You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@pekko.apache.org by Johannes Rudolph <jo...@gmail.com> on 2023/02/23 10:26:19 UTC
Contributor's PRs vs CLAs
Hi all,
how is the process handled of getting CLAs for non-committers for PRs?
It seems Apache Flink and Apache Kafka both don't have any
documentation on the necessity of getting these first.
https://flink.apache.org/contributing/how-to-contribute.html
https://cwiki.apache.org/confluence/display/KAFKA/Contributing+Code+Changes
On the other hand,
https://www.apache.org/licenses/contributor-agreements.html seems
pretty clear on requiring CLAs for any kind of contribution.
We are now in the uncomfortable position not being able to go ahead
with a somewhat trivial (66 lines added and 2000+ deleted) but
important PR (https://github.com/apache/incubator-pekko-http/pull/14)
because it was contributed by a non-committer without an ICLA on file.
How can we deal with this issue? Because if the contributor does not
file a CLA, we will have to recommit the exact same PR but with
another author because it is so trivial.
A few questions come up:
* What exactly is the process to onboard contributors and how is that
dealt with in other projects?
* How can we prevent a situation like this, ideally, we would not
allow PRs from contributors not having signed a CLA?
* Where is the file / API to look up if a certain Github user has
already filed a CLA? How can we automate checking if a certain user
has filed a CLA?
I see we are getting a copy of the filing acknowledgement to the
private mailing list but these answers are quite unstructured and we
don't have any way of safely associating such an acknowledgement with
a Github user id.
Johannes
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pekko.apache.org
For additional commands, e-mail: dev-help@pekko.apache.org
Re: Contributor's PRs vs CLAs
Posted by Jean-Luc Deprez <Je...@gmail.com>.
On a mildly related subject. (and discussions in the vicinity in my inbox)
Was the logo CLA covered?
On Wed, Mar 1, 2023 at 6:47 AM Hen <ba...@apache.org> wrote:
> On Mon, Feb 27, 2023 at 5:14 AM Johannes Rudolph <
> johannes.rudolph@gmail.com>
> wrote:
>
> >
> > Now, for Pekko, we must keep in mind that probably 99% of all current
> > code is *not* covered by a CLA right now. So, looking at each single
> > case of a contribution, whether we have a CLA on file or not seems to
> > matter only a little. Therefore, I would suggest to set the barrier to
> > require a CLA for contributions really high for practical purposes,
> > i.e. only for significant features or new submodules added. In
> > particular, we would not by default require a CLA for contributions
> > that change existing code (regardless of the size of the change or how
> > many files have been added or removed).
> >
>
> Another way I like to look at this is as a recruitment pipeline.
>
> Typically one of the mistakes I see projects making is setting such a high
> bar to becoming a committer that it involves somehow hanging around and
> picking up a whole chunk of project knowledge before they are basically
> acting as committers, despite the lack of permissions allowing them to do
> so. It's a grind. Those contributions that you get and think "should we
> have an ICLA here?" really ought to be "wow, they just passed the first
> interview. How do we turn this individual into a committer". And as all
> committers must sign ICLAs, the problem generally works itself out.
>
> The time to think ICLA (or Software Grant of License) is when you get a
> first-interview-worthy contribution and think "This isn't a future
> committer situation"; for whatever completely fine reason it's that way.
>
> Hen
>
Re: Contributor's PRs vs CLAs
Posted by Hen <ba...@apache.org>.
On Mon, Feb 27, 2023 at 5:14 AM Johannes Rudolph <jo...@gmail.com>
wrote:
>
> Now, for Pekko, we must keep in mind that probably 99% of all current
> code is *not* covered by a CLA right now. So, looking at each single
> case of a contribution, whether we have a CLA on file or not seems to
> matter only a little. Therefore, I would suggest to set the barrier to
> require a CLA for contributions really high for practical purposes,
> i.e. only for significant features or new submodules added. In
> particular, we would not by default require a CLA for contributions
> that change existing code (regardless of the size of the change or how
> many files have been added or removed).
>
Another way I like to look at this is as a recruitment pipeline.
Typically one of the mistakes I see projects making is setting such a high
bar to becoming a committer that it involves somehow hanging around and
picking up a whole chunk of project knowledge before they are basically
acting as committers, despite the lack of permissions allowing them to do
so. It's a grind. Those contributions that you get and think "should we
have an ICLA here?" really ought to be "wow, they just passed the first
interview. How do we turn this individual into a committer". And as all
committers must sign ICLAs, the problem generally works itself out.
The time to think ICLA (or Software Grant of License) is when you get a
first-interview-worthy contribution and think "This isn't a future
committer situation"; for whatever completely fine reason it's that way.
Hen
Re: Contributor's PRs vs CLAs
Posted by Johannes Rudolph <jo...@gmail.com>.
On Fri, Feb 24, 2023 at 10:40 PM Hen <ba...@apache.org> wrote:
> Yup - though that subjectivity comes from copyright law rather than the
> ASF.
I mostly agree with what you wrote, Hen.
IANAL but as I understand it that the subjective parts may be more
important for the direct copyright issue and not necessarily for
requiring the CLA in the same way.
I guess the ambiguity comes from "Typically, a work must meet minimal
standards of originality"
(https://en.wikipedia.org/wiki/Copyright#Eligible_works) which seems
to be the case for many jurisdictions. So, for contributions that
don't get over that threshold, there's some ambiguity about how to
treat them.
However, it seems it might not matter a lot for Apache, and even less
for Pekko. Because for a contribution to an Open Source project we can
usually assume that the contribution is covered by the license of the
project (as others have mentioned before). So, the copyright case
itself (i.e. Apache having enough of a license to distribute and build
on the contribution) should be adequately covered in all cases.
Regarding the CLA, Apache states this as the purpose of the CLA:
https://www.apache.org/licenses/contributor-agreements.html:
> The purpose of this agreement is to clearly define the terms under which intellectual property has been contributed to the ASF and thereby allow us to defend the project should there be a legal dispute regarding the software.
So, it seems to be on one hand another layer of protection that a
contribution indeed was contributed under the terms of the APL. On the
other hand, it gives Apache a better handle to defend projects against
misuse (I don't know if that has ever happened). The more code is
covered by contributions under a CLA, the more material Apache can use
to defend against misuse (my own naive interpretation).
Now, for Pekko, we must keep in mind that probably 99% of all current
code is *not* covered by a CLA right now. So, looking at each single
case of a contribution, whether we have a CLA on file or not seems to
matter only a little. Therefore, I would suggest to set the barrier to
require a CLA for contributions really high for practical purposes,
i.e. only for significant features or new submodules added. In
particular, we would not by default require a CLA for contributions
that change existing code (regardless of the size of the change or how
many files have been added or removed).
Johannes
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pekko.apache.org
For additional commands, e-mail: dev-help@pekko.apache.org
Re: Contributor's PRs vs CLAs
Posted by Hen <ba...@apache.org>.
Yup - though that subjectivity comes from copyright law rather than the
ASF. Here's my attempt at a simpler flowchart than the JIRA issue really
provides:
Non-subjective:
* Any contribution to an Apache-2.0 licensed file made back to our projects
is under Apache-2.0 unless the contributor says otherwise (in which case,
flag it). Note that GitHub's terms also reinforce that if the contribution
is being made on GitHub.
* Committers must sign ICLAs.
Simple, not very subjective, rule:
* Submitting new files not based on an existing ASF project file require an
ICLA.
Subjective modifier to that:
* Not needed if we're talking about a very simple new file.
Hen
On Thu, Feb 23, 2023 at 4:18 AM Matthew Benedict de Detrich
<ma...@aiven.io.invalid> wrote:
> My understanding is also the same, i.e. if a change is considered complex
> then an ICLA is required. The problem is that the definition of complex can
> be considered largely subjective and falls under the "common sense"
> mentality.
>
> On Thu, Feb 23, 2023 at 12:53 PM Claude Warren, Jr
> <cl...@aiven.io.invalid> wrote:
>
> > For something like this, where you have a few lines of code to fix a bug
> a
> > ICLA is not required. If someone is contributing a fix/change that is
> > "complex" then an ICLA is recommended. If they are contributing a new
> > package or extension and ICLA is required.
> >
> > On Thu, Feb 23, 2023 at 11:16 AM Johannes Rudolph <
> > johannes.rudolph@gmail.com> wrote:
> >
> > > Relevant JIRA issue: https://issues.apache.org/jira/browse/LEGAL-615
> > > (which in summary is about as confused as I am :))
> > >
> > > On Thu, Feb 23, 2023 at 12:09 PM Johannes Rudolph
> > > <jo...@gmail.com> wrote:
> > > >
> > > > Echoing PJ's relevant response at
> > > > https://github.com/apache/incubator-pekko-http/pull/14
> > > >
> > > > > In practice, ASF projects don't collect CLAs from every user who
> > > submits a PR. There is no magic criterion for what makes a PR
> significant
> > > enough to require one but the PR changes 70 files, even if the changes
> > are
> > > not very large.
> > > >
> > > > It's hard to gather relevant information here. As stated above the
> > > > Apache site linked prominently on the Apache website says that a CLA
> > > > is required for any kind of contribution in very clear language:
> > > >
> > > > > All contributors of ideas, code, or documentation to any Apache
> > > projects must complete, sign, and submit via email an Individual
> > > Contributor License Agreement (ICLA).
> > > >
> > > > On the other hand Roy Fielding himself said this in
> > > > https://lists.apache.org/thread/0mytpqj7too29bj90yz65rggdv7gd35d:
> > > >
> > > > > Again, there is no such requirement for commits/pushes at Apache.
> > > > > The person responsible for moving the bits into our repository
> > > > > is responsible for verifying that they have the right to do so
> > > > > before the push is made. The authors do not need to have a CLA
> > > > > on file even if the contribution is massive -- CLAs are only
> > > > > required for the people who want an account at Apache and thus
> > > > > are allowed to make the decision to push those bits into our
> > > > > repository.
> > > >
> > > > Which says almost exactly the opposite, in fact, that no
> non-committer
> > > > contribution ever needs a CLA. Is that thinking outdated by now?
> > > >
> > > > Searching through the Flink and Kafka Github repos it seems that the
> > > > topic has almost never come up in a PR (low single digit number of
> > > > total occurrences, though you cannot trust Github search). Where it
> > > > came up, mostly when complete modules where contributed.
> > > >
> > > > I tend to get the impression that we should *not* require a CLA in
> > > > general from external contributors but (in spirit of what Roy
> Fielding
> > > > wrote) we might want to add a section to the PR template that makes
> it
> > > > clear that a contribution was done under the terms of the APL2.
> > > >
> > > > Johannes
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: dev-unsubscribe@pekko.apache.org
> > > For additional commands, e-mail: dev-help@pekko.apache.org
> > >
> > >
> >
>
>
> --
>
> Matthew de Detrich
>
> *Aiven Deutschland GmbH*
>
> Immanuelkirchstraße 26, 10405 Berlin
>
> Amtsgericht Charlottenburg, HRB 209739 B
>
> Geschäftsführer: Oskari Saarenmaa & Hannu Valtonen
>
> *m:* +491603708037
>
> *w:* aiven.io *e:* matthew.dedetrich@aiven.io
>
Re: Contributor's PRs vs CLAs
Posted by Matthew Benedict de Detrich <ma...@aiven.io.INVALID>.
My understanding is also the same, i.e. if a change is considered complex
then an ICLA is required. The problem is that the definition of complex can
be considered largely subjective and falls under the "common sense"
mentality.
On Thu, Feb 23, 2023 at 12:53 PM Claude Warren, Jr
<cl...@aiven.io.invalid> wrote:
> For something like this, where you have a few lines of code to fix a bug a
> ICLA is not required. If someone is contributing a fix/change that is
> "complex" then an ICLA is recommended. If they are contributing a new
> package or extension and ICLA is required.
>
> On Thu, Feb 23, 2023 at 11:16 AM Johannes Rudolph <
> johannes.rudolph@gmail.com> wrote:
>
> > Relevant JIRA issue: https://issues.apache.org/jira/browse/LEGAL-615
> > (which in summary is about as confused as I am :))
> >
> > On Thu, Feb 23, 2023 at 12:09 PM Johannes Rudolph
> > <jo...@gmail.com> wrote:
> > >
> > > Echoing PJ's relevant response at
> > > https://github.com/apache/incubator-pekko-http/pull/14
> > >
> > > > In practice, ASF projects don't collect CLAs from every user who
> > submits a PR. There is no magic criterion for what makes a PR significant
> > enough to require one but the PR changes 70 files, even if the changes
> are
> > not very large.
> > >
> > > It's hard to gather relevant information here. As stated above the
> > > Apache site linked prominently on the Apache website says that a CLA
> > > is required for any kind of contribution in very clear language:
> > >
> > > > All contributors of ideas, code, or documentation to any Apache
> > projects must complete, sign, and submit via email an Individual
> > Contributor License Agreement (ICLA).
> > >
> > > On the other hand Roy Fielding himself said this in
> > > https://lists.apache.org/thread/0mytpqj7too29bj90yz65rggdv7gd35d:
> > >
> > > > Again, there is no such requirement for commits/pushes at Apache.
> > > > The person responsible for moving the bits into our repository
> > > > is responsible for verifying that they have the right to do so
> > > > before the push is made. The authors do not need to have a CLA
> > > > on file even if the contribution is massive -- CLAs are only
> > > > required for the people who want an account at Apache and thus
> > > > are allowed to make the decision to push those bits into our
> > > > repository.
> > >
> > > Which says almost exactly the opposite, in fact, that no non-committer
> > > contribution ever needs a CLA. Is that thinking outdated by now?
> > >
> > > Searching through the Flink and Kafka Github repos it seems that the
> > > topic has almost never come up in a PR (low single digit number of
> > > total occurrences, though you cannot trust Github search). Where it
> > > came up, mostly when complete modules where contributed.
> > >
> > > I tend to get the impression that we should *not* require a CLA in
> > > general from external contributors but (in spirit of what Roy Fielding
> > > wrote) we might want to add a section to the PR template that makes it
> > > clear that a contribution was done under the terms of the APL2.
> > >
> > > Johannes
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@pekko.apache.org
> > For additional commands, e-mail: dev-help@pekko.apache.org
> >
> >
>
--
Matthew de Detrich
*Aiven Deutschland GmbH*
Immanuelkirchstraße 26, 10405 Berlin
Amtsgericht Charlottenburg, HRB 209739 B
Geschäftsführer: Oskari Saarenmaa & Hannu Valtonen
*m:* +491603708037
*w:* aiven.io *e:* matthew.dedetrich@aiven.io
Re: Contributor's PRs vs CLAs
Posted by "Claude Warren, Jr" <cl...@aiven.io.INVALID>.
For something like this, where you have a few lines of code to fix a bug a
ICLA is not required. If someone is contributing a fix/change that is
"complex" then an ICLA is recommended. If they are contributing a new
package or extension and ICLA is required.
On Thu, Feb 23, 2023 at 11:16 AM Johannes Rudolph <
johannes.rudolph@gmail.com> wrote:
> Relevant JIRA issue: https://issues.apache.org/jira/browse/LEGAL-615
> (which in summary is about as confused as I am :))
>
> On Thu, Feb 23, 2023 at 12:09 PM Johannes Rudolph
> <jo...@gmail.com> wrote:
> >
> > Echoing PJ's relevant response at
> > https://github.com/apache/incubator-pekko-http/pull/14
> >
> > > In practice, ASF projects don't collect CLAs from every user who
> submits a PR. There is no magic criterion for what makes a PR significant
> enough to require one but the PR changes 70 files, even if the changes are
> not very large.
> >
> > It's hard to gather relevant information here. As stated above the
> > Apache site linked prominently on the Apache website says that a CLA
> > is required for any kind of contribution in very clear language:
> >
> > > All contributors of ideas, code, or documentation to any Apache
> projects must complete, sign, and submit via email an Individual
> Contributor License Agreement (ICLA).
> >
> > On the other hand Roy Fielding himself said this in
> > https://lists.apache.org/thread/0mytpqj7too29bj90yz65rggdv7gd35d:
> >
> > > Again, there is no such requirement for commits/pushes at Apache.
> > > The person responsible for moving the bits into our repository
> > > is responsible for verifying that they have the right to do so
> > > before the push is made. The authors do not need to have a CLA
> > > on file even if the contribution is massive -- CLAs are only
> > > required for the people who want an account at Apache and thus
> > > are allowed to make the decision to push those bits into our
> > > repository.
> >
> > Which says almost exactly the opposite, in fact, that no non-committer
> > contribution ever needs a CLA. Is that thinking outdated by now?
> >
> > Searching through the Flink and Kafka Github repos it seems that the
> > topic has almost never come up in a PR (low single digit number of
> > total occurrences, though you cannot trust Github search). Where it
> > came up, mostly when complete modules where contributed.
> >
> > I tend to get the impression that we should *not* require a CLA in
> > general from external contributors but (in spirit of what Roy Fielding
> > wrote) we might want to add a section to the PR template that makes it
> > clear that a contribution was done under the terms of the APL2.
> >
> > Johannes
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@pekko.apache.org
> For additional commands, e-mail: dev-help@pekko.apache.org
>
>
Re: Contributor's PRs vs CLAs
Posted by Johannes Rudolph <jo...@gmail.com>.
Relevant JIRA issue: https://issues.apache.org/jira/browse/LEGAL-615
(which in summary is about as confused as I am :))
On Thu, Feb 23, 2023 at 12:09 PM Johannes Rudolph
<jo...@gmail.com> wrote:
>
> Echoing PJ's relevant response at
> https://github.com/apache/incubator-pekko-http/pull/14
>
> > In practice, ASF projects don't collect CLAs from every user who submits a PR. There is no magic criterion for what makes a PR significant enough to require one but the PR changes 70 files, even if the changes are not very large.
>
> It's hard to gather relevant information here. As stated above the
> Apache site linked prominently on the Apache website says that a CLA
> is required for any kind of contribution in very clear language:
>
> > All contributors of ideas, code, or documentation to any Apache projects must complete, sign, and submit via email an Individual Contributor License Agreement (ICLA).
>
> On the other hand Roy Fielding himself said this in
> https://lists.apache.org/thread/0mytpqj7too29bj90yz65rggdv7gd35d:
>
> > Again, there is no such requirement for commits/pushes at Apache.
> > The person responsible for moving the bits into our repository
> > is responsible for verifying that they have the right to do so
> > before the push is made. The authors do not need to have a CLA
> > on file even if the contribution is massive -- CLAs are only
> > required for the people who want an account at Apache and thus
> > are allowed to make the decision to push those bits into our
> > repository.
>
> Which says almost exactly the opposite, in fact, that no non-committer
> contribution ever needs a CLA. Is that thinking outdated by now?
>
> Searching through the Flink and Kafka Github repos it seems that the
> topic has almost never come up in a PR (low single digit number of
> total occurrences, though you cannot trust Github search). Where it
> came up, mostly when complete modules where contributed.
>
> I tend to get the impression that we should *not* require a CLA in
> general from external contributors but (in spirit of what Roy Fielding
> wrote) we might want to add a section to the PR template that makes it
> clear that a contribution was done under the terms of the APL2.
>
> Johannes
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pekko.apache.org
For additional commands, e-mail: dev-help@pekko.apache.org
Re: Contributor's PRs vs CLAs
Posted by Johannes Rudolph <jo...@gmail.com>.
Echoing PJ's relevant response at
https://github.com/apache/incubator-pekko-http/pull/14
> In practice, ASF projects don't collect CLAs from every user who submits a PR. There is no magic criterion for what makes a PR significant enough to require one but the PR changes 70 files, even if the changes are not very large.
It's hard to gather relevant information here. As stated above the
Apache site linked prominently on the Apache website says that a CLA
is required for any kind of contribution in very clear language:
> All contributors of ideas, code, or documentation to any Apache projects must complete, sign, and submit via email an Individual Contributor License Agreement (ICLA).
On the other hand Roy Fielding himself said this in
https://lists.apache.org/thread/0mytpqj7too29bj90yz65rggdv7gd35d:
> Again, there is no such requirement for commits/pushes at Apache.
> The person responsible for moving the bits into our repository
> is responsible for verifying that they have the right to do so
> before the push is made. The authors do not need to have a CLA
> on file even if the contribution is massive -- CLAs are only
> required for the people who want an account at Apache and thus
> are allowed to make the decision to push those bits into our
> repository.
Which says almost exactly the opposite, in fact, that no non-committer
contribution ever needs a CLA. Is that thinking outdated by now?
Searching through the Flink and Kafka Github repos it seems that the
topic has almost never come up in a PR (low single digit number of
total occurrences, though you cannot trust Github search). Where it
came up, mostly when complete modules where contributed.
I tend to get the impression that we should *not* require a CLA in
general from external contributors but (in spirit of what Roy Fielding
wrote) we might want to add a section to the PR template that makes it
clear that a contribution was done under the terms of the APL2.
Johannes
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pekko.apache.org
For additional commands, e-mail: dev-help@pekko.apache.org