tags:

views:

46

answers:

2

How do open source projects ensure that any code contributed to the project is original, not proprietary to a company or plagiarized from another source?

Should open source contributors be required to sign something to that effect before they start contributing code? If so, is there a generally accepted legal contract that any open source project may use?

Do you know of any cases in which an open-source project was accused of allegedly distributing proprietary or plagiarized code?

A: 

I don't think there is much you can do. You need to make it stated policy, and you should probably have the software be a product of an LLC, that way if someone comes after the program, they have to sue the LLC (and possibly the person who was the contributor). If you're the maintainer, you should talk to a lawyer if this is a concern.

Steve
Are there lawyers that help out the open source community? I can't have a side project turn into a financial burden.
David
+2  A: 

You don't really need to verify that the code isn't plagiarized to be protected from prosecution or civil liability. Instead, you need to verify that the contributors claim that they have the right to contribute the code. If they've done that then if they're lying, or wrong, it's on them. What steps you take to make sure you can prove that they're responsible for their own contributions are up to you.

Most open source projects don't worry about it. The license terms are clear, and it is supposed that anyone contributing code has the right to contribute it. Further, contributions tend to come in through patches on mailing lists or commits into a version control system, both of which are somewhat traceable.

After the SCO fiasco, the Linux kernel took the additional step of adding a "sign-off" requirement. Basically, contributors have to attach a statement to their contributions signing off they they have the right to contribute them. Since Linux kernel patches go through a few layers of review before Linus puts them into his tree, those reviewers add their own signoffs.

Some corporate-owned projects, like OpenOffice.org, actually require all contributors to first sign a legal agreement. This document's primary purpose is to ensure that the contributions can be used by the owning corporation in closed-source ways, but it also contains language that asserts that the contributor has the right to contribute whatever he or she contributes.

Note that regardless of what you do, your project still could get shut down. If a contributor provides a large quantity of important code that becomes central to the application's operation, and it later turns out that the contributor did not have the right to contribute that code, then while you don't have any civil or criminal liability for using or distributing the code (because you acted in good faith), you WILL have to cease distribution of the infringing code, which means removing it from the application, which may mean a lot of work to rewrite that functionality.

If you are working on an important or high-profile project, or if your project might get some significant negative attention from people with lots of lawyers, it's HIGHLY recommended to retain an experienced IP attorney and proceed based on his or her advice.

swillden