4

Attempting to read the Contribution License Agreement (source) for the .NET Foundation code. This includes the C#/VB.NET Roslyn compiler, the .NET CLR, and other runtimes. I am a fervent user of these technologies, and also a fervent supporter of free/libre and open-source software. I have some personal interest in possibly contributing to these technologies and their codebase in some way.

I'm no lawyer or open source expert, though, and I'm wondering if this CLA allows the .NET Foundation, and/or Microsoft, to relicense the code under a non-open-source license. This is colloquially referred to as a "rugpull", and has occurred with such open source projects as MongoDB and Redis.

Does the .NET Foundation have a profitable motive to do so? Does this license agreement implicate such a hazardous condition?

1
  • 1
    I just want to make sure it's clear that even if they rugpulled this would only apply to subsequent versions/contributions. They could not take away the right to the source (including your contribution) that existed before the "rugpull" from anyone who'd already started using it. Most if not all of .NET is MIT or Apache which have no revocation option (Apache is expressly perpetual). It would be the subsequent derivative works made after the rugpull that would be at issue. Related - opensource.stackexchange.com/questions/4012/…. Commented May 2 at 16:57

2 Answers 2

6

I'm wondering if this CLA allows the .NET Foundation, and/or Microsoft, to relicense the code under a non-open-source license

The copyright licence in the CLA, s4(1), says that

You grant .NET Foundation, and those who receive the Code directly or indirectly from .NET Foundation, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license in the Submission to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the Submission and such derivative works, and to sublicense any or all of the foregoing rights to third parties.

The CLA places no obligations on the Foundation to distribute your code, nor does it constrain the terms under which such distribution must occur if they choose to do it. So Microsoft would be entirely within their rights to (a) stop distributing your submission under free terms, and (b) start distributing it under non-free terms. Yes, it can be "rugpulled".

Does the .NET Foundation have a profitable motive to do so? Does this license agreement implicate such a hazardous condition?

The first of those questions only the Foundation can answer. As for the second, I think it's no more dangerous than any other reasonably-boilerplate CLA - but such agreements are inherently risky in this regard.

If someone's really playing a straight bat, they'll use a strong copyleft licence instead of a CLA. If Alice licences a work under GPL, and accepts contributions thereto, the whole work becomes very difficult to relicence (agreement amongst the rightsholders must be reached). While that's still no guarantee of permanency, it's a clear declaration of intent-to-keep-free, and the community is well-practised in forking code bases on the odd occasion that someone decides to go to all that effort.

9
  • In principle I'd argue this way, too. But §1 of the CLA made me wonder about its implication whether it puts limits on the ability to relicense: "Project means any of the projects owned or managed by .NET Foundation and offered under a license approved by the Open Source Initiative (www.opensource.org).". Either way, this is IMHO a good indicator that relicensing it under proprietary term is not forseen - maybe forbidden in the statute of the foundation (I haven't looked there at all)? Commented May 2 at 6:38
  • 3
    Your contribution doesn't stop the project being managed by the Foundation. Them distributing it under a closed licence would remove it from that definition, sure, but if they close up the code they're not going to be accepting any more contributions, are they? I don't see that either of those block "rugpulling".
    – MadHatter
    Commented May 2 at 8:03
  • 2
    "If someone's really playing a straight bat, they'll use a strong copyleft licence instead of a CLA" I really don't think that's a fair statement. There are countless extremely popular and valuable projects out there under permissive licenses by people/groups who have no nefarious intent but simply don't want to make it impossible for their stuff to be used in proprietary commercial products. Commented May 2 at 16:50
  • From my further research, the .NET Foundation is a 501(c)(6) non-profit “business league” foundation. While this does not negate the CLA’s clauses that implicate the possibility of relicensing, it does deny the Foundation a motive to do so. I’m not a lawyer, but relicensing a project under more restrictive terms is usually only done for profit; seeing how the Foundation is categorized as non-profit, it might (again, not a lawyer) land them in legal trouble for pursuing profit motives. I’m still weary of contributing to the project, but a rugpull seems less likely now. Thanks for your answer.
    – austanss
    Commented May 2 at 20:00
  • @PeterMoore but if they release under a permissive licence no CLA is required to achieve that. A Contributor's Agreement clarifying that contributions are made under the same permissive licence is a good idea, but permission to relicense isn't needed in order to enable use in proprietary products.
    – MadHatter
    Commented May 5 at 12:51
3

The CLA is a license between you and the .NET Foundation, applicable to your contribution, and yes allows the project owners to go ahead and relicense your contributions under any licensing model they want. While they use MIT and Apache now, there's nothing stopping them from turning around and re-licensing your contribution in a closed-source commercial form in the future. They may have even already done so and you'd never know.

But here's the thing - there's nothing stopping anyone else from doing that either.

Anyone can fork the permissively-licensed portions of .NET, make closed source modifications, and sell a complete product - including your contribution - under essentially any licensing terms they want. The makers of Avalonia did just that with XPF, a closed-source commercial cross-platform fork of WPF. This is the entire point of a permissive OSS license. It's a feature, not a bug.

Also remember that even if .NET Foundation decided to shutter the project, or changed it to closed-source, this would have no practical impact on the code that existed prior to that point. Enough people have forked the .NET code on Github and in so doing relicensed it under MIT to the world. Literally everyone who'd ever touched it would have to agree to pull their licenses - even assuming that would hold up legally which I doubt. That wouldn't happen. Instead you'll simply lose the benefits of future updates authored by Microsoft employees and other foundation members, which is a risk in any open source project, regardless of the licensing model.[1]

So the important question isn't whether .NET Foundation might "rug pull". It's whether you're ok with your contributions being used in proprietary/commercial/closed-source projects by anyone. If you're not, then as MadHatter implied, you simply shouldn't contribute to a project that uses a permissive license.


[1] Sidenote, I never quite understood the uproar about Redis or MongoDB. As far as I know nothing was taken away from anyone and pre-"rug pull" forks are numerous and thriving. If the complaint is that Redis Inc. and MongoDB Inc. are no longer giving away, or are putting new conditions on, the fruits of their labor, then the complaint is with capitalism. If others can do better for free or for less then they should; if they can't then that pretty much proves that the companies' products are worth the cost.

4
  • I’d play devil’s advocate, and wager that the people who you say have a “complaint [that] is with capitalism” are not completely baseless. There are countless free/libre and open source software advocates who do see the de-capitalization of the internet as an ultimate end goal… including me. Do with those opinions what you will.
    – austanss
    Commented May 3 at 10:39
  • @austanss hey man more power to 'em/you. Some of the best stuff out there is public domain (Sqlite anyone?) But you gotta admit it's pretty hilarious to hear cloud service providers whine about Redis and Mongo. Have you seen what Azure charges for a production-level managed Redis instance? Mamma mia. I say good for Redis for insisting on a piece of that action. Commented May 3 at 12:49
  • What Redis Inc. did amounts to a hostile takeover, if we are throwing opinions around in mine they have no right to complain about Azure or anyone else
    – klh
    Commented May 3 at 15:07
  • @klh and Microsoft and Amazon do have a right to complain? And "hostile takeover" is just hysteria. They didn't "take" anything. They stopped sharing IP going forward. They could've shut down the company and the result would be the same, except their work wouldn't just not be free - it wouldn't exist. Commented May 3 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.