What's the procedure of the project leaving .NET Foundation?

[oskardudycz]

I want to ask what is the procedure of the project leaving the .NET Foundation? I'm especially interested in the "Contribution" type (as we have in Marten), but I think that it'd be also essential to clarify that also for "Assignment". Is any paperwork needed, or is it just enough to revert changes made during project onboarding?

I think that this is important not only for projects wanting to leave .NET Foundation, but also for those who consider joining.

[leastprivilege]

I would be interested in that information as well. Could someone from the DNF explain?

[rprouse]

• We think that paperwork is needed in order to transfer/release the copyright. We've already been talking to our lawyers to clarify
• Reversing the onboarding, yes
• I think that if your nuget packages are signed, you will need to get a new certificate to sign them with. I'm pretty sure NuGet.org will not allow you to upload unsigned packages if you've already uploaded signed ones.

As you can see from my answers, we're still working through the details.

[devlead]

@devlead, thank you for the feedback. I see the importance of the public announcement. Still, I don't see the value of keeping it for a few weeks as a blocker to finish the offboarding process, especially since initial signing parties have to sign the offboarding intent letter (btw. see also my comment in the other thread about that part: #68 (reply in thread)).

The reasoning would be if the circumstances for a new agreement for any reason are invalid, a couple of weeks' notice would make it possible for people to notice any issues, to adjust and address that before the agreement is signed, and before any other agreements are potentially violated. Common practice is that due diligence is done before an agreement is made, not after.
A notice would also give a period to be respectful of people so they are given a chance so if they want to act based on that notice they would have a couple of days' heads-up instead of having to drop everything when something already happened.

The reason for doing it in the forum of the project is that those interested in the project might be monitoring the project more than the .NET Foundation blog, so more channels increase the chance of the message reaching all concerned parties.

If it's a big issue for projects to inform their community/have them aware about this change, one might question their motives and if everything is in order.

[JimBobSquarePants]

Again. This is an agreement only between the maintainers and the foundation. I will not be accepting this requirement.

[mysticmind]

@devlead I am sure, there will be more edits/changes based on feedback from project owners. What is the timeline for this draft to take effect so that maintainers can plan to look at next steps?

[devlead]

@devlead I am sure, there will be more edits/changes based on feedback from project owners. What is the timeline for this draft to take effect so that maintainers can plan to look at next steps?

Maintainer committee meets today, agenda here

dotnet-foundation/wg-maintainers#51 (comment)

Board meets next week, and this will be one of the topics there.

How quick it can be implemented depends on if all parties can agree on the process or not.

[oskardudycz]

I've moved the further discussion to the other comment #68 (comment), as it's hard to go through this whole thread.

[leastprivilege]

We think that paperwork is needed in order to transfer/release the copyright.

This might be slightly different for every project. In our case we never transferred the copyright.

I think that if your nuget packages are signed, you will need to get a new certificate to sign them with.

The DNF SignService was indeed a nice feature (along with the CLA tool that was unfortunately abused).

We are now using NuGetKeyVaultSignTool to sign our Nugets. It is pretty straightforward - I can help if needed.

I'm pretty sure that switching certs does work. Can anyone confirm?

yes I can confirm.

[oskardudycz]

In our case, it was also granting, not transfering.

4. Licenses.
   a. Copyright License. Contributor hereby grants .NET Foundation, and those who receive the Code directly or indirectly from .NET Foundation, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license in the Submission to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the Submission and such derivatives works, and to sublicense any or all of the foregoing rights to third parties.
   b. Patent License. Contributor grants .NET Foundation, and those who receive the Code directly or indirectly from .NET Foundation, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license under Contributor’s patent claims that directly read on the Code to make, have made, use, offer to sell, sell and import or otherwise dispose of the Code.
   c. Trademark Rights. Contributor grants .NET Foundation rights to use certain Project trademarks owned by Contributor. The specific grant of rights in those trademarks (if any) is specified by
   the election to disclaim or license those trademark rights as denoted in the signature block below. By electing to disclaim such rights the Contributor is agreeing to the terms of the “Contributor Marks Disclaimer” in the Trademarks Use Addendum. By electing to license such rights the Contributor is agreeing to the terms of the “Contributor Marks License” in the Trademarks Use Addendum.
   d. Other Rights Reserved. Each party reserves all rights not expressly granted in this Agreement. No additional licenses or rights whatsoever (including, without limitation, any implied licenses) are granted by implication, exhaustion, estoppel or otherwise.

As we have an MIT licence, then I think that licence shouldn't be an issue. I'm more concerned about the trademark rights.

[rprouse]

IANAL but NUnit's agreement is the same and I read/understand the Trademark rights as just granting the Foundation the right to use any trademarks such as your name/logo. We won't use them for non-member projects. Also, do you have any registered trademarks?

[oskardudycz]

Right, we don't have any registered trademark, so that point may also be fine 👍

[SeanKilleen]

I see in the threads that:

• There is a (reasonable IMO) frustration over the amount of time this is taking to resolve
• There is a (reasonable IMO) process that has to be undertaken in order to resolve this, and that takes (reasonably, IMO) an amount of logistics and scheduling and time.

So, what could the board do in the interim to help show progress and transparency?

I think it would be a great idea to publish an "alpha draft" of what the process might look like, and what the outstanding questions are. As legal weighs in on these questions, the process can be modified and the answers to those questions can be listed. This would show updates as things progress, and provide a sort of decision record on how the final process evolved. It would also allow community input that could lead to important clarifying questions for legal, making that piece more efficient as well.

This helps invite projects into the "problem space" and gives transparency and insight into the (understandably messy) process, rather than a black box until a "solution" is found. Seeing the evolution may also help folks feel better about the end result, rather than asking many questions that could be answered by seeing the evolution.

CC @rprouse and @BillWagner since you've been active on this issue.

[oskardudycz]

That all sounds to me like a good idea ☝️

[SeanKilleen]

I will add that if someone wants to get me up to speed on said topics, I can do my best to create a draft repo with the process and outstanding issues so that it is clear.

I know the board is handling a lot right now and as hard as you all work, it's not your full time job. ♥️

[rprouse]

The board is meeting this week to discuss a proposed process and to poke holes in it. Once we do that, we'll update here and also get an opinion from our lawyers. Thanks for the offer of help @SeanKilleen. Maybe once we have that basic structure you can help me pull it into a more formal document.

[SeanKilleen]

Happy to! My larger point is that it would be great to consider smaller feedback loops so that information can be radiated long before it's in a formal structure, so that the larger community can see the working/thinking out loud.

[AraHaan]

or have it live streamed so everyone can see that part of the meeting.

[rprouse]

We have a plan and are confirming the details with our lawyers before we formalize it. At a high level, the procedure for leaving the foundation is going to be,

1. Project submits a notice of intention to leave the foundation signed by ALL the original maintainers that submitted the project to the foundation. We want to respect the wishes of everyone that originally joined the foundation.
2. The foundation will discuss the process with the maintainers and plan the exit.
3. The foundation will archive a copy of the project's repositories as-is. This is only to give the community the option to fork the project (license permitting) if the project decides to go closed source or delete their repos.
4. The foundation will sign an agreement reversing the original agreement with the original maintainers.
5. If the project is using the NuGet signing service, they MUST obtain their own signing certificate and start signing their packages with that certificate. They must also remove the foundation as an owner of their NuGet packages. This must be done because NuGet will not allow you to upload unsigned packages if they were previously signed.
6. If the project is in GitHub Enterprise, it will be removed.
7. The project maintainers should also update their repositories to remove references to the foundation, update their copyright, remove the dnadmin account, remove the code signing bot, update their code of conduct, etc. We'll create a full list.
8. The foundation will disable access to code signing.
9. The foundation will remove the project from their website.
10. The foundation and the project will create a public statement.

[mysticmind]

Regarding some of the services that the DNF currently offers such as code signing, the CLA bot, etc... it might be good if the Foundation could show some good will in providing assistance to exiting projects in how to set these services up. For instance we might point the projects to Open Source (either from the DNF or OSS Community) and/or 3rd Party paid services that they can set up to replace the DNF services.

@dansiegel cla-bot is a readily available replacement for the DNF CLA bot. @leastprivilege already referred to using NuGetKeyVaultSignTool to sign NuGet files. These should cover the majority of DNF services being provided. DNF could include these in the docs for the exiting projects.

[dansiegel]

@mysticmind I wasn't asking for the information as I'm actually already aware of these. Not every maintainer is, nor is every project maintainer comfortable setting these up. The point is too have a list of resources that OSS maintainers can use whether they are part of the DNF or not as it ultimately promotes a healthier OSS community at large. Projects that wish to leave may be getting a "divorce" from the DNF but that doesn't mean it can't be on good terms in which we still take the time to help the departing projects ensure they have the resources that they need.

[mysticmind]

Makes sense, completely agree with you 👍

[glennawatson]

What about project maintainer death or unable to be contacted.

[devlead]

What about project maintainer death or unable to be contacted.

Ideally, projects would themselves do a successor plan, so maintainers' wishes can be followed and project continuity ensured. This is an area where work needs to be done and dialog needs to take place with maintainers.

[oskardudycz]

Unfortunately, I wasn't able to join the last Maintainers Committee meeting.
I'm adding the dedicated comment, as threads are getting longer and longer and harder to read. I got a summary from them @glennawatson of the last Maintainers Committee.

NOTE: It's not an official summary. I'll update the comment once the official meeting notes are out.

1. There's legal issues, since they have a contract with the original maintainers who signed the agreement, the lawyers have indicated it needs to be them that withdraws the agreement at the moment. If they have died the lawyers have indicated in that scenario it'd have to be the estate that handles it for example. This means the original maintainers have to be involved regardless if new maintainers have been involved
2. The pre-signout announcement to the public is basically a way to avoid the whole mess with lack of communication in the past with the DNF. You can for example make this read only announcement
3. It might be worthwhile having a formal handover with contract process with projects who have passed the torch onto new maintainers. This would make processes like this easier in the future. So this would be likely a good agenda item for future maintainers meetings.
4. They are ideally wanting ways to keep current maintainers then losing them but they feel it important to do the ethical thing and let projects who just don't want to be with the foundation, so that's why they'd like the consultation period
5. The draft is getting put forward to the board this week

I'm not sure yet about the timeline. I hope that there will be some update from the Board soon.

[devlead]

Small update on status as announced in March newsletter and March Maintainers' Meeting

• The process was presented and approved at the board meeting on March 7th
• Tom Pappas has joined Executive Director of the .NET Foundation.

The board has a scheduled meeting on March 24th, where we'll start the process, and reach out to projects on a project-by-project basis in the order they sent their written intent to leave. Initially, this will be handled by the ED and the Board, but once the process is fully fleshed out it'll be handled by a committee in a similar ongoing way as onboarding of new projects, they ensure everything is in order and pass on to the board for formal processing.

[oskardudycz]

Per the email agreement, we created a pinned issue in the Marten repository with our official statement to inform our community that we intend to leave DNF by the end of the month. JasperFx/marten#2183.

Other agreed steps:

• The CLA bot will no longer function.
• The .NET Foundation no longer digitally signs any NuGet packages.
• The CoC won’t be enforced.
• Maintainers may change the license terms after leaving the foundation, please think of this as the maintainers forking their project out of the foundation, the foundation will fork the project and store it with other archived projects.