Guidance needed for copyright headers

[sudo-bmitch]

Across the various OCI projects, we have inconsistency in the copyright headers. Some files are missing headers, and it's not clear which files need a copyright/licensing header (e.g. whether they are needed for the markdown specifications or the GitHub actions yaml). Where we do have the headers, some copyright assignments go to "Linux Foundation", others to "OCI Contributors", and we recently added "Contributors to the Open Containers Distribution Specification". When projects were donated to OCI, the original copyright owner is listed, but no new copyright was added for OCI contributions.

I'm hoping to get guidance from LF legal on how to proceed. And I'm opening this as an issue to track that request (this PR comment is too likely to get lost).

[sudo-bmitch]

@caniszczyk @jorydotcom would you forward to the appropriate party?

[caniszczyk]

You can simply use this guidance which works for the LF at a minimum:

https://github.com/cncf/foundation/blob/main/copyright-notices.md

So something like "Copyright The Open Container Initiative Authors"

So I recommend just keep it simple without dates or extra information

[sudo-bmitch]

@opencontainers/tob is this something we should document for all OCI specs and projects to follow?

[mikebrow]

I vote in the affirmative.

[samuelkarp]

@sudo-bmitch A PR to https://github.com/opencontainers/project-template would be appropriate.

We don't quite have a functional TOB right now until #148.

[cyphar]

I agree, and we probably also want to include SPDX license lines as well. I have a general preference for block comments, though I don't really like the "Copyright (C) ... foo Contributors" thing to be honest (it makes the copyrights too vague).

[sudo-bmitch]

I don't really like the "Copyright (C) ... foo Contributors" thing to be honest (it makes the copyrights too vague).

Do you have a proposed alternative that would be feasible to maintain? Trying to keep track of who wrote each line of code seems like something best left up to the VCS. And even with that, it's not clear that the individual owns the copyright themselves, vs their company or derived from a compatible OSS project. And I'd rather have a vague copyright line than no line at all.

[mikebrow]

The line by itself is intentionally vague, but done with tradition for decades. The DCO explanation and signature requirements in each commit header are not vague or anonymous and thus explain how it all maps with the authors/contributors line.

[cyphar]

Do you have a proposed alternative that would be feasible to maintain?

I would say that something like:

• The first creator of a file can put their copyright line they feel is appropriate. If they want to just put the generic one, that is fine too.
• Anyone who makes substantial changes (say, >25% of the file changed) can put their own copyright line if they wish.
• Include the fallback "Copyright (C) foo Contributors" line at the end as a catch-all.

should be fine for both maintainers and contributors -- for most people (that don't care) then it's the same as just having the generic line. I'm not proposing that it be required but that it still be reasonably encouraged for significant contributors to list their copyrights in the file. Big projects like Linux used to get contributions where people would submit small patches to get credits, but I don't think that's a super realistic thing to worry about.

And even with that, it's not clear that the individual owns the copyright themselves, vs their company or derived from a compatible OSS project.

By using the DCO for our project we are already trusting the author to be able to answer that question.

For the case of code derived from another project, it would also be equally incorrect to say "Copyright (C) foo Contributors" (though in the case of files copied wholesale you would legally need to keep the old notices anyway and so you would only be appending the "Copyright (C) foo Contributors" line). When I've done this in the past, I spend some time making sure that I properly credit the original code's source, license, and copyrights.

Trying to keep track of who wrote each line of code seems like something best left up to the VCS.

Source code is shared very often without VCS data (all distros just provide source tree archives, so you could even argue that most code sharing is done without VCS data), and it seems that there is general agreement that even the GPL does not require that you provide VCS logs for the Corresponding Source. While it is somewhat less common with Go projects, people do copy around individual files to other projects -- meaning that no VCS data could be used to reconstruct the copyrights.

And I'd rather have a vague copyright line than no line at all.

I agree.

The line by itself is intentionally vague, but done with tradition for decades.

I think this is somewhat debatable -- from my personal experience, I've tended to see these kinds of vague statements far more in modern large-community codebases. Older codebases would list companies or organisations as copyright holders. My understanding is that the feeling of what level of notice is necessary for copyright licenses to apply have loosened over time in software lawyer circles.

[sudo-bmitch]

I'm not proposing that it be required but that it still be reasonably encouraged for significant contributors to list their copyrights in the file.

I'd prefer the MAY rather than SHOULD side of the line here. If someone makes a major contribution to a file and specifically wants to include their copyright line, they may add their own copyright entry. But in every file we have the default "Copyright the OCI Contributors" as the first, and preferably only, copyright line.

Edit: This also follows the CNCF guidance that anyone may add their copyright if they really want to, but it's not something they recommend as the default: https://github.com/cncf/foundation/blob/main/copyright-notices.md#what-if-i-want-my-copyright-notice-included

My concern is that people see a list of entries and submit low quality/minor changes to get themselves listed, without reading our contributor guidance on when it should be added. That puts the maintainers in the awkward position to telling contributors that we don't feel their contribution is worthy of an additional copyright line.

[samuelkarp]

Per today's TOB meeting, the consensus was to follow the LF guidance: https://www.linuxfoundation.org/blog/blog/copyright-notices-in-open-source-software-projects.