Copyright arrangements for a web project

[Ian Jackson]

(This is a bit off-topic for the Debian list; I hope people won't mind
me asking opinions here though.)

I'm being asked for advice on encouraging contributions by the people
behind a couple of "community-ish" websites which I use regularly.
There's a lot of work to be done to improve the attractiveness to
contributors, and one of the things that needs fixing is the
licensing.

It's my view that a community software project ought to use a copyleft
licence nowadays.  But two questions arise:

* It would clearly be sensible to appoint a licence steward in the
  GPLv3 sense.  If the current project leadership lack free software
  credibility, could SPI serve as licence steward ?

  What instructions/directions would SPI take ?  The goal would have
  to include the SPI Board making the value judgement, not just
  deferring to the project's leadership - that is, the SPI Board would
  make the decision itself in what it sees as the interests of the
  project and the free software community.

* Should the project give the licence steward the power to change the
  public licence unilaterally in the future in ways other than just
  upgrading to newer versions ?  I think the answer is probably "yes"
  because the licensing landscape for web applications isn't settled
  yet.  Is this a good idea and how should it be done ?

  Ideally it would be good to avoid requiring copyright assignment to
  the licence steward.  Can this be achieved by some text in the
  standard licence rubric eg

    This program is free software: you can redistribute it and/or
    modify it under the terms of the GNU General Public License as
    published by the Free Software Foundation, version 3, or (at your
    option) any other general public free software licence publicly
    endorsed for PROJECT by Software in the Public Interest Inc
    (i.e. SPI is a proxy as described in s14 of the GNU GPLv3 but SPI
    is not limited to endorsing only future versions of the GNU GPL).

  (Along presumably with some Signed-off-by system for contributions.)

* Personally I'm an AGPLv3 proponent.  The system ought to be suitable
  for AGPLv3 provided that its submodules are AGPLv3-compatible (and
  if they aren't, then we can probably write a licence exception).
  (The main program I'm thinking of here is a Ruby on Rails
  application.)  What are people's feelings about AGPLv3 ?

Thanks,
Ian.