Mozilla Foundation License Policy

[Benjamin Smedberg]

I saw that the Mozilla Foundation license policy was updated recently,
though I didn't see a post about it here or on mozilla.legal. I have a
question about the "Third Party Code" section and how it relates to
Mercurial repositories:

Users can host "personal" hg.mozilla.org repositories. Some of these are
clones of mozilla-central and follow the normal rules. But other
repositories may be clones of third-party code that we are modifying for
Mozilla or just for testing. See, e.g.

http://hg.mozilla.org/users/bsmedberg_mozilla.com/index.cgi/hg_templates/
http://hg.mozilla.org/users/bsmedberg_mozilla.com/index.cgi/mercurial-crew-patches/

Which are both clones or patches of Mercurial, which is GPL.

I think we should make it clear that you can put up clones of projects under
any open-source license (OSI-approved) on hg.mozilla.org as long as that
code is not going to end up in mozilla-central.

--BDS

[Gervase Markham]

Benjamin Smedberg wrote:
> I saw that the Mozilla Foundation license policy was updated recently,
> though I didn't see a post about it here or on mozilla.legal.

Yes, I'm sorry, I should have done that.

> I think we should make it clear that you can put up clones of projects
> under any open-source license (OSI-approved) on hg.mozilla.org as long
> as that code is not going to end up in mozilla-central.

Acceptable Licenses, section 4 says:

"For Third Party Code, you should use the license pertaining to that
code when modifying it or adding new files to it, and the tri-license
when adding Mozilla-specific files such as build system files. See below
for a list of directories this applies to."

Does that not cover this situation?

I agree that section 5 says:

"All Product Code must be under either the tri-license or, for Third
Party Product Code, a license compatible with all three sets of terms in
the tri-license. The purpose of this rule is to make sure that users of
our code can take and use the same code under any one of the three
licenses; no group is disadvantaged."

but if this code is not Product Code (which is roughly the same thing as
"not being in mozilla-central"), then there is no problem.

Gerv

[Benjamin Smedberg]

Gervase Markham wrote:

> Acceptable Licenses, section 4 says:
>
> "For Third Party Code, you should use the license pertaining to that
> code when modifying it or adding new files to it, and the tri-license
> when adding Mozilla-specific files such as build system files. See below
> for a list of directories this applies to."
>
> Does that not cover this situation?

So... I've cloned Mercurial code onto hg.mozilla.org. It's not listed on the
license policy, and talking about a "list of directories" doesn't make
sense: that list of directories only really applies to mozilla-central or CVS.

It's certainly not clear to me from the document that I may clone random
open-source code to hg.mozilla.org without somehow getting that code listed
in the list-of-directories... although I think in practice it's fine.

--BDS

[Gervase Markham]

Benjamin Smedberg wrote:
> It's not listed on
> the license policy, and talking about a "list of directories" doesn't
> make sense: that list of directories only really applies to
> mozilla-central or CVS.

Yes, indeed. It seems that technology has overtaken us again.

> It's certainly not clear to me from the document that I may clone random
> open-source code to hg.mozilla.org without somehow getting that code
> listed in the list-of-directories... although I think in practice it's
> fine.

Yes, in practice it's fine. But you are right that the policy should
cover this situation.

We need to separate policy and permission. Exactly how one obtains
permission to store third party code on our server is out of scope of
the policy. But once it's there, it should be covered as any other third
party code. Does that seem sensible?

Gerv

[Benjamin Smedberg]

Gervase Markham wrote:

>> It's certainly not clear to me from the document that I may clone random
>> open-source code to hg.mozilla.org without somehow getting that code
>> listed in the list-of-directories... although I think in practice it's
>> fine.
>
> Yes, in practice it's fine. But you are right that the policy should
> cover this situation.
>
> We need to separate policy and permission. Exactly how one obtains
> permission to store third party code on our server is out of scope of
> the policy. But once it's there, it should be covered as any other third
> party code. Does that seem sensible?

Yes

--BDS

[Gervase Markham]

Benjamin Smedberg wrote:
> Yes

OK. Working on it.

Gerv