Re: Daffodil Code Donation to ASF

["John D. Ament" <jo...@apache.org>]

Steve,

Apologies for the late reply.  I had this on my todo for last week, thought
I responded, but didn't.

On Wed, Aug 30, 2017 at 2:06 PM Steve Lawrence <sl...@apache.org> wrote:

> I've thoroughly gone through the Daffodil codebase and documented all
> the potential code ownership issues that I think need to be resolved
> before we can donate the code to the Apache Software Foundation (ASF).
> My findings are below.
>
> 1) The majority of the code is copyright NCSA, Tresys, or Mike Beckerle.
> The contributors from NCSA and some from Tresys now work at different
> companies and so contacting all of them may be difficult. We have
> contacted representatives for these entities and are working to get SGAs
> from NCSA, Tresys, and Mike Beckerle in place. We believe these three
> SGAs should cover contributions made by past employees.
>

There's two types of open source.  For the situation you're describing, it
makes sense to wait on SGAs since the copyright owners are companies not
individuals (I think Mike has already signed off). (the other type is when
the individuals retain the IP, in which case the ICLA is preferred but only
required if the copyright says something like "Contributors to <Project>")


>
> 2) Some contributions came from other entities that we no longer have
> contact with. Based on the git log, this includes:
>
> - Jeffrey Jacobs (Navy Research Lab)
> - Stephanie Huber (Air Force Research Lab)
> - Alonza Mumford (Department of Defense)
> - Jonathan Cranford (MITRE)
> - Jacob Baker (Booze Allen Hamilton)
>
> Of this list, the first three are federal government entities. Our
> understanding is that federal government contributions are Public
> Domain, and so perhaps we do not need an SGA for these contributions?
> This needs to be confirmed.
>

I forget the rules here.  You're right that its public domain, but there
are some nuances with then including it in a grant.  I'd actually recommend
asking the question on legal-discuss list and get their opinion.  Our
present VP Legal is actually Chief Architect for NASA JPL so he should be
pretty familiar with the situation.


>
> We have looked at the patches contributed from the non-government
> entities (Jonathan Cranford and Jacob Baker), and have confirmed that
> their changes have since been replaced as Daffodil has evolved, so we do
> not believe an SGA is necessary for their contributions.
>
> 3) A handful of tests and schema files were given to us from IBM and
> include an IBM copyright. The license for these files is unknown. We are
> working with IBM to get an SGA for these contributions.
>
> 4) The tests in item 3 include example snippets taken out of the DFDL
> specification, which are labeled as copyright Global Gird Forum (now
> renamed to the Open Grid Forum (OGF)). Regarding the ownership of these
> files, the OGF has stated:
>
>   In general OGF takes the position that it does not copyright or
>   license software, and that the examples used in specifications are
>   just that, examples of how to use the specification rather than
>   separately copyrighted code snippets.
>
> The full copyright notice regarding the contents of OGF documents is at:
>
>   https://www.ogf.org/dokuwiki/doku.php/about/copyright
>
> The copyright is copied at the end of this email for reference [1]. To
> me, this means we do not need an SGA, but may need to include the
> copyright notice from the link.
>
>

Agreed, more likely than not we would place that in our LICENSE file.  We
can confirm this on legal when we're ready to do a release.



> 5) We have copied code from the Scala library into Daffodil. The license
> is 3-clause BSD and should not cause any issues, aside from needing to
> include the license.
>

Agreed.  Just make sure none of the grants indicate this code is included.
Same for the next.


>
> 6) We have copied code from the Passera library into Daffodil. The
> license is 3-clause BSD and should not cause any issues, aside from
> needing to include the license.
>
> We additionally have dependencies on other libraries, but none of their
> code is included in the Daffodil source. We believe they are all
> compatible with the Apache v2 license, including Apache v2, BSD, MIT,
> and ICU.
>

Dependencies are generally not an issue, unless they're GPL.  Even LGPL has
some interesting ways to work around.


>
> We are also working on getting a CCLA from Tresys, since all initial
> committers are employed by Tresys.
>
> - Steve
>
>
> [1] Open Grid Forum Full Copyright Notice:
>
> * Copyright (C) Open Grid Forum (insert applicable years). Some Rights
>   Reserved. *
>
> This document and translations of it may be copied and furnished to
> others, and derivative works that comment on or otherwise explain it or
> assist in its implementation may be prepared, copied, published and
> distributed, in whole or in part, without restriction of any kind,
> provided that the above copyright notice and this paragraph are included
> as references to the derived portions on all such copies and derivative
> works. The published OGF document from which such works are derived,
> however, may not be modified in any way, such as by removing the
> copyright notice or references to the OGF or other organizations, except
> as needed for the purpose of developing new or updated OGF documents in
> conformance with the procedures defined in the OGF Document Process, or
> as required to translate it into languages other than English. OGF, with
> the approval of its board, may remove this restriction for inclusion of
> OGF document content for the purpose of producing standards in
> cooperation with other international standards bodies.
>
> The limited permissions granted above are perpetual and will not be
> revoked by the OGF or its successors or assignees.
>
>

Re: Daffodil Code Donation to ASF

[Steve Lawrence <sl...@apache.org>]

On 10/05/2017 02:30 PM, John D. Ament wrote:
> Joshua,
> 
> On Thu, Oct 5, 2017 at 2:22 PM Joshua Adams <ja...@apache.org> wrote:
> 
>> All,
>>
>> We have reviewed the commits that were made by the following government
>> employees: Alonza Mumford, Stephanie Huber (shuber), and Jeffrey Jacobs
>> (Jeffrey C. Jacobs, jeffrey.jacobs, timehorse).  These contributors were
>> only active for a short period of time 5 years ago (2012) and we believe
>> that there is no need for them to sign an SGA as the vast majority of the
>> changes they made have been removed in the 5 years since they were added.
>>
> 
> Unless these individuals are copyright holders to the source code, there is
> never a case for an individual to sign an SGA.  Individuals may sign ICLAs
> if there's a belief they have contributed in a way that requires it (e.g.
> active code).
> 
> 

Thanks for the clarification. Sounds like since to contributions from
Alonza, Staphanie, and Jeffrey are essentially gone, we do not need an
ICLA from them or an SGA from their company.

An update on SGA status, Tresys recently submitted a CCLA and SGA. We
are still waiting on an SGA from NCSA and IBM.

>>
>> Here is a summary of the few things that have remained in the codebase.
>> These were found by using git blame on the current state of the codebase as
>> well as doing a lot of grepping for strings in case code has moved to
>> different files and the original files have been removed.
>>
>> Outside of simply moving some test schemas inside of TDML files (as
>> opposed to keeping separate schema files), only 3 lines of Alonza Mumford's
>> code remain which consist only of some boilerplate in our test suite.
>>
>> Stephanie Huber primarily worked on some early implementations of
>> unparsing which has since been rewritten.  While none of her unparsing code
>> remains in the codebase, there are a few unparsing tests as well as some
>> scripts that she contributed that are still a part of the test suite.
>> These scripts as well as some of her test code are part of some legacy code
>> that we have already earmarked for removal before finalizing the move to
>> Apache.
>>
>> Jeffrey Jacobs focused his work on the parsing of binary data which has
>> also largely been rewritten and none of his parsing code remains in the
>> codebase.  There are still a few test cases that he contributed that are in
>> the test suite as well as some IDE configuration files that we have tracked
>> in the repo, which are also earmarked for removal as they are very out of
>> date.  We do not feel that these warrant the need for him to sign an SGA.
>>
>> Please let us know if you have any questions or if there is any more
>> information you need.
>>
>> Thanks,
>>
>> Josh Adams
>>
>>
>> On 2017-09-19 08:42, Steve Lawrence <sl...@apache.org> wrote:
>>> On 09/14/2017 10:08 PM, John D. Ament wrote:
>>>> Steve,
>>>>
>>>> Apologies for the late reply.  I had this on my todo for last week,
>> thought
>>>> I responded, but didn't.
>>>>
>>>> On Wed, Aug 30, 2017 at 2:06 PM Steve Lawrence <sl...@apache.org>
>> wrote:
>>>>
>>>>> I've thoroughly gone through the Daffodil codebase and documented all
>>>>> the potential code ownership issues that I think need to be resolved
>>>>> before we can donate the code to the Apache Software Foundation (ASF).
>>>>> My findings are below.
>>>>>
>>>>> 1) The majority of the code is copyright NCSA, Tresys, or Mike
>> Beckerle.
>>>>> The contributors from NCSA and some from Tresys now work at different
>>>>> companies and so contacting all of them may be difficult. We have
>>>>> contacted representatives for these entities and are working to get
>> SGAs
>>>>> from NCSA, Tresys, and Mike Beckerle in place. We believe these three
>>>>> SGAs should cover contributions made by past employees.
>>>>>
>>>>
>>>> There's two types of open source.  For the situation you're
>> describing, it
>>>> makes sense to wait on SGAs since the copyright owners are companies
>> not
>>>> individuals (I think Mike has already signed off). (the other type is
>> when
>>>> the individuals retain the IP, in which case the ICLA is preferred but
>> only
>>>> required if the copyright says something like "Contributors to
>> <Project>")
>>>>
>>>>
>>>>>
>>>>> 2) Some contributions came from other entities that we no longer have
>>>>> contact with. Based on the git log, this includes:
>>>>>
>>>>> - Jeffrey Jacobs (Navy Research Lab)
>>>>> - Stephanie Huber (Air Force Research Lab)
>>>>> - Alonza Mumford (Department of Defense)
>>>>> - Jonathan Cranford (MITRE)
>>>>> - Jacob Baker (Booze Allen Hamilton)
>>>>>
>>>>> Of this list, the first three are federal government entities. Our
>>>>> understanding is that federal government contributions are Public
>>>>> Domain, and so perhaps we do not need an SGA for these contributions?
>>>>> This needs to be confirmed.
>>>>>
>>>>
>>>> I forget the rules here.  You're right that its public domain, but
>> there
>>>> are some nuances with then including it in a grant.  I'd actually
>> recommend
>>>> asking the question on legal-discuss list and get their opinion.  Our
>>>> present VP Legal is actually Chief Architect for NASA JPL so he should
>> be
>>>> pretty familiar with the situation.
>>>>
>>>>
>>>>>
>>>>> We have looked at the patches contributed from the non-government
>>>>> entities (Jonathan Cranford and Jacob Baker), and have confirmed that
>>>>> their changes have since been replaced as Daffodil has evolved, so we
>> do
>>>>> not believe an SGA is necessary for their contributions.
>>>>>
>>>>> 3) A handful of tests and schema files were given to us from IBM and
>>>>> include an IBM copyright. The license for these files is unknown. We
>> are
>>>>> working with IBM to get an SGA for these contributions.
>>>>>
>>>>> 4) The tests in item 3 include example snippets taken out of the DFDL
>>>>> specification, which are labeled as copyright Global Gird Forum (now
>>>>> renamed to the Open Grid Forum (OGF)). Regarding the ownership of
>> these
>>>>> files, the OGF has stated:
>>>>>
>>>>>   In general OGF takes the position that it does not copyright or
>>>>>   license software, and that the examples used in specifications are
>>>>>   just that, examples of how to use the specification rather than
>>>>>   separately copyrighted code snippets.
>>>>>
>>>>> The full copyright notice regarding the contents of OGF documents is
>> at:
>>>>>
>>>>>   https://www.ogf.org/dokuwiki/doku.php/about/copyright
>>>>>
>>>>> The copyright is copied at the end of this email for reference [1]. To
>>>>> me, this means we do not need an SGA, but may need to include the
>>>>> copyright notice from the link.
>>>>>
>>>>>
>>>>
>>>> Agreed, more likely than not we would place that in our LICENSE file.
>> We
>>>> can confirm this on legal when we're ready to do a release.
>>>>
>>>>
>>>>
>>>>> 5) We have copied code from the Scala library into Daffodil. The
>> license
>>>>> is 3-clause BSD and should not cause any issues, aside from needing to
>>>>> include the license.
>>>>>
>>>>
>>>> Agreed.  Just make sure none of the grants indicate this code is
>> included.
>>>> Same for the next.
>>>>
>>>>
>>>>>
>>>>> 6) We have copied code from the Passera library into Daffodil. The
>>>>> license is 3-clause BSD and should not cause any issues, aside from
>>>>> needing to include the license.
>>>>>
>>>>> We additionally have dependencies on other libraries, but none of
>> their
>>>>> code is included in the Daffodil source. We believe they are all
>>>>> compatible with the Apache v2 license, including Apache v2, BSD, MIT,
>>>>> and ICU.
>>>>>
>>>>
>>>> Dependencies are generally not an issue, unless they're GPL.  Even
>> LGPL has
>>>> some interesting ways to work around.
>>>>
>>>>
>>>>>
>>>>> We are also working on getting a CCLA from Tresys, since all initial
>>>>> committers are employed by Tresys.
>>>>>
>>>>> - Steve
>>>>>
>>>>>
>>>>> [1] Open Grid Forum Full Copyright Notice:
>>>>>
>>>>> * Copyright (C) Open Grid Forum (insert applicable years). Some Rights
>>>>>   Reserved. *
>>>>>
>>>>> This document and translations of it may be copied and furnished to
>>>>> others, and derivative works that comment on or otherwise explain it
>> or
>>>>> assist in its implementation may be prepared, copied, published and
>>>>> distributed, in whole or in part, without restriction of any kind,
>>>>> provided that the above copyright notice and this paragraph are
>> included
>>>>> as references to the derived portions on all such copies and
>> derivative
>>>>> works. The published OGF document from which such works are derived,
>>>>> however, may not be modified in any way, such as by removing the
>>>>> copyright notice or references to the OGF or other organizations,
>> except
>>>>> as needed for the purpose of developing new or updated OGF documents
>> in
>>>>> conformance with the procedures defined in the OGF Document Process,
>> or
>>>>> as required to translate it into languages other than English. OGF,
>> with
>>>>> the approval of its board, may remove this restriction for inclusion
>> of
>>>>> OGF document content for the purpose of producing standards in
>>>>> cooperation with other international standards bodies.
>>>>>
>>>>> The limited permissions granted above are perpetual and will not be
>>>>> revoked by the OGF or its successors or assignees.
>>>>>
>>>>>
>>>>
>>>
>>> Thanks for the answers John. Sounds like we're on the right track. For
>>> reference, I've started a thread on legal-discuss for further
>>> clarifications here:
>>>
>>>
>> https://lists.apache.org/thread.html/5bea1471ba0b98a14c87d066e83faf377e6e537ed02ee9dc6b583569@%3Clegal-discuss.apache.org%3E
>>>
>>> - Steve
>>>
>>
> 

Re: Daffodil Code Donation to ASF

["John D. Ament" <jo...@apache.org>]

Joshua,

On Thu, Oct 5, 2017 at 2:22 PM Joshua Adams <ja...@apache.org> wrote:

> All,
>
> We have reviewed the commits that were made by the following government
> employees: Alonza Mumford, Stephanie Huber (shuber), and Jeffrey Jacobs
> (Jeffrey C. Jacobs, jeffrey.jacobs, timehorse).  These contributors were
> only active for a short period of time 5 years ago (2012) and we believe
> that there is no need for them to sign an SGA as the vast majority of the
> changes they made have been removed in the 5 years since they were added.
>

Unless these individuals are copyright holders to the source code, there is
never a case for an individual to sign an SGA.  Individuals may sign ICLAs
if there's a belief they have contributed in a way that requires it (e.g.
active code).


>
> Here is a summary of the few things that have remained in the codebase.
> These were found by using git blame on the current state of the codebase as
> well as doing a lot of grepping for strings in case code has moved to
> different files and the original files have been removed.
>
> Outside of simply moving some test schemas inside of TDML files (as
> opposed to keeping separate schema files), only 3 lines of Alonza Mumford's
> code remain which consist only of some boilerplate in our test suite.
>
> Stephanie Huber primarily worked on some early implementations of
> unparsing which has since been rewritten.  While none of her unparsing code
> remains in the codebase, there are a few unparsing tests as well as some
> scripts that she contributed that are still a part of the test suite.
> These scripts as well as some of her test code are part of some legacy code
> that we have already earmarked for removal before finalizing the move to
> Apache.
>
> Jeffrey Jacobs focused his work on the parsing of binary data which has
> also largely been rewritten and none of his parsing code remains in the
> codebase.  There are still a few test cases that he contributed that are in
> the test suite as well as some IDE configuration files that we have tracked
> in the repo, which are also earmarked for removal as they are very out of
> date.  We do not feel that these warrant the need for him to sign an SGA.
>
> Please let us know if you have any questions or if there is any more
> information you need.
>
> Thanks,
>
> Josh Adams
>
>
> On 2017-09-19 08:42, Steve Lawrence <sl...@apache.org> wrote:
> > On 09/14/2017 10:08 PM, John D. Ament wrote:
> > > Steve,
> > >
> > > Apologies for the late reply.  I had this on my todo for last week,
> thought
> > > I responded, but didn't.
> > >
> > > On Wed, Aug 30, 2017 at 2:06 PM Steve Lawrence <sl...@apache.org>
> wrote:
> > >
> > >> I've thoroughly gone through the Daffodil codebase and documented all
> > >> the potential code ownership issues that I think need to be resolved
> > >> before we can donate the code to the Apache Software Foundation (ASF).
> > >> My findings are below.
> > >>
> > >> 1) The majority of the code is copyright NCSA, Tresys, or Mike
> Beckerle.
> > >> The contributors from NCSA and some from Tresys now work at different
> > >> companies and so contacting all of them may be difficult. We have
> > >> contacted representatives for these entities and are working to get
> SGAs
> > >> from NCSA, Tresys, and Mike Beckerle in place. We believe these three
> > >> SGAs should cover contributions made by past employees.
> > >>
> > >
> > > There's two types of open source.  For the situation you're
> describing, it
> > > makes sense to wait on SGAs since the copyright owners are companies
> not
> > > individuals (I think Mike has already signed off). (the other type is
> when
> > > the individuals retain the IP, in which case the ICLA is preferred but
> only
> > > required if the copyright says something like "Contributors to
> <Project>")
> > >
> > >
> > >>
> > >> 2) Some contributions came from other entities that we no longer have
> > >> contact with. Based on the git log, this includes:
> > >>
> > >> - Jeffrey Jacobs (Navy Research Lab)
> > >> - Stephanie Huber (Air Force Research Lab)
> > >> - Alonza Mumford (Department of Defense)
> > >> - Jonathan Cranford (MITRE)
> > >> - Jacob Baker (Booze Allen Hamilton)
> > >>
> > >> Of this list, the first three are federal government entities. Our
> > >> understanding is that federal government contributions are Public
> > >> Domain, and so perhaps we do not need an SGA for these contributions?
> > >> This needs to be confirmed.
> > >>
> > >
> > > I forget the rules here.  You're right that its public domain, but
> there
> > > are some nuances with then including it in a grant.  I'd actually
> recommend
> > > asking the question on legal-discuss list and get their opinion.  Our
> > > present VP Legal is actually Chief Architect for NASA JPL so he should
> be
> > > pretty familiar with the situation.
> > >
> > >
> > >>
> > >> We have looked at the patches contributed from the non-government
> > >> entities (Jonathan Cranford and Jacob Baker), and have confirmed that
> > >> their changes have since been replaced as Daffodil has evolved, so we
> do
> > >> not believe an SGA is necessary for their contributions.
> > >>
> > >> 3) A handful of tests and schema files were given to us from IBM and
> > >> include an IBM copyright. The license for these files is unknown. We
> are
> > >> working with IBM to get an SGA for these contributions.
> > >>
> > >> 4) The tests in item 3 include example snippets taken out of the DFDL
> > >> specification, which are labeled as copyright Global Gird Forum (now
> > >> renamed to the Open Grid Forum (OGF)). Regarding the ownership of
> these
> > >> files, the OGF has stated:
> > >>
> > >>   In general OGF takes the position that it does not copyright or
> > >>   license software, and that the examples used in specifications are
> > >>   just that, examples of how to use the specification rather than
> > >>   separately copyrighted code snippets.
> > >>
> > >> The full copyright notice regarding the contents of OGF documents is
> at:
> > >>
> > >>   https://www.ogf.org/dokuwiki/doku.php/about/copyright
> > >>
> > >> The copyright is copied at the end of this email for reference [1]. To
> > >> me, this means we do not need an SGA, but may need to include the
> > >> copyright notice from the link.
> > >>
> > >>
> > >
> > > Agreed, more likely than not we would place that in our LICENSE file.
> We
> > > can confirm this on legal when we're ready to do a release.
> > >
> > >
> > >
> > >> 5) We have copied code from the Scala library into Daffodil. The
> license
> > >> is 3-clause BSD and should not cause any issues, aside from needing to
> > >> include the license.
> > >>
> > >
> > > Agreed.  Just make sure none of the grants indicate this code is
> included.
> > > Same for the next.
> > >
> > >
> > >>
> > >> 6) We have copied code from the Passera library into Daffodil. The
> > >> license is 3-clause BSD and should not cause any issues, aside from
> > >> needing to include the license.
> > >>
> > >> We additionally have dependencies on other libraries, but none of
> their
> > >> code is included in the Daffodil source. We believe they are all
> > >> compatible with the Apache v2 license, including Apache v2, BSD, MIT,
> > >> and ICU.
> > >>
> > >
> > > Dependencies are generally not an issue, unless they're GPL.  Even
> LGPL has
> > > some interesting ways to work around.
> > >
> > >
> > >>
> > >> We are also working on getting a CCLA from Tresys, since all initial
> > >> committers are employed by Tresys.
> > >>
> > >> - Steve
> > >>
> > >>
> > >> [1] Open Grid Forum Full Copyright Notice:
> > >>
> > >> * Copyright (C) Open Grid Forum (insert applicable years). Some Rights
> > >>   Reserved. *
> > >>
> > >> This document and translations of it may be copied and furnished to
> > >> others, and derivative works that comment on or otherwise explain it
> or
> > >> assist in its implementation may be prepared, copied, published and
> > >> distributed, in whole or in part, without restriction of any kind,
> > >> provided that the above copyright notice and this paragraph are
> included
> > >> as references to the derived portions on all such copies and
> derivative
> > >> works. The published OGF document from which such works are derived,
> > >> however, may not be modified in any way, such as by removing the
> > >> copyright notice or references to the OGF or other organizations,
> except
> > >> as needed for the purpose of developing new or updated OGF documents
> in
> > >> conformance with the procedures defined in the OGF Document Process,
> or
> > >> as required to translate it into languages other than English. OGF,
> with
> > >> the approval of its board, may remove this restriction for inclusion
> of
> > >> OGF document content for the purpose of producing standards in
> > >> cooperation with other international standards bodies.
> > >>
> > >> The limited permissions granted above are perpetual and will not be
> > >> revoked by the OGF or its successors or assignees.
> > >>
> > >>
> > >
> >
> > Thanks for the answers John. Sounds like we're on the right track. For
> > reference, I've started a thread on legal-discuss for further
> > clarifications here:
> >
> >
> https://lists.apache.org/thread.html/5bea1471ba0b98a14c87d066e83faf377e6e537ed02ee9dc6b583569@%3Clegal-discuss.apache.org%3E
> >
> > - Steve
> >
>

Re: Daffodil Code Donation to ASF

[Joshua Adams <ja...@apache.org>]

All,

We have reviewed the commits that were made by the following government employees: Alonza Mumford, Stephanie Huber (shuber), and Jeffrey Jacobs (Jeffrey C. Jacobs, jeffrey.jacobs, timehorse).  These contributors were only active for a short period of time 5 years ago (2012) and we believe that there is no need for them to sign an SGA as the vast majority of the changes they made have been removed in the 5 years since they were added.

Here is a summary of the few things that have remained in the codebase.  These were found by using git blame on the current state of the codebase as well as doing a lot of grepping for strings in case code has moved to different files and the original files have been removed.

Outside of simply moving some test schemas inside of TDML files (as opposed to keeping separate schema files), only 3 lines of Alonza Mumford's code remain which consist only of some boilerplate in our test suite.

Stephanie Huber primarily worked on some early implementations of unparsing which has since been rewritten.  While none of her unparsing code remains in the codebase, there are a few unparsing tests as well as some scripts that she contributed that are still a part of the test suite.  These scripts as well as some of her test code are part of some legacy code that we have already earmarked for removal before finalizing the move to Apache.

Jeffrey Jacobs focused his work on the parsing of binary data which has also largely been rewritten and none of his parsing code remains in the codebase.  There are still a few test cases that he contributed that are in the test suite as well as some IDE configuration files that we have tracked in the repo, which are also earmarked for removal as they are very out of date.  We do not feel that these warrant the need for him to sign an SGA.

Please let us know if you have any questions or if there is any more information you need.

Thanks,

Josh Adams


On 2017-09-19 08:42, Steve Lawrence <sl...@apache.org> wrote: 
> On 09/14/2017 10:08 PM, John D. Ament wrote:
> > Steve,
> > 
> > Apologies for the late reply.  I had this on my todo for last week, thought
> > I responded, but didn't.
> > 
> > On Wed, Aug 30, 2017 at 2:06 PM Steve Lawrence <sl...@apache.org> wrote:
> > 
> >> I've thoroughly gone through the Daffodil codebase and documented all
> >> the potential code ownership issues that I think need to be resolved
> >> before we can donate the code to the Apache Software Foundation (ASF).
> >> My findings are below.
> >>
> >> 1) The majority of the code is copyright NCSA, Tresys, or Mike Beckerle.
> >> The contributors from NCSA and some from Tresys now work at different
> >> companies and so contacting all of them may be difficult. We have
> >> contacted representatives for these entities and are working to get SGAs
> >> from NCSA, Tresys, and Mike Beckerle in place. We believe these three
> >> SGAs should cover contributions made by past employees.
> >>
> > 
> > There's two types of open source.  For the situation you're describing, it
> > makes sense to wait on SGAs since the copyright owners are companies not
> > individuals (I think Mike has already signed off). (the other type is when
> > the individuals retain the IP, in which case the ICLA is preferred but only
> > required if the copyright says something like "Contributors to <Project>")
> > 
> > 
> >>
> >> 2) Some contributions came from other entities that we no longer have
> >> contact with. Based on the git log, this includes:
> >>
> >> - Jeffrey Jacobs (Navy Research Lab)
> >> - Stephanie Huber (Air Force Research Lab)
> >> - Alonza Mumford (Department of Defense)
> >> - Jonathan Cranford (MITRE)
> >> - Jacob Baker (Booze Allen Hamilton)
> >>
> >> Of this list, the first three are federal government entities. Our
> >> understanding is that federal government contributions are Public
> >> Domain, and so perhaps we do not need an SGA for these contributions?
> >> This needs to be confirmed.
> >>
> > 
> > I forget the rules here.  You're right that its public domain, but there
> > are some nuances with then including it in a grant.  I'd actually recommend
> > asking the question on legal-discuss list and get their opinion.  Our
> > present VP Legal is actually Chief Architect for NASA JPL so he should be
> > pretty familiar with the situation.
> > 
> > 
> >>
> >> We have looked at the patches contributed from the non-government
> >> entities (Jonathan Cranford and Jacob Baker), and have confirmed that
> >> their changes have since been replaced as Daffodil has evolved, so we do
> >> not believe an SGA is necessary for their contributions.
> >>
> >> 3) A handful of tests and schema files were given to us from IBM and
> >> include an IBM copyright. The license for these files is unknown. We are
> >> working with IBM to get an SGA for these contributions.
> >>
> >> 4) The tests in item 3 include example snippets taken out of the DFDL
> >> specification, which are labeled as copyright Global Gird Forum (now
> >> renamed to the Open Grid Forum (OGF)). Regarding the ownership of these
> >> files, the OGF has stated:
> >>
> >>   In general OGF takes the position that it does not copyright or
> >>   license software, and that the examples used in specifications are
> >>   just that, examples of how to use the specification rather than
> >>   separately copyrighted code snippets.
> >>
> >> The full copyright notice regarding the contents of OGF documents is at:
> >>
> >>   https://www.ogf.org/dokuwiki/doku.php/about/copyright
> >>
> >> The copyright is copied at the end of this email for reference [1]. To
> >> me, this means we do not need an SGA, but may need to include the
> >> copyright notice from the link.
> >>
> >>
> > 
> > Agreed, more likely than not we would place that in our LICENSE file.  We
> > can confirm this on legal when we're ready to do a release.
> > 
> > 
> > 
> >> 5) We have copied code from the Scala library into Daffodil. The license
> >> is 3-clause BSD and should not cause any issues, aside from needing to
> >> include the license.
> >>
> > 
> > Agreed.  Just make sure none of the grants indicate this code is included.
> > Same for the next.
> > 
> > 
> >>
> >> 6) We have copied code from the Passera library into Daffodil. The
> >> license is 3-clause BSD and should not cause any issues, aside from
> >> needing to include the license.
> >>
> >> We additionally have dependencies on other libraries, but none of their
> >> code is included in the Daffodil source. We believe they are all
> >> compatible with the Apache v2 license, including Apache v2, BSD, MIT,
> >> and ICU.
> >>
> > 
> > Dependencies are generally not an issue, unless they're GPL.  Even LGPL has
> > some interesting ways to work around.
> > 
> > 
> >>
> >> We are also working on getting a CCLA from Tresys, since all initial
> >> committers are employed by Tresys.
> >>
> >> - Steve
> >>
> >>
> >> [1] Open Grid Forum Full Copyright Notice:
> >>
> >> * Copyright (C) Open Grid Forum (insert applicable years). Some Rights
> >>   Reserved. *
> >>
> >> This document and translations of it may be copied and furnished to
> >> others, and derivative works that comment on or otherwise explain it or
> >> assist in its implementation may be prepared, copied, published and
> >> distributed, in whole or in part, without restriction of any kind,
> >> provided that the above copyright notice and this paragraph are included
> >> as references to the derived portions on all such copies and derivative
> >> works. The published OGF document from which such works are derived,
> >> however, may not be modified in any way, such as by removing the
> >> copyright notice or references to the OGF or other organizations, except
> >> as needed for the purpose of developing new or updated OGF documents in
> >> conformance with the procedures defined in the OGF Document Process, or
> >> as required to translate it into languages other than English. OGF, with
> >> the approval of its board, may remove this restriction for inclusion of
> >> OGF document content for the purpose of producing standards in
> >> cooperation with other international standards bodies.
> >>
> >> The limited permissions granted above are perpetual and will not be
> >> revoked by the OGF or its successors or assignees.
> >>
> >>
> > 
> 
> Thanks for the answers John. Sounds like we're on the right track. For
> reference, I've started a thread on legal-discuss for further
> clarifications here:
> 
> https://lists.apache.org/thread.html/5bea1471ba0b98a14c87d066e83faf377e6e537ed02ee9dc6b583569@%3Clegal-discuss.apache.org%3E
> 
> - Steve
> 

Re: Daffodil Code Donation to ASF

[Steve Lawrence <sl...@apache.org>]

On 09/14/2017 10:08 PM, John D. Ament wrote:
> Steve,
> 
> Apologies for the late reply.  I had this on my todo for last week, thought
> I responded, but didn't.
> 
> On Wed, Aug 30, 2017 at 2:06 PM Steve Lawrence <sl...@apache.org> wrote:
> 
>> I've thoroughly gone through the Daffodil codebase and documented all
>> the potential code ownership issues that I think need to be resolved
>> before we can donate the code to the Apache Software Foundation (ASF).
>> My findings are below.
>>
>> 1) The majority of the code is copyright NCSA, Tresys, or Mike Beckerle.
>> The contributors from NCSA and some from Tresys now work at different
>> companies and so contacting all of them may be difficult. We have
>> contacted representatives for these entities and are working to get SGAs
>> from NCSA, Tresys, and Mike Beckerle in place. We believe these three
>> SGAs should cover contributions made by past employees.
>>
> 
> There's two types of open source.  For the situation you're describing, it
> makes sense to wait on SGAs since the copyright owners are companies not
> individuals (I think Mike has already signed off). (the other type is when
> the individuals retain the IP, in which case the ICLA is preferred but only
> required if the copyright says something like "Contributors to <Project>")
> 
> 
>>
>> 2) Some contributions came from other entities that we no longer have
>> contact with. Based on the git log, this includes:
>>
>> - Jeffrey Jacobs (Navy Research Lab)
>> - Stephanie Huber (Air Force Research Lab)
>> - Alonza Mumford (Department of Defense)
>> - Jonathan Cranford (MITRE)
>> - Jacob Baker (Booze Allen Hamilton)
>>
>> Of this list, the first three are federal government entities. Our
>> understanding is that federal government contributions are Public
>> Domain, and so perhaps we do not need an SGA for these contributions?
>> This needs to be confirmed.
>>
> 
> I forget the rules here.  You're right that its public domain, but there
> are some nuances with then including it in a grant.  I'd actually recommend
> asking the question on legal-discuss list and get their opinion.  Our
> present VP Legal is actually Chief Architect for NASA JPL so he should be
> pretty familiar with the situation.
> 
> 
>>
>> We have looked at the patches contributed from the non-government
>> entities (Jonathan Cranford and Jacob Baker), and have confirmed that
>> their changes have since been replaced as Daffodil has evolved, so we do
>> not believe an SGA is necessary for their contributions.
>>
>> 3) A handful of tests and schema files were given to us from IBM and
>> include an IBM copyright. The license for these files is unknown. We are
>> working with IBM to get an SGA for these contributions.
>>
>> 4) The tests in item 3 include example snippets taken out of the DFDL
>> specification, which are labeled as copyright Global Gird Forum (now
>> renamed to the Open Grid Forum (OGF)). Regarding the ownership of these
>> files, the OGF has stated:
>>
>>   In general OGF takes the position that it does not copyright or
>>   license software, and that the examples used in specifications are
>>   just that, examples of how to use the specification rather than
>>   separately copyrighted code snippets.
>>
>> The full copyright notice regarding the contents of OGF documents is at:
>>
>>   https://www.ogf.org/dokuwiki/doku.php/about/copyright
>>
>> The copyright is copied at the end of this email for reference [1]. To
>> me, this means we do not need an SGA, but may need to include the
>> copyright notice from the link.
>>
>>
> 
> Agreed, more likely than not we would place that in our LICENSE file.  We
> can confirm this on legal when we're ready to do a release.
> 
> 
> 
>> 5) We have copied code from the Scala library into Daffodil. The license
>> is 3-clause BSD and should not cause any issues, aside from needing to
>> include the license.
>>
> 
> Agreed.  Just make sure none of the grants indicate this code is included.
> Same for the next.
> 
> 
>>
>> 6) We have copied code from the Passera library into Daffodil. The
>> license is 3-clause BSD and should not cause any issues, aside from
>> needing to include the license.
>>
>> We additionally have dependencies on other libraries, but none of their
>> code is included in the Daffodil source. We believe they are all
>> compatible with the Apache v2 license, including Apache v2, BSD, MIT,
>> and ICU.
>>
> 
> Dependencies are generally not an issue, unless they're GPL.  Even LGPL has
> some interesting ways to work around.
> 
> 
>>
>> We are also working on getting a CCLA from Tresys, since all initial
>> committers are employed by Tresys.
>>
>> - Steve
>>
>>
>> [1] Open Grid Forum Full Copyright Notice:
>>
>> * Copyright (C) Open Grid Forum (insert applicable years). Some Rights
>>   Reserved. *
>>
>> This document and translations of it may be copied and furnished to
>> others, and derivative works that comment on or otherwise explain it or
>> assist in its implementation may be prepared, copied, published and
>> distributed, in whole or in part, without restriction of any kind,
>> provided that the above copyright notice and this paragraph are included
>> as references to the derived portions on all such copies and derivative
>> works. The published OGF document from which such works are derived,
>> however, may not be modified in any way, such as by removing the
>> copyright notice or references to the OGF or other organizations, except
>> as needed for the purpose of developing new or updated OGF documents in
>> conformance with the procedures defined in the OGF Document Process, or
>> as required to translate it into languages other than English. OGF, with
>> the approval of its board, may remove this restriction for inclusion of
>> OGF document content for the purpose of producing standards in
>> cooperation with other international standards bodies.
>>
>> The limited permissions granted above are perpetual and will not be
>> revoked by the OGF or its successors or assignees.
>>
>>
> 

Thanks for the answers John. Sounds like we're on the right track. For
reference, I've started a thread on legal-discuss for further
clarifications here:

https://lists.apache.org/thread.html/5bea1471ba0b98a14c87d066e83faf377e6e537ed02ee9dc6b583569@%3Clegal-discuss.apache.org%3E

- Steve