesn't necessarily require to be linked to one or more external licenses, i.e. you can agree to contribute under the terms of the CLA alone and that should be enough.  The Google individual CLA seems to do this.
The problem with linking to external licenses is that *in theory* it requires you (and him) to read, understand, and accept their terms before putting your signature on the agreement.  In practice people are too lazy to do it and/or they don't care, so the only common problem is that contributors don't know which one to pick and ask you if you can lend them a coin to flip.
So, unless there's some specific reason preventing it, it should be possible to simplify our CLA and make it "self-contained" so that contributors can easily understand what they are signing (IANAL, but it seems to work for Google).
 
If he has specific legal concerns about the CLA backed by legal standing, he can send them to psf@python.org and we will have legal counsel review them.


I think the problem (or one of the problems) is that the Apache license (http://opensource.org/licenses/apache2.0.php) requires that, among other things, "You must give any other recipients of the Work or Derivative Works a copy of this License; and You must cause any modified files to carry prominent notices stating that You changed the files".  I'm not sure if we are doing this, if we really are required to do it, and what are the implications if we don't do it.  These are probably questions that a lawyer should answer (but OTOH contributors should be able to understand it without being lawyers themselves).

Also note that these issues are somewhat orthogonal.  Electronic signatures a simpler CLA are about improving and simplifying the process, while the issues with the Apache license could be an actual problem (that might be solved if the external licenses are removed by the CLA).  The combination of the two issues is probably making him uncomfortable about signing, even if he stated that we are free to use his patches on the bug tracker as we wish (but we can't without contribution form -- unless they are trivial).
IOW, from his point of view, he is willing to contribute, but before doing so he has to sign the contributor form.  Since he wants to understand what he is signing (and this is not an unreasonable request), he also has to read and understand the linked licenses, and because there are parts of them that are not yet clear to him, he is reluctant about signing.
(Disclaimer: the views expressed in this and some of the others email I wrote solely represent my understanding of the issues, and do not necessarily represent the actual views of anatoly.)

Best Regards,
Ezio Melotti