License and contribution question

[Martin d'Anjou]

Hello,

I was in the process of getting approval from my employer to contribute to ANTLR, but the legal department came back saying the following clause is too broad:

"Although the BSD license itself excludes all liabilities, the certificate of origin that must be signed by the contributor contains an indemnification clause which is drafted using very broad language:

 

	If I violate another’s rights, liability lies with me.  I agree to    defend, indemnify, and hold The ANTLR Project and ANTLR users
	harmless from any claim or demand, including reasonable attorney
	fees, made by any third party due to or arising out of my violation
	of these terms and conditions or my violation of the rights of
	another person or entity.

 

“Violate another’s rights” could mean anything (copyright, patent, etc.). "

My legal department also says:

"In reality, this clause is likely meant to ensure that Contributors who are contributing their employer’s IP are doing so with appropriate approval to do so, but what is written goes far beyond that.  Unless you are able to obtain written confirmation from this project’s owner that the intent of this indemnification language is solely limited to protecting against the inappropriate contribution of your employer’s IP, and is absolutely not meant to provide a broad indemnification to the community on the code you contribute, the request to contribute to ANTLR has to be denied."

So my question to the current project owner(s): can you please clarify or restrict the scope of this indemnification clause?

Best Regards,

Martin d'Anjou

[Mike Lischke]

Hi Martin,

You should probably directly contact Terence Parr <pa...@cs.usfca.edu> (who owns ANTLR4) to discuss this issue.

Mike
-- 
www.soft-gems.net

[Terence Parr]

yeah, sorry about that. contributing and using licenses are different. after all the lawsuits etc… my attorney helped me draft that nasty language :(

Ter

[Martin d'Anjou]

Ouch, that's too bad.

I see this in the license on line 20:

"IN NO EVENT SHALL THE AUTHOR BE LIABLE ..."

Any particular reason you are using BSD 3-clause license instead of BSD 2-clause license which has:

"IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE ..."

Or another license which would protect the contributors as well as the author?

Martin

On Wednesday, February 5, 2020 at 1:43:36 PM UTC-5, the_antlr_guy wrote:

yeah, sorry about that. contributing and using licenses are different. after all the lawsuits etc… my attorney helped me draft that nasty language :(

Ter

[Martin d'Anjou]

Actually, there is confusion. Antlr's "3-clause BSD license" is not the same as the 3-clause BSD as found on the OSI website.

This commit is where the 3rd clause was added to the Antlr license, but the body of the license below the clauses was not changed to reflect the 3-clause BSD license:

https://github.com/antlr/antlr4/commit/891915de846d39c17b8357a17a7a8626a2869dfc

The differences are:

--- a/LICENSE.txt
+++ b/LICENSE.txt
@@ -14,10 +14,10 @@ are met:
     may be used to endorse or promote products derived from this software
     without specific prior written permission.
 
-THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
 IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

Antlr has a BSD-like license, but it's not BSD. Is this the intent? If so, perhaps the name at the top of the license should be changed.

Would adopting the real BSD license, which protects authors and contributors from liability, remove the need for clause 3 in the certificate of origin?

Martin

[the_antlr_guy]

Well, I can't change anything now I don't think w/o making it worse, but remember there were multiple licenses floating around for years before things started to solidify. I'm sure I copied this from somewhere 2+ decades ago.  The intent is BSD but it sounds like they updated the license.