Oli Warner About Contact Oli on Twitter Subscribe

Why does Ubuntu need the Canonical Contributor Agreement?

Thursday, 28 July 2011 canonical ubuntu

Let’s say you want to improve Ubuntu by contributing a patch but if that project is covered by the Canonical Contributor Agreement, you’ll need to sign over some of your rights. People have been arguing about this for a while now but why does Canonical need it in the first place?

Several very important core components in Ubuntu are covered by the Canonical Contributor Agreement. These are Canonical-owned projects and include major items like Bzr, Upstart, indicator-applet and desktop-couch, to name but a few. A full list can be seen on the Contributor Agreement page.

The natural inference from this page is Canonical won’t accept any contribution into their projects without you signing their Contributor Agreement.

In this post, I’m trying to better understand what the Contributor Agreement does but I also have some questions that I really don’t have satisfactory answers to. If you can answer them, I’d really like to hear from you.

So what does the Contributor Agreement actually do?

Searching for the reason why an agreement is needed, I turned first to the FAQ but only found airy language like:

We need to make sure we and our users are legally entitled to distribute software that includes your contributed code, in a way that will hold for all end-users, wherever in the world they might be.

What sort of wishy washy guff is this? This is exactly what the GNU General Public License is for. Most of the software in Ubuntu is in there under the GPL. It is the keystone that the entire Linux community is built upon… So why isn’t the GPL good enough for Canonical?

In writing this I’ve read through Mark Shuttleworth’s account on the old copyright assignment that Canonical used to use until recently. He seems to claim that contributing without assignment is like giving a gift with no trust and with heavy strings attached, and that doing so is anti-social. I think this is frankly insulting. Canonical publishes these projects under GPL (opposed to a more permissive license like MIT) because you can’t trust everybody. GPL exists to force things to remain free. It’s a bit hypocritical to suggest that would-be contributors are the anti-social ones when it’s Canonical who want the ability to change licenses.

Next I turned to the Agreement itself. I’m not a lawyer so my conclusions might be wrong. Let me know if they are.

(b) To the maximum extent permitted by the relevant law, You grant to Us a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license under the Copyright covering the Contribution, with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform and distribute the Contribution as part of the Material; provided that this license is conditioned upon compliance with Section 2.3.

To me that translates as “You give Canonical the right to do anything they like with your contribution, regardless of how you otherwise license it.”

Section 2.2 does something similar for patents. If you contribution uses one of your patents, you give Canonical the right to use it and sub-license its use. I hate software patents so I’m not bothered with people essentially breaking their own patents on the rocks of Canonical’s Contributor Agreement.

But the worst part comes as a confirmation of my previous estimation of 2.1(b):

2.3 Outbound License

Based on the grant of rights in Sections 2.1 and 2.2, if We include Your Contribution in a Material, We may license the Contribution under any license, including copyleft, permissive, commercial, or proprietary licenses. As a condition on the exercise of this right, We agree to also license the Contribution under the terms of the license or licenses which We are using for the Material on the Submission Date.

Canonical can multi-license your contribution whenever they like without any say from you. Note that this isn’t just non-free (eg them selling it); they can make your work public domain, completely neutering any copyright you hold on it.

You give Canonical the right to do anything with your contributions. You have no say in its future.

One important update to it this month is it stops short of actually transferring the entire copyright to Canonical, also known as copyright assignment, where you lose all rights to a work.

So I would still own the copyright? What’s wrong then?

Well, yes and that is a major improvement… But as above, it’s rather toothless. Canonical, without any reprieve from you can re-license your work as they want to.

If, for example, you believe the GPL is the right level of free for the world (free as long users make their changes similarly free), you might lose out here. Ubuntu can

I’m highlighting the worst cases because these are the rights that Canonical demand if you want to improve one of Canonical’s open source applications.

How does this work with downstream distributions? What happens to contributions outside the Contributor Agreement? Does the Contributor Agreement hurt projects?

Well let’s imagine that another distribution wants to use something from Ubuntu. They can change it and publish those changes under the same license.

For the sake of example, let’s say their community improves how Upstart works to halve the time it takes to boot up the system. Assuming the developers responsible have no interest in signing the Canonical Contributor Agreement, what does the project maintainer at Canonical do?

Given how much effort Canonical has spent on getting people to sign the Contributor Agreement, one of the first two seem most likely. These both protect Canonical’s licensing flexibility but both hurt (directly and indirectly, respectively) the progress of these projects… and hurt Ubuntu.

If they do “taint” the codebase with non-CCA’d code, why force everybody else to go through this process?

What if I want to contribute to one of these projects in Ubuntu but can’t or wont sign the Contributor Agreement?

Well assuming Canonical won’t taint their projects, you can’t contribute. Not directly to a Canonical Contributor Agreement -based project. You can contribute to forks and to downstream versions (technically forks).

It’s not a good situation where the choices are “potentially losing your copyright or improvements” and “forking the entire project”. Douche vs Turd Sandwich.

Why does Canonical really want a super-license for my contributions?

The easy answer (as I’ve mentioned a couple of times already) is “so they can sell it” but looking more closely at the applications applications that Canonical currently owns, I can’t really see any of them becoming runaway commercial hits. There is too much open competition.

I suspect I’m missing the real agenda. Mark talks and talks and talks and talks about maintaining code and generosity but as I said previously, GPL code is inherently maintainable and it’s just as generous as Canonical is to the community. If I am missing his points, you can hardly blame me when he obfuscates the message in a 2500-word-long, thick mixed-metaphor.

If anybody from Canonical wants to explain the actual business or technical logic for demanding signed Contributor Agreements, please use the comment system or if you’d like to email me, there’s a link right at the bottom of the page. I beg you leave out the wishy-washy, and again, insulting nonsense about generosity and supportiveness. That argument really has no legs.

Perhaps if you can succinctly explain what Canonical might want to achieve, the community will understand and embrace the Agreement.

Even if the Contributor Agreement does have limited merit, does every Canonical project need to be under it?

Even if Canonical does want to sell Bazaar one day, are they really going to sell indicator-applet? Who on earth would buy a commercial derivative of IA?

Why don’t you release it (and its similarly trivial siblings) from the CCA? There’s no value keeping them locked up; it’s just stopping people who object to things like the CCA helping to improve them.

My Conclusion: How can you trust Canonical when they won’t give you a straight answer? It’s not for me.

Even under its new “Harmony Project” Contributor Agreement, I fail to see how it benefits anybody. It adds ambiguity to the future of a contribution and it stops Canonical pulling in non CCA’d code, hurting the project.

Every argument I’ve seen for Contributor Agreements has talked about “giving back”, “trust” being able to maintain things but the GPL license clearly allows for all of this. It seems like nobody is being truly honest about why they want the Contributor Agreement and when you’re demanding that people trust you, that’s a big problem for me.

Unless Canonical can provide a good, honest reason for the CCA, they should strongly consider dropping it entirely. That would do a lot more to help people believe in the long-term future of Ubuntu than it currently delivers.