Monday, May 7, 2012

Plone Contributor Agreements

This is an open letter about my frustrations with the Plone contributor agreement process. I have tried many times to discuss this in a private setting but I feel no movement and have resorted to stupid antics like writing open letters as blog posts. This is my last effort to push this forward.

Dear Plone Foundation Board -

The current state of the Plone contributor agreement process is abysmal. It is careless, out of date, and undocumented at best. Don't worry, I am not talking about e-signing. We all gave up on that. I am talking about simple things that make me want to go postal. If the developers in #plone can get it together and be nice to newbies, you can do the same.

The steps to make it sane are trivial:
  1. Update the agreement. Get rid of the stuff that no one fills in and the fields that you will never follow up on (e.g. "Please write your physical mailing address here, so we can mail a physical copy back to you." Ahem...). Every time some one fills this out at a sprint, they ask what "Program" is and I always respond with "Pretty sure it's Plone... I think...". I also have to ask them to add their github user name and put it somewhere on the bottom (or I forget then have to contact them later).  Other gems in this legal document include: "If you have any questions, or would like something to be changed, ask [Plone Foundation Contact for Assignments Email Address] via email." In its current state, the agreement is a joke. Please spend 5 minutes and update it.
  2. Update the documentation for new contributors. From our communications, I understand that scanned agreements can be accepted. Maybe you should write that somewhere since everything now points to snail mail (used to be a joke, now just sad). You could also have an email address set up so that it doesn't take 3 emails to find out who "gets the agreements now". You could set up one email, such as, that redirects to whomever is in charge of the agreements at the time being. They could even answer questions and you could update certain documents to have contact information once and never have to update it again. Related: internationally mailing agreements is cruel and unusual punishment. 
  3. Update the documentation for superusers. I have run several sprints and have superuser access to everything needed to make things work. I try to do the right thing but I constantly feel at risk. Let me count the ways:
    1. When triaging tickets with patches, I have no idea which people have signed an agreement and we can accept the patch and who has not. This is not fair to me OR the poor ticket reporters that I pester asking if they have signed or not. 
    2. During virtual sprints, such as tuneups, I often spend time recruiting people to send in their agreements. Does this count as a normal sprint? Can I give them perms once I see the agreement? No one knows the rules. Write them down, please. 
    3. Similarly, there is no list of who has and who hasn't signed the agreement. It would make my life so much easier if I could just validate that. People forget if they signed it in the past and then its a whole debacle. Keep in mind that as a sprint host, I am the one who has to answer questions about whether or not agreements are received or what the status is and can they have permissions yet. 
  4. Be responsive. When people sign agreements, especially mail it in, its because they have something they want to commit. A one month turnaround time is horrid. Motivation is a fleeting thing. Furthermore, please don't make people open a ticket for core access in trac. It's annoying. If you get their github username upfront in a certain document, you can just add them. DONE.
  5. Bonus Round: Follow up. How about a nice welcome email? Maybe a link to instructions on getting the buildout going and how to fix tickets? This can be very easily done with a mailing list which could then be used to send updates like "hey contributors, we moved from svn a year ago" instead of people opening tickets in trac. 
In summary, I'm asking you to give a shit about this poop stain of a process. It is a frustrating, out of date introduction to the Plone developer community and we deserve better.


PS. Have word processor, will edit.

UPDATE #1: The email exists! It's If your agreement is in limbo, email them today and ask whats up.

Also, apparently we technically don't accept scanned documents yet. I hear conflicting things so at the moment I guess just... no.

UPDATE #2: There is a list of approved contributors at Quick, everyone click it and watch crawl! It's a half solution since it doesn't actually list the trac username for quick search but at least it's something.


  1. Fedora and LibreOffice (after departing from OOo) got rid of the contributor agreement and now everyone is happy and more productive (i.e. less paperwork and more programming time).

    Why does the Plone Foundation still think that keeping the contributor agreement is something good?

  2. The problem is not the paperwork, the problem is the processing. The committer committee of the Zope Foundation (which is basically me) processes new applications usually within a day (in most cases within an hour or so during day time). Having no paper work or application does not make any sense to me. You want to ensure the identity of a person and you want a reference from exisiting comitters about the new applicant for legal reasons. This applies to the core Plone repository (getting access to the collective is a completely different story). There must be some formal application process for a core repository but applications must be handled in time. In case of the ZF the application has to be send by email to the committee's list which will then ask the reference committer about a statement and then process the application immediately - as said: usually happening within hours. I only remember one case where an application got lost and where it took some weeks (which seems to be the standard in the Plone Foundation).

  3. One of the main issues here is that for the past 6-7 years all of this has been handled behind the scenes very efficiently by Toby Robert whilst at Enfold. Toby has stepped down in his role as both PF Treasurer and admin for the contributor agreements at the start of this year. These roles have now been split and the finance handled by Jen Mayers at SixFeetUp and the agreements being handled by Sjoerd van Elfern at FourDigits.

    This change has uncovered a number of issue that we have been living with. We have been in contact with our legal council about getting things updated, but alas these things take time. We will re-double our efforts to get things sorted as soon as we can. But even things like changing wording need legal advice. I think reference to 'The Program' is not helpful too, but alas this is the way it was legally drafted and IANAL.

    Gil, I'm very interested that Fedora and LibreOffice got rid of their contrib agreements. Do they have the same software conservancy model of the Plone Foundation? With no agreement how do they handle getting people to assign the rights to their code over to the Foundation?

    Plone Foundation President

  4. I feel like people are getting caught up in first bullet point on wording. It is bad, but I understand that these things take time. In the meanwhile, there are several other parts of this process that could be addressed. Yesterday alone I asked 2 people in Trac tickets comments if they had signed the agreement to know if I could accept their patch or not. It's a waste of my time and theirs. Solving that issue shouldn't depend on lawyers.

  5. Having just been through the process of attempting to make sense of the contributor agreement (there's quite a bit of outdated and missing information in that original PDF), I can wholeheartedly agree with the above.

    I stumbled upon the fact that my agreement could be scanned and emailed in by chance in IRC, and with regards to turn around time, I'm unfortunately waiting. In this time, because of no commit access on my behalf, at least 1 notable bug (someone's typo) has been inadvertently introduced into Plone 4.2rc1.

    Imho, it'd be better if the process was more transparent and indeed simpler. At present, I'm completely unsure what's happening or similarly who to contact regarding my agreement's progress .

    For now, should I be creating a ticket in Plone's tracker for commit access? I honestly don't know.

    1. Word on the street is that you can email to find out what's up. Include your github and usernames so they can double check. Let me know how it turns out.