How did my project get here? (General Licensing Question)

[Pololot64]

I was reading the terms outlined here and was confused.

In number three it says:
Originality of Work. You represent that each of Your Submissions is entirely Your original work. Should You wish to Submit materials that are not Your original work, You may Submit them separately to the Project if You (a) retain all copyright and license information that was in the materials as You received them, (b) in the description accompanying Your Submission, include the phrase “Submission containing materials of a third party:” followed by the names of the third party and any licenses or other restrictions of which You are aware, and (c) follow any other instructions in the Project’s written guidelines concerning Submissions.

Suppose someone uploaded a link to someone else's code here without consent. How does that work? Even if the code is open source, it seems a little unclear.

[denelon]

The content you are quoting comes from the CLA.

With respect to a "manifest" in this repository, This applies to the file you are creating and/or submitting.

You are not submitting the "installer" to this repository, just the URL that is publicly available.

I am not an attorney, and this is not legal advice.

[Pololot64]

Sounds good 👍 Just clarifying

[Jaifroid]

I think there is some confusion here. When I first submitted an app I have developed here, I thought I was signing the CLA with regard to the app itself. I only realized later that the CLA refers only to the authorship of the Manifest (which itself had been created by the wincreate script). It might help clear this confusion if it were very clearly spelt out at the time of signing, not in the small print, but at the top in big and bold letters!

[denelon]

@Jaifroid, the CLA is more of a "global" agreement for all Microsoft repositories. I'll see if there is something we can do to help provide a bit more clarity here. Fortunately, this discussion can stay open, and it serves as at least one point of reference.

[CodyRWhite]

I guess I have a follow up question for this topic. I was confused by the wording of the CLA as well. There is some software that I would like to help contribute to the repository but I have no affiliation with the publisher of the software. The downloads are publicly available. If I author the manifest I am able to sign the CLA and contribute?

On the same note, there are a few existing projects here that do not have scope assigned and we are trying to utilize machine scope. I know the install supports machine scope its just not defined. How do I go about addressing this issue? Can I submit a PR to an existing project for a modification or does that project belong to the original contributor and I am not able to issue PR's against it.

I understand the CLA is to help protect Microsoft, however it is very poorly worded in my opinion for someone who just wants to assist the community.

Ultimately I want to help, but I don't want to upset anyone.

[OfficialEsco]

(Contributor perceptive)
IIRC the CLA basically ask if you are Submitting your own OR others software (with their knowledge). Highly doubt every software dev knows its added to WinGet, however if they ask to remove it, we do so.

If you know of any scopes or installers missing feel free to submit a PR, just make sure the manifest is a multi manifest.
Currently there are no owners, but they should probably get permission to accept PRs for that folder.

Just to highlight the whole thing, we're less than 10 active contributors trying to maintaining 2k+ Packages, there is no way we can keep track of every release and metadata (I've been testing and forcing installer scopes in PRs)

The best way to automate/maintain packages are RSS Feeds and API support, so GitHub and SourceForge releases are taken care of.
Currently https://github.com/vedantmgoyal2009/winget-pkgs-automation takes care of GitHub releases which is most of our Packages, it can probably support SourceForge too, however there are so few SourceForge releases that i've not asked to get 1 supported

[CodyRWhite]

So for clarity. One package that I would like to see in winget is Explorer++. While I have no affiliation its best for me to create a new manifest submit a new PR and sign an CLA that I am submitting on behalf of others software.

Before the PR is created I should reach out to the creator of the software and ask if I can publish their released in this repo. Do I then need to provide those approvals somewhere to verify as an approved PR?

While I understand this is a daunting task for 10 contributors I just want to make sure I am following the rules correctly.

Thanks!

[OfficialEsco]

Yes.

In theory, yes, but i would say it depends on the License and the metadata you provide.
A written statement that you've added the Package with the consent of the Developer should be good enough.

Well, luckily we're not asking for permission since the Package is already added to the Repo, it was more to welcome submissions :)

Explorer++ is currently Packaged in a Zip so its not supported.
Explorer++ is licensed under GPLv3 which basically allows anyone to do anything with it.

If it was MIT License https://github.com/microsoft/winget-pkgs/blob/master/LICENSE you are still allowed to submit the Package without asking, however you should be respectful and include the Copyright

Any software that is Proprietary (Copyright/EULA/Terms) should be asked for Consent, however none does, and there is no issues with that since the package will just be removed if the developer really want that.

[CodyRWhite]

Sure yeah. That all makes sense I am in no way attempting to take credit of anything. Just expand availability.

Thanks for the help and guidance.

[OfficialEsco]

That would be hard to do anyways :)
When you submit a Package we require the InstallerURL to come from the Source, unless the Package requires someone to build the Package, for example ungoogled-chromium, or the Package's Official Mirrors.
AND the PackageName and Publisher gotta match the Add or Remove Programs entries.
So technically you just have to provide the correct information for the Publisher (AnyDesk) and everything will be fine :)