[Idpy-board] Notes: idpy board call, 13 November 2017

Notes: 0. Agenda bash 1. Introductions     - Heather Flanagan     - Ivan Kanakarakis (SUNET, lead architect for Satosa, pySAML)     - Leif Johansson (SUNET)     - Roland Hedberg (independent, original developer and architect)     - Christos Kanellopoulos (GÉANT)     - Chris Whalen (individual contributor)     - Mike Jones (Director OIDF, author of OIDC and JWT and OAuth) 2. Governance documents     - https://github.com/IdentityPython/Governance 3. Discussing and possibly approving the use of Commons Conservancy as our IPR home     - https://drive.google.com/drive/folders/1h2mFQHGhJualJWTwtt-ivpkJvUZP960f?us… Why do we want an IPR home? Today, all the code is copyrighted at various organizations. If we want to have other organizations rely on it, it might help if the copyright notices are at an organization that is demonstrated to be neutral, not affiliated with any commercial interest, and hard to take over. We (probably) would need to reassign copyright to them. We also might want the ability to take donations and hire more developers. Ivan is on staff, paid for by GÉANT, but we might want additional resources at some point (e.g., students, developers, other). Commons Conservancy offers a separate service that supports the financial end of things, and while we don’t need that right now, we might in the future. Can the Conservancy defend IPR in court for a project? They have a network of volunteer lawyers who would be interested in taking on pro bono work. Note that it is really hard to bring a lawsuit for something based in The Netherlands. This is a difference between some of the Foundations out there (e.g., OIDF, Free Software Foundation, Linux Foundation). Note that organizations like Linux Foundation will charge a much higher overhead. The Apache Foundation leaves you locked to a specific license model. So, there are pros and cons for all the above. Donating money to Commons Conservancy/NLNet gets you some tax advantages. Note that Commons Conservancy hasn’t been around all that long, so some of their assertions re: “unlikely to be sued” might be naive. What is the relationship between IPR and the GEANT project? The default clause in the consortium agreement is that GEANT holds the IPR on behalf of the consortium. Need to see how that would play out if that means handing the IPR over to a third party. Action item for Christos to follow up on. Procedural note: board members need to have an opportunity to have their legal team(s) review anything that requires a signature. 4. The pros/cons for requiring a CLA (and possibly making a decision on that) An initial discussion around CLAs had taken place on the mailing list: https://lists.sunet.se/pipermail/idpy-discuss/2018-April/000146.html https://lists.sunet.se/pipermail/idpy-discuss/2018-June/000188.html and, the related discussion for the criteria for new projects: https://lists.sunet.se/pipermail/idpy-discuss/2018-February/000098.html Ivan: Given the current GitHub terms, we are probably covered. But the terms take place from a certain date; before that date all contributions made are under a different state. We need to figure out whether we want to bring these changes up to our current license agreements, and whether or not we’ll need CLAs for everyone from now on. Roland: When did the GitHub terms change? Need to verify. Leif: Originally was on the side of needing CLAs, but after reviewing the arguments, decided against it. This is more like the IETF Note Well. By being in the room and contributing, you’re acknowledging what you need to do. That’s slightly different than saying “can I commit this code/write this draft/be in this meeting” and having to bring this to a company lawyer that has no interest in understanding whether this is ok or not. Roland: Also not in the camp of doing CLAs. The sheer amount of work to track everyone down is very high. Leif: will need to do some background work - are there any contributions we’re unsure of? (e.g., if a project pulled in an external dependency that had an incompatible license). Perhaps we want to formulate our own Note Well/Terms of Service? Chris: what kind of guidance do organizations have for their employees? It varies significantly Mike: for contributing to Google projects and OIDF you have to sign CLAs. Leif: in some organizations, developers are explicitly kept away from lawyers. We should not put people into a situation where they have to bring lawyers into it. We should create something “here’s what we think you should have the right to do. If you don’t, go away.” Christos: There are two aspects here, one is about the past, one about the future. Leif: we have to do something for the past. Some sort of transfer of authority to Commons Conservancy. Ivan: Need to decide what to do with contributors for people who contributed before 2017; we have a list of who has contributed as a whole, just need to figure out which among those contributed before 2017. Christos: If we’re going to use something like Commons Conservancy, does this become their problem? No, because we have to transfer the license over to them. Action items: Determine list of contributors from before 2017 GitHub term changes; create a Note Well 5. review the criteria for bring in new projects to idpy     - https://github.com/IdentityPython/IdentityPython.github.io/wiki/Adding-and-… Practical use case: evolution of pyFF Holding topic to next call 6. Administrivia * Call frequency? More frequent calls to start; next call in 2-3 weeks * Publicly posted meeting agenda, meeting notes? Heather will post to the board mailing list; items that shouldn’t be public (which should be exceedingly rare) shouldn’t be noted. OK to make the mailing list archives. 7. AOB