Governance: Remove Google CLA requirement

[ddevault]

Moving a conversation which has been taking place variously on IRC/Discord and PR comments to a GitHub Discussion.

The CLA requirement is onerous and unduly privileges Google with respect to the governance and maintenance of jj, and it pushes contributors away -- like myself. I don't have a Google account with which to complete the CLA process and I do not want to give Google any special privileges above and beyond what is afforded by the same Apache 2.0 license myself and everyone else is entitled to when receiving this code.

The Developer Certificate of Origin is a better solution for establishing provenance and accountability.

[ddevault]

(reproducing some of the remarks I've made on IRC for posterity here on GitHub)

It has been suggested that jj could be "donated" by Google to a legal entity like the Linux Foundation or Apache. Personally I would be fine with jj being under the stewardship of the Linux Foundation, moreso than Apache but either is better than Google. Apache has a similar CLA but Apache at least is an organization that I can see myself having some influence on policy and governance within; not so with Google.

However, I do object to this framing in general. What exactly is there for Google to donate? Google does not own the copyright, even from contributors who have signed the CLA, with the exception of the contributions from Google employees who have separately signed a copyright assignment agreement. As far as I'm aware "jujutsu" is not trademarked, either. The software's intellectual property is jointly held by all of its contributors, not by Google, so what material property does Google actually have the right to "donate" to anyone? At best they can assert stewardship (something that they currently officially disclaim) and then "spiritually" transfer that stewardship to someone else.

I don't really think this project needs to belong to a foundation, though, and the overhead of getting one to agree to take it and doing some kind of formal hand-over seems entirely unnecessary. The material problem is really just that @martinvonz is in charge of this project and Google requires employees who are in charge of free software projects to use the CLA, and the most prescient solution is for Google to agree to let @martinvonz, on his authority as the maintainer, remove the Google CLA requirement (perhaps instituting the DCO instead), and then continue to contribute to this project and its governance not as Google's proxy but on equal terms as everyone else.

[thisisnotapril]

• The foundation topic came up because that is the one of two ways for a Google-project to move out of Google. Transfer, or fork.

• Google lawyers have weighed in on this; that is why the CLA is required. We in OSPO are engaging in conversations with them about the possibility of allowing projects to use DCO, as I mentioned earlier. At the moment, the CLA requirement on this Github org remains.

[ilyagr]

DCO is relatively new and we in OSPO are exploring the possibility of it being an option for our projects. It's not as tested as CLA is though, and especially in light of new potential regulations across the industry, there are many factors to consider.

Thank you for working on it! ❤️

Separately from the main issue of this thread, if you end up openly publishing some documents about why the DCO is sufficient or insufficient, how the new regulations affect open source, and so on, that would be interesting to me and hopefully valuable more generally.

[ilyagr]

Re the side discussion about Google accounts (also separate from the main issue of this thread), this is based on a vague memory and a tiny bit of research, but I think it might be possible to register a separate personal Google account just to sign the CLA. You might need to use its address to your GitHub account, but you otherwise don't need to use it.

So, whether or not it's the case for the real person in this thread, if your only problem with signing the CLA were that you have a school-provided Google account that can't do it, this might be a completely legitimate way around it.

For example, here are some quotes from https://support.google.com/accounts/answer/40695 that suggest to me that Google doesn't have a problem with a person having multiple accounts (though, of course, I can't speak for them nor guarantee anything). The bolding is mine.

Don't use Google services to create a false identity to trick people into taking action (social engineering). It's a violation to create a Gmail address that implies someone works for an unrelated company or government organization.

However, uses like making a fan email account in a celebrity’s name are fine.

( Note from ilyagr: Of course, for CLA purposes you'd probably need to create a separate account under your real name; it shouldn't be a parody account )

---

• Don't create or use multiple accounts to break Google's policies.
• Don't use programs (called bots) to create fake accounts.

Many people have more than one Google Account, like a personal account and a work account. Uses like that are fine.

---

Again, I can't speak for them, but it seems that creating a personal account in a addition to a school account is fine (unless done in order to do other prohibited things, on the level of scamming people). In less official places on the internet, people say that there seems to be a soft limit of ~3-4 Google accounts per phone number.

https://support.google.com/accounts/thread/11008132/how-many-gmail-accounts-can-a-person-have-i-assume-they-all-have-to-be-linked-to-one-number?hl=en

https://support.google.com/accounts/thread/19158171/can-i-have-two-gmail-accounts?hl=en

[lishaduck]

So, whether or not it's the case for the real person in this thread, if your only problem with signing the CLA were that you have a school-provided Google account that can't do it, this might be a completely legitimate way around it.

Yeah, my point was that a CLA discourages contributors both philosophically and practically. While I'm glad Google is considering people who don't want/don't have Google accounts, those who don't want them are probably the same people who don't want a CLA? I, for one, have little intent of signing the CLA whether or not I can. (I might, but not for much beyond all the docs issues I've found over in Dart. I wouldn't write any significant CLA'd code, like over here.)

For example, here are some quotes from https://support.google.com/accounts/answer/40695 that suggest to me that Google doesn't have a problem with a person having multiple accounts (though, of course, I can't speak for them nor guarantee anything). The bolding is mine.

Yeah, I also have a personal account, but on there I think I recall getting errors about how minors can't access certain services or something (not from the CLA form, but from the Google login).
It doesn't really matter given that I probably wouldn't sign it anyway, so I'd prefer to keep this on-topic-er. I, for one, have certainly gotten a lot more notifications than I'd expected today.

[ddevault]

The foundation topic came up because that is the one of two ways for a Google-project to move out of Google. Transfer, or fork.

This is a self-imposed limitation by Google. We are petitioning for a third option. Who is overtly responsible for this project is off-topic for this issue, and better handled by the broader governance discussions. This discussion is strictly about the removal of the CLA, and will not accept any substitutes.

Google lawyers have weighed in on this; that is why the CLA is required. We in OSPO are engaging in conversations with them about the possibility of allowing projects to use DCO, as I mentioned earlier. At the moment, the CLA requirement on this Github org remains.

Thank you, this is good news. Please keep us updated on the DCO.

[martinvonz]

I mentioned a few months ago that we were going to discuss project ownership with stakeholders at Google this month. We have now done that.

Google supports setting up the governance as proposed. We care a lot about building a healthy community and tool that is successful and useful far beyond Google's own use. We will keep the CLA and continue to own the jj Github org for now, and revisit the option of donating to a foundation later, when the new governance model has been working well for a while.

[ddevault]

The CLA and transferring to some foundation are orthogonal. Since this discussion is about the CLA requirement I'm not sure how your comment is relevant to moving this forward.

[intarga]

The CLA and transferring to some foundation are orthogonal. Since this discussion is about the CLA requirement I'm not sure how your comment is relevant to moving this forward.

If the CLA requirement is imposed by Google, it seems to me that transferring ownership away from Google would indeed be a step toward removing it

[WhyNotHugo]

These two statements completely contradict each other:

…

We care a lot about building a healthy community We will keep the CLA

[thisisnotapril]

Hi there, I'm in the Google Open Source Programs Office and have been working with Martin and the team. The ultimate goal is, as Martin said, to build a healthy community around the project. Governance is something that a project can implement quickly, and iterate on as needed. Moving to a foundation is a legal process that can sometimes take a year or more, depending upon the foundation home. Yes, a Google-owned project will always have some non-negotiables; but we do recommend projects open up governance as much as possible, while other avenues are explored.

[ddevault]

This project is not Google-owned. As some have taken pains to point out, the Google CLA does not include a copyright assignment. And, as Google has taken pains to point out:

Mandatory Google Disclaimer

I (Martin von Zweigbergk, martinvonz@google.com) started Jujutsu as a hobby project in late 2019, and it has evolved into my full-time project at Google, with several other Googlers (now) assisting development in various capacities. That said, this is not a Google product.

Please clarify in what respect jj is a "Google-owned" project, as you state here.

[thisisnotapril]

My comment here - #4849 (reply in thread) addresses this

[WhyNotHugo]

The mention of a foundation is a red herring here. Nobody's requesting a foundation, and that is entirely off-topic. The requirement to sign a CLA to participate in a "community" can perfectly well be dropped without a foundation (this is how the overwhelming majority of open source projects operate).

[shanesveller]

@WhyNotHugo One rando user to another: your rhetorical approach on this topic is pretty rigid and argumentative and IMO diminishes your cause. Try rereading what you've written here and see if you find any evidence for a willingness to be patient, to compromise from some perfect outcome to obtain a good one, or to extend any empathy to the circumstances of others involved.

"I won't even concede your premise, so I also reject your policy and your steps towards fulfilling that policy" isn't a dialogue, it's an entitled dismissal and it's hostile. Ignoring a messy pile of Reality that is complicating and prolonging the process won't suddenly make that process pan out any faster or better.

[WhyNotHugo]

What exactly is this fear of a developer “going rouge”? Without a CLA, no single developer can do much damage, given that individual authors continue holding copyright over their contributions. Granting Google the exclusive ability to override all maintainers and contributors (including the ability to relicense the entire project) isn’t a path building a community. Unless by “community” you mean “fiefdom”.

[ddevault]

I think everyone is much more concerned about Google "going rogue" than anything else. Which is to say, the only party in this project which has received an exclusive license to go rogue.

[martinvonz]

It's above my pay grade. I hope @jrn or @rdamazio can take over.

[ddevault]

At your "pay grade" we could hire an army of lawyers who would resolve these questions in a heartbeat. Answering questions like this is one of your most important jobs as a Jujutsu maintainer, one that you are uniquely qualified to address. Other maintainers can do code review. Nobody else can go talk to the right people at Google.

[intarga]

While I’m of your point of view Drew, it’s worth remembering that @martinvonz doesn’t owe us anything. I think your comments are crossing the line from discussion to harassment, and that’s a poor way to convince anyone.

[RalfJung]

There is a point that has not been raised here yet, which I think is worth adding:
While I am not a big fan of CLAs, there are CLAs that I find tolerable. The jj process, however, goes way beyond that: it apparently requires a Google account. Every time I tried to create a Google account in the last few years, it insisted on me handing my mobile phone number to Google. That is an entirely unacceptable intrusion of my privacy -- I consider my mobile phone number to be as sensitive as my physical address and will not share either of them with Google. In other words, jj currently requires people to share private details of their personal life with Google in order to submit a PR. (Getting a burner SIM can help, but that's a lot of effort and in many countries there is no legal way to obtain a SIM card not linked to a physical address, so it's still pretty bad.)

I suppose you don't have much choice in the matter, and I appreciate all the work that went into jj. It sounds like a tremendous tool. It might just not be for me under the current conditions.

[runxiyu]

Note that the README is, in my opinion, actively misleading, even if it's "technically true".

There is a mandatory CLA you must agree to. Importantly, it does not transfer copyright ownership to Google or anyone else; it simply gives us the right to safely redistribute and use your changes.

Which a DCO is sufficient for. You don't need to transfer each and every one of the exclusive rights in 17 U.S.C. § 106 to Google in order for Google to be able to "safely distribute and use your changes" unless "use" refers to, well, doing things that would otherwise violate the license.

I believe that a more honest description would be something like this:

Contributors must sign a CLA granting Google a perpetual license to use, modify, and sublicense their contributions under any terms, although copyright is not transferred per se.