Hacker News Reader

Comment by lars_francke | Hacker News Reader

You are technically correct but I do see a difference between signing a CLA with The Linux Foundation, Eclipse, ASF etc. and a purely commercial corporate entity.

View on HN

You are entirely right; it's nowhere comparable. I'm just talking about the theoretical impacts. (after all, the re-licencing was also a theoretical problem, i.e. Hashicorp might abuse the non-compete clause so Terraform is not safe to use) I just find it interesting to mention - after all, the important details the ones which are not talked about.

For at least a few years now, companies relicensing their open source software has not been just a theoretical possibility, but a plausible thing that could happen any time.

I don’t know what happens to the Linux Foundation when we’re all in the nursing home, but them relicensing everything is not currently plausible. It is a merely theoretical possibility.

Yeah this makes sense. "CLAs (or DCOs) assigning copyright to foundations are good, CLAs assigning copyright to corporate entities are questionable" does seem like a pretty good rule of thumb for contributors who care about this kind of thing (which I agree most people should).

For what it's worth, the CNCF is not big on CLAs in general although, as far as I know, they don't specifically prohibit them. In general, they prefer to use a developer certificate of origin.

Are you sure of the CNCF not being big on CLAs?

According to the link below:

> Anyone who is contributing any code to any CNCF project must have the CLA signed.

https://contribute.cncf.io/resources/glossary/#:~:text=Contr...

That's a bit surprising to read because here's what @cra of the Linux Foundation said a couple years ago:

It’s [a Developer Certificate of Origin] how the Linux kernel works, where basically it takes all the basic things that most CLAs do, which would be like, ‘Did I write this code? Did I not copy it elsewhere? Do I have the rights to give this to you, and you sign off on?’ It’s been a very successful model played out in the kernel and many other ecosystems. I’m generally not really supportive of having CLAs unless there’s a real strict business need."

https://opensource.com/article/20/2/open-source-projects-gov...

FYI 99% of CNCF projects use DCO, only a handful still use CLA but we give projects a CHOICE in the matter. I prefer DCO personally because it's a lower barrier to entry for contributors (e.g., not formal legal agreement to sign and be reviewed by lawyers)

Doesn't Kubernetes require a CLA?

Yes. A small number of CnCF projects do. Google originally had a CLA in k8s and this was kept.

it does, they even have a label for it: https://github.com/kubernetes/kubernetes/pulls?q=label%3A%22...

> signing a CLA with The Linux Foundation, Eclipse, ASF etc.

what is the reason those require CLA? Why underlying license is not enough?

If there’s no intention of ever changing the license, then there is no need for a CLA.

A CLA is required when the repo owner wants the ability to change the license down the road without contacting N contributors.

yes, but it's not always malicious. one example is to dual license the code. for example, Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses.

a good CLA in this instance would guarantee you that your code cannot be relicensed exclusively away from GPL. the software is still free as in freedom, but the organization can fund itself by courting businesses that would not touch GPL software.

Another example is OpenStreetMap which changed its license because we learned that the old one wasn't adequate for the purpose intended.

We have no idea how today's licenses will be challenged in the future and I believe it's a good practice to keep a door open to being able to change the license going forward.

That it's not done maliciously is a purpose for foundations which serve as trust anchors.

that's an interesting point, thanks.

I'm still skeptical of a CLA for such a project since a ton (currently all) of the copyright is held by Hashicorp meaning they would have to consent to the future license change as well, regardless of the CLA or foundation membership. In general I think that makes a point for a CLA, but in this case I don't think it does.

> Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses.

but that's exactly the case which happened in case of Hashi, so CLA allowed them to continue working on commercial product only, with all 3p contributions being under their proprietary license.

Qt's situation is different, since they have contractual obligations to continue releasing under (L)GPL - failure to do so allows the KDE Project to release Qt under MIT.

A CLA is not required for that. A copyright assignment is. A CLA is not necessarily a copyright assignment, and a copyright assignment is not necessarily a CLA.

Reply on news.ycombinator.com