Query about patch submission by link

[Andy Seaborne <an...@epimorphics.com>]

(mentors, mainly)

Suppose a JIRA has patch but it's a link to a file on a non-ASF machine 
from someone who has not signed a xCLA.  The "Apache can use it" check 
box is checked.

Can this be accepted as-is, or should/must the contents be placed on the 
JIRA?

The 2 issues I see are

1/ that the link does not provide a proper record of the contents of the 
file (the contents may change or disappear)

2/ it's not so clear the submitter has the rights to contribute (could 
be a link to someone's content; it's hard to verify the ownership of 
link content)

When this happened to me, I asked the contributor to attach the patch, 
which they kindly did (more a question to driving JIRA), but to be 
prepared for next time, I wanted to check the situation.

Unless there established practice, I'd not accept linked contributions
because of 1 and 2 not leaving a trail in JIRA.  The only exception 
might be very large contributions - but if it's that large, then a 
software grant would be clearer anyway.

	Andy

Re: Query about patch submission by link

[Andy Seaborne <an...@epimorphics.com>]

I'll watch LEGAL-92 with interest.

I saw the maven one which is what caused be to ask - JENA-78 is simpler, 
and isn't itself a problem because the contributor has attached the 
content of the patch.

At the time, I didn't think it was workable to provide a link because of 
lack of clarity over ownership of the content.  The JIRA file attachment 
statement seems to apply to the link, the not content of the link.

And so we conclude that not every problem can be solved by another level 
of indirection.

	Andy

On 03/07/11 16:59, Benson Margulies wrote:
> I just asked legal-discuss this very question.
> https://issues.apache.org/jira/browse/LEGAL-92. Since your JIRA is at
> ASF, this should make it good to go.
> .
> On Sun, Jul 3, 2011 at 11:50 AM, Andy Seaborne
> <an...@epimorphics.com>  wrote:
>> (mentors, mainly)
>>
>> Suppose a JIRA has patch but it's a link to a file on a non-ASF machine from
>> someone who has not signed a xCLA.  The "Apache can use it" check box is
>> checked.
>>
>> Can this be accepted as-is, or should/must the contents be placed on the
>> JIRA?
>>
>> The 2 issues I see are
>>
>> 1/ that the link does not provide a proper record of the contents of the
>> file (the contents may change or disappear)
>>
>> 2/ it's not so clear the submitter has the rights to contribute (could be a
>> link to someone's content; it's hard to verify the ownership of link
>> content)
>>
>> When this happened to me, I asked the contributor to attach the patch, which
>> they kindly did (more a question to driving JIRA), but to be prepared for
>> next time, I wanted to check the situation.
>>
>> Unless there established practice, I'd not accept linked contributions
>> because of 1 and 2 not leaving a trail in JIRA.  The only exception might be
>> very large contributions - but if it's that large, then a software grant
>> would be clearer anyway.
>>
>>         Andy
>>

Re: Query about patch submission by link

[Ross Gardler <rg...@opendirective.com>]

On 3 July 2011 16:59, Benson Margulies <bi...@gmail.com> wrote:
> I just asked legal-discuss this very question.
> https://issues.apache.org/jira/browse/LEGAL-92. Since your JIRA is at
> ASF, this should make it good to go.

Sam quotes:

"Contribution" shall mean any work of authorship, including the
original version of the Work and any modifications or additions to
that Work or Derivative Works thereof, that is intentionally submitted
to Licensor for inclusion in the Work by the copyright owner or by an
individual or Legal Entity authorized to submit on behalf of the
copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent to
the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control
systems, and issue tracking systems that are managed by, or on behalf
of, the Licensor for the purpose of discussing and improving the Work,
but excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."

If the "contribution" is a link to some code somewhere then I think it
can be argued that the code was never contributed to the ASF.

I've asked on the issue, so watch that space for more clarity from our
legal team.

Ross

> .
> On Sun, Jul 3, 2011 at 11:50 AM, Andy Seaborne
> <an...@epimorphics.com> wrote:
>> (mentors, mainly)
>>
>> Suppose a JIRA has patch but it's a link to a file on a non-ASF machine from
>> someone who has not signed a xCLA.  The "Apache can use it" check box is
>> checked.
>>
>> Can this be accepted as-is, or should/must the contents be placed on the
>> JIRA?
>>
>> The 2 issues I see are
>>
>> 1/ that the link does not provide a proper record of the contents of the
>> file (the contents may change or disappear)
>>
>> 2/ it's not so clear the submitter has the rights to contribute (could be a
>> link to someone's content; it's hard to verify the ownership of link
>> content)
>>
>> When this happened to me, I asked the contributor to attach the patch, which
>> they kindly did (more a question to driving JIRA), but to be prepared for
>> next time, I wanted to check the situation.
>>
>> Unless there established practice, I'd not accept linked contributions
>> because of 1 and 2 not leaving a trail in JIRA.  The only exception might be
>> very large contributions - but if it's that large, then a software grant
>> would be clearer anyway.
>>
>>        Andy
>>
>



-- 
Ross Gardler (@rgardler)
Programme Leader (Open Development)
OpenDirective http://opendirective.com

Re: Query about patch submission by link

[Benson Margulies <bi...@gmail.com>]

I just asked legal-discuss this very question.
https://issues.apache.org/jira/browse/LEGAL-92. Since your JIRA is at
ASF, this should make it good to go.
.
On Sun, Jul 3, 2011 at 11:50 AM, Andy Seaborne
<an...@epimorphics.com> wrote:
> (mentors, mainly)
>
> Suppose a JIRA has patch but it's a link to a file on a non-ASF machine from
> someone who has not signed a xCLA.  The "Apache can use it" check box is
> checked.
>
> Can this be accepted as-is, or should/must the contents be placed on the
> JIRA?
>
> The 2 issues I see are
>
> 1/ that the link does not provide a proper record of the contents of the
> file (the contents may change or disappear)
>
> 2/ it's not so clear the submitter has the rights to contribute (could be a
> link to someone's content; it's hard to verify the ownership of link
> content)
>
> When this happened to me, I asked the contributor to attach the patch, which
> they kindly did (more a question to driving JIRA), but to be prepared for
> next time, I wanted to check the situation.
>
> Unless there established practice, I'd not accept linked contributions
> because of 1 and 2 not leaving a trail in JIRA.  The only exception might be
> very large contributions - but if it's that large, then a software grant
> would be clearer anyway.
>
>        Andy
>

Re: Query about patch submission by link

[Ross Gardler <rg...@opendirective.com>]

On 3 July 2011 16:50, Andy Seaborne <an...@epimorphics.com> wrote:
> (mentors, mainly)
>
> Suppose a JIRA has patch but it's a link to a file on a non-ASF machine from
> someone who has not signed a xCLA.  The "Apache can use it" check box is
> checked.
>
> Can this be accepted as-is, or should/must the contents be placed on the
> JIRA?

My answer is not authoritative on this one. If you want to get an
autoratative answer you need to ask on legal-discuss@apache.org My
answer is what I *think* they will say (but this is legal and thus
full of surprises).

I would say that no this is not acceptable. The problem, as I see it,
is that there can be no way of verifying that the person who submitted
the issue is the same person that uploaded the code to the third party
site. Consequently we cannot assume that they have the necessary
permissions to offer the code to the ASF.

Naturally it can be argued that an upload to JIRA doesn't provide
proof, but it does provide evidence that did everything we can
reasonably be expected to do in order to ensure the legitimacy of the
code.

In other words, I agree with your observations below.

Ross

> The 2 issues I see are
>
> 1/ that the link does not provide a proper record of the contents of the
> file (the contents may change or disappear)
>
> 2/ it's not so clear the submitter has the rights to contribute (could be a
> link to someone's content; it's hard to verify the ownership of link
> content)
>
> When this happened to me, I asked the contributor to attach the patch, which
> they kindly did (more a question to driving JIRA), but to be prepared for
> next time, I wanted to check the situation.
>
> Unless there established practice, I'd not accept linked contributions
> because of 1 and 2 not leaving a trail in JIRA.  The only exception might be
> very large contributions - but if it's that large, then a software grant
> would be clearer anyway.
>
>        Andy
>



-- 
Ross Gardler (@rgardler)
Programme Leader (Open Development)
OpenDirective http://opendirective.com

Re: Query about patch submission by link

[Bertrand Delacretaz <bd...@apache.org>]

Hi,

On Sun, Jul 3, 2011 at 3:50 PM, Andy Seaborne
<an...@epimorphics.com> wrote:
> ...Suppose a JIRA has patch but it's a link to a file on a non-ASF machine from
> someone who has not signed a xCLA.  The "Apache can use it" check box is
> checked.
>
> Can this be accepted as-is, or should/must the contents be placed on the
> JIRA?...

As you say, there's no guarantee that the file that you get when
clicking the link is the same as what the person who clicked the
"Apache can use it" box meant it to be.

In such a case I'd ask that person to attach the file in question to
JIRA directly, or, if it's not convenient provide an md5 digest of
that file in JIRA, to establish that this is what they mean to be
their contribution.

-Bertrand