Licensing and Contribution Guidance
This document is meant to provide guidance to Globus Software committers for legal and licensing aspects of accepting contributions into dev.globus projects. Open Source licensing is a very useful tool to encourage collaboration and creation of community software. However, due to its distributed development nature there are a number of pitfalls and it is important that dev.globus members who are accepting contributions are aware of these.
The Globus Software community believes strongly in the central importance of open architecture, open source software to our field. We have worked within the Globus Software community, its users and other communities to make this vision a reality. If readers still have questions or concerns after reading this document, they are encouraged to contact the dev.globus Legal Issues Project (firstname.lastname@example.org) or the Globus Management Committee (email@example.com).
A Note about Terminology
Often when talking about copyrights and licensing in the context of software development it is natural to think of source code and in fact source code terminology is used throughout this document. However, it is important to recognize that other intellectual property such as documentation are also licensed and this document covers these types of intellectual property as well.
This document uses the term “Apache License V2” to refer to the “Apache V2.0 License” as available from http://www.apache.org. The Globus Toolkit Public License is identical to the Apache V2 license in function (it is the Apache V2 License renamed).The intent is that dev.globus will continue to use the latest license from Apache should it change in the future.
Why do we have to deal with Licensing?
Some members of the community believe that to release "free software" it suffices to put a copyright statement on it and put it "in the public domain." But in fact, other than claiming ownership a copyright statement has little meaning. What is important is the license under which the software is released. This is where you say what people can do with the software.
There are all sorts of licenses: e.g., licenses that require people to pay, licenses that say software is free to academia but not commerce, licenses that say any additions have to follow the same license (e.g., the Gnu Public License), and licenses that, like the Globus Toolkit Public License, the Modified BSD License and the Apache V2 License, that are much less prescriptive.
While the average graduate student or researcher doesn't typically worry too much about licenses, commercial people do. So if a piece of software has a license that says "no commercial use", they won't use it. If a software system is composed of 10 pieces, each with a different license, they probably won't use it either: how are they supposed to figure out whether they are going to get sued for some infringement of one of those 10 different licenses?
Over the past few years many large, widely-known Grid projects that develop and (re-)distribute software, as well as their funding agencies, have also become increasingly concerned with these legalities as they become increasingly dependant on the growing body of software being produced by the Grid and Web Services communities.
Goals of Globus Software Licensing
Members of the Globus Software community have been working for a decade, in collaboration with partners, to produce open source software for use in Grid infrastructures. Our goals with respect to licensing are as follows:
- To enable anyone to use Globus Software for any purpose without hindrance.
- To ensure that we (and anybody else) have the right to redistribute the Globus Software, with all contributions, under the Apache V2 License.
- To permit anyone to contribute to the Globus Software so long as their contribution is in line with the goals of the community.
Goal 1 is that anyone should be able to use Globus Software for any purpose without hindrance. For example, someone can use it for an academic project, for a scientific Grid, in a commercial product, etc. We believe that this liberal approach is critical for success of the field: e.g., if Siemens, or Sun, or IBM can't incorporate Grid software in products, we are less likely to get good Grid software in the future.
Goal 2 is akin to Goal 1, in that the Globus Software should be distributable by the University of Chicago and Argonne National Laboratory, as the legal entities maintaining dev.globus, as well as by anyone else who so desires within the terms of the Apache V2 License (and any other licenses contained within the distribution). It is important to note that this does not give redistributors carte blanche. For example, you cannot reuse Globus Software in your own code without maintaining copyright statements and licensing terms appropriately.
Goal 3 is that the processes needed to achieve the other goals are managed in such a manner so that contributors can make contributions to the Globus Software with the full blessing and knowledge of their employer and/or project.
Overview of the Globus Software Licensing Process
There are a number of licenses that are used in the Globus Software Licensing Process. These licenses are between the University of Chicago as Operator of Argonne National Laboratory, as the legal entity behind dev.globus, and the individuals and organizations contributing and using Globus Software. The Globus Software Licensing Process consists of the following licenses:
- The Apache V2 License: All software developed and maintained by the Globus Software community is distributed under the Apache V2 License. This allows such software to be freely used by anyone so long as they abide by the terms of the license.
- The Globus Software Individual Contributor License Agreement: This license is an agreement that allows dev.globus and others to freely redistribute contributions by an individual.
- The Globus Software Corporate Contributor License Agreement: For contributors with employers that own the intellectual property produced by that employee, this is an agreement between the employer and dev.globus granting dev.globus the right to freely distribute the contributions. This license allows a contributing organization to list exactly what is being contributed in the first instance.
Types of Software
There are three different types of software that compose the Globus Software base. Each has different licenses and requirements for contribution. The different types of code are as follows:
- Globus Community Created Software: Most of the code comprising the Globus Software base is code developed by members of the community and contributed to dev.globus under the Globus Software Contributors License (Individual and possible Corporate). This code is distributed under the Apache V2 License by dev.globus.
- Third-party Unmodified Code: Code that developed by a third party and is simply redistributed by dev.globus without modification under its original license. In this case the license for that code must be compatible with the Apache V2 License, but no further effort is required. By definition contributions are not made to Third-party Unmodified Code in the context of dev.globus.
- Third-party Modified Code: Code is that developed by some third party and modified or extended by Globus community members. For example, OpenSSH code modified to be Grid-enabled by developers at NCSA. This code cannot be "contributed" to Globus, as the developers (e.g., the OpenSSH modifiers at NCSA) do not own the original OpenSSH code and do not have the right to contribute it. The contributions to dev.globus make up the modifications to this code. These modifications may be distributed separately (e.g., as a patch) or combined with the original code. In the latter case the code is distributed under the original license, which must be compatible with the Apache V2 License. The modifications can be distributed under the same license as the original code or under the Apache V2 License.
Ideally modifications to Third-party Modified Code are contributed back to the original developers. However it is understood this is not always possible in a reasonable period of time, so the dev.globus community must occasionally maintain these changes separate from the original distribution but always within the rules of the original license.
Bug Fixes versus Contributions
The licensing process distinguishes between Bug Fixes, which do not require a contributor’s license, and Contributions.
Bug fixes are modifications to existing software or documentation that fixes a bug, typo, grammatical mistake, or similar error, but that do not add functionality or new intellectual property in its generally accepted sense. Bug fixes should be original creations of the contributor and not, for example, lifted from third-party code. Bug Fixes do not require any license agreements from the contributor. Bug Fixes must not have any copyright or license attached to them.
A Contribution is either a completely new piece of software, an addition to software that adds new functionality, new text that adds content to a document or a similar addition. The litmus test to separate such a contribution from a Bug Fix is that it does not simply fix existing content, but adds new functionality or intellectual content.
Legal Requirements for Contributions
This section documents the requirements for Contributions made to dev.globus.
- Individual Contributor’s License: The contributor must have signed an appropriate contributor’s agreement.
- Corporate Contributor’s License: If the contributor is employed by an organization, that organization must also have signed a Corporate Contributors License Agreement prior to the contribution. Note that a contributor cannot sign a contributor’s agreement in a personal capacity and then contribute code whose copyright is owned by their organization – the agreement has no value in this case. It should be noted that this license may be used to contribute a completely new piece of software to dev.globus and often an organization will wish to list all of the software and documents being contributed. This license allows for this as an annex.
- Other Licenses: Standard Contributions must have no prior licenses attached to them (if the contributor originally licensed the code under another license, they must remove that license when making the contribution). As a result of the contribution process, they will be licensed under the Apache V2 License.
- Third-party licenses and copyrights: It is very important when accepting a contribution that you make sure the contributor has the right to contribute the code to the repository. This means making sure the code contains no statements of copyright or licenses not held by the contributor unless the contributor has separately communicated to you which pieces of code are owned and licensed by someone else – so called “3rd party code” as described in Section 10. A common problem in Open Source software is the theft of software through the stripping of licensing terms and copyright statements and the inclusion of this code in contributions as if it were the contributor’s own work. The contributor’s licenses require the contributor to indemnify dev.globus and the University of Chicago as Operator of Argonne National Laboratory against such actions, however in practice accepting “clean” code is much the preferred option.
Software Headers and Copyright Statements
Each file in dev.globus should have the header shown in Figure 1, appropriately formatted to be a comment based on the language (e.g. C, Java) of the file it is in. There should be one or more copyright statements (one from each copyright holder).
/* * Copyright [yyyy] [name of copyright owner] * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, * either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */
Figure 1: Header to appear in all dev.globus files.
What makes a Contribution a Contribution?
Something becomes a contribution when an individual who has signed the Individual Contributor’s License and whose employer has also signed the Corporate Contributor’s License, performs one of the following actions:
- Commits a change to a repository (e.g. they perform a “cvs commit”); or
- They post the change to a project email list and do not explicitly state that it is not a contribution (e.g. they email a patch).
Contributions from Third Parties
Occasionally an individual may make a contribution written by a third party. For instance the code they are contributing may be jointly owned by several organizations or it may contain a function or source file written by another organization but used with their explicit permission. As described in Section 7 of the Individual Contributor’s License, such contributions should be made separately and the contributor must identify the complete details of its source and of any license or other restriction (including, but not limited to, related patents, trademarks, and license agreements) of which they are personally aware, and conspicuously marking the work as "Submitted on behalf of a third-party: [named here]". It is important to note that contributions made by an individual but which were written by several members within a single organization are not classified as Third Party contributions and may be contributed by that one individual.
What Third Party Licenses are Acceptable
In general, Globus follows the Apache Third-Party Licensing Policy. If you software that uses a third-party license, please read this document for guidance.
In a nutshell, all licenses of third-party code used by Globus products must be BSD-based. GPL-based licenses are not acceptable.
Updating the Globus Software License
Globus Software is currently distributed under the Apache V2 License, which from time-to-time will be updated. Since the Globus Software Contributor’s Licenses give dev.globus the ability to distribute software under any future version of the Apache V2 License, it is expected that dev.globus will track these changes in the Apache V2 License. The Globus Management Committee will coordinate such updates.
Much of the Globus Software licensing process is based on the processes and licenses established by the Apache Software Foundation.
- Apache V2 License: http://www.apache.org/
- Globus Software Individual Contributor’s License: http://www.globus.org/toolkit/GlobusIndividualContribLicenseAgreement.pdf
- Globus Software Corporate Contributor’s License: http://www.globus.org/toolkit/GlobusCorporateContribLicenseAgreement.pdf
- Apache License and Distribution FAQ: http://www.apache.org/foundation/licence-FAQ.html
- Applying the Apache License, Version 2.0: http://www.apache.org/dev/apply-license.html