Starting work on the shibboleth-sp2 packages

[Russ Allbery]

"Scott Cantor" <cantor.2 at osu.edu> writes:

>> Hm, at first glance, if OASIS is happy with copying of those parts of
>> the standard without any copyright notice, I wonder if they consider
>> them copyrightable.  One could make a strong argument that a schema
>> document itself is a functional interface specification and hence isn't
>> copyrightable under US law.

> It's news to me that you can't copyright a header file (people do it all
> the time). I don't see much difference here.

People put copyright notices on header files all the time, but most of
them are invalid.  In order to be protected by copyright law, a work has
to contain creative expression.  I'm fairly certain there's case law
around interface specifications similar to the established law that you
cannot copyright a telephone listing because there's no creativity to the
expression of the interface.

> It most likely does, and it's just an oversight or lack of attention
> that the schemas don't carry the same notice.

Do you know where I would ask?

> Schemas aside, if you did that you'd be running into all the IPR on SAML
> itself, which has non-assertion covenants only insofar as one is
> implementing the specification.
>
> http://www.oasis-open.org/committees/security/ipr.php
>
> Since some of that IPR is very generic, any web SSO technology is
> inevitably going to infringe (or, as I suspect, render the patents
> themselves invalid through prior art, but nobody's going to spend the
> money to fight them).

True.  Debian doesn't have a policy on this, and doesn't worry about
patents except insofar as the patentable material is included directly in
Debian, however, so the existing IPR policy is okay on the patent front
and for the purposes of inclusion in Debian, we don't have to worry
further about that.

>> The W3C documents were more of a concern because they contain large
>> blocks of text which is copyrightable in its own right.  The OASIS
>> schemas don't contain enough English text to be copyrightable
>> independently of the rest of the schema, only at most brief revision
>> histories, so if the schemas fall under the interface exception to US
>> copyright law, there probably isn't a problem.
>
> I'm not familiar with the exception.

Sega v. Accolade is probably the most relevant case law (at least the most
relevant that I could find quickly):

| Computer programs pose unique problems for the application of the
| "idea/expression distinction" that determines the extent of copyright
| protection.  To the extent that there are many possible ways of
| accomplishing a given task or fulfilling a particular market demand, the
| programmer's choice of program structure and design may be highly
| creative and idiosyncratic.  However, computer programs are, in essence,
| utilitarian articles -- articles that accomplish tasks.  As such, they
| contain many logical, structural, and visual display elements that are
| dictated by external factors such as compatibility requirements and
| industry demands... In some circumstances, even the exact set of
| commands used by the programmer is deemed functional rather than
| creative for the purposes of copyright.  When specific instructions,
| even though previously copyrighted, are the only and essential means of
| accomplishing a given task, their later use by another will not amount
| to infringement.

In other words, the theory is that if a given XML schema or a given set of
function prototypes express the only and essential means of interface with
an application implementing a protocol or with a library, they're not
creative and hence do not fall under copyright law.

Debian has rested on this general provision before in cases such as
extracting lists of Unicode characters from RFCs, but I'm not sure that
we've ever discussed it for XML schemas.

-- 
Russ Allbery (rra at debian.org)               <http://www.eyrie.org/~eagle/>