From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id A8B9A138334 for ; Mon, 25 Jun 2018 14:46:42 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 790D1E09AB; Mon, 25 Jun 2018 14:46:41 +0000 (UTC) Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id ED248E099C for ; Mon, 25 Jun 2018 14:46:40 +0000 (UTC) Received: from [192.168.6.88] ([212.159.46.162]) by mrelayeu.kundenserver.de (mreue004 [212.227.15.163]) with ESMTPSA (Nemesis) id 0Lg4q7-1fw8c01yFn-00pdPf for ; Mon, 25 Jun 2018 16:46:39 +0200 Subject: Re: [gentoo-project] Re: [gentoo-core] Re: Poll: Would you sign a Contributer License Agreement? To: gentoo-project@lists.gentoo.org References: <23310.46809.293787.611345@a1i15.kph.uni-mainz.de> <23317.12829.91552.529904@a1i15.kph.uni-mainz.de> <20180625013334.GA28404@kroah.com> <23344.37042.753481.563752@a1i15.kph.uni-mainz.de> <20180625070525.GA6151@kroah.com> <23344.40875.105369.227774@a1i15.kph.uni-mainz.de> <20180625110540.GB3058@kroah.com> <23344.65054.620110.958503@a1i15.kph.uni-mainz.de> From: "M. J. Everitt" Openpgp: preference=signencrypt Autocrypt: addr=m.j.everitt@iee.org; prefer-encrypt=mutual; keydata= xsFNBFj5szgBEAC/agebayc0YHOQ/gYpGTPrSfj/IWYynaub4p55TRPUYFQrBTAwR/Qy7EH/ QxsPX6pXKmUh44j+dGMzifOFbA9tN+XQcSPYSpqJJLnajDmBFw9gIIqCLSHYAWrKkP/NNo/1 edBQO61clMRf4+quPk6Jm/EdaIcDFO9PoclRJ202NYJJqFlXmzSpPZETYu2h0YeCO3cAkJwd EkRpU18u4p0b3/N9EPlMxlfZTaGiGC+uM0OI3g4MflexOnFDLkIVa8iaOA5ws/GxN6+r05E+ 2q3jF1WhbrfxlHRim1kEtPHU/e28eiL8V5A77PvNkgQz0ff2ob5wMQ9aQLJKrCLxkBDHaj1J 5l6dF3KXzAIC2L+cqEKgBxNppqvleWTTA9TLBEk211qnBDe/PCVvWvl0R1oQX+fnxlxI3WA+ k9K6382FqN0fEslvVC5SBIZq6jnLPyIbwSSE+70lxfnR56AbnUI1p2etgz6K+lEq/3Ba20Fu WBlXNIkcogvZR8Eyz5K/iKIv7Tcj6hHq+PA57ZM/FWEFDeQsY8hTtI1/hdri4BQ4NW6JNREr duz9BVyf+V648VayYjK9SrfeGfrRnv4L7DwaU1q/nASU4IwJAnPGN4TZ9xPv6W6x76cs3iJt 4x23t3Fpn54b+oSNj5JcBIFxkkmxt/qSLqJgytaK3RJrmHuHNwARAQABzTBNLiBKLiBFdmVy aXR0IChMYXB0b3Aga2V5KSA8bS5qLmV2ZXJpdHRAaWVlLm9yZz7CwYEEEwECACsCGwMFCQPC ZwAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheABQJY+bowAhkBAAoJELvNRitMMx01do4P/0vZ jYo4IJI+OZMG7xpn9tbI6WDvvxP6b8yNaytlVbbSoX4ZJM0BlcEaVxQFpKxGYFWp7CAi3JH9 X93Pvt0PowAZstuO5MQklmTEsp450uv0IcfI4bXpr5Vvu6NrIBj+NMNUQFVIGYk20U0SO0gj KKl8LgLeMHiQWyTbDP8foqSIr3c8egIuHFKdSw+BKUCnTmdG1RQGKfNMiHHUPyNJopUCt/4w y7bSrBAiJTQM73mWjktpvMBYtlaYHLuCkkKQ3TL8pGlbWI2bEachxOzbE4nTLY6rlLAg+D8A t1tnXWprYN+OL0BxxqQHbWYKeboplF+XuMgDY73FfH/bzR6Z7AkBxFojIuBhfYlWNp1681xj t5MGfpZ83rTfspbbr2L+TWE/ZSOvecKXQAnve5+C2Wkqxgmolb8t7rS7GAVouD4Qul2mvem7 DAB066RxfzAxHRb9OvcEONhzuzYnj+Gi5OoD2hurhM7Ck63cHAvi65vRmkPHawsHiRlyUxUI E0/eHBWjBNH+vQFV7AfiFIytcYORpE/2T82nx6lFzvFrq6/vsTZ2m1UJ5HifusN6m6Mq0VGo tJhtTNyec/rKLEMRqHBPR2qyhuAKBkmWCEYLgiB+LGvTIibJ9LvXXwx4kr9H3ZiYT3u8I+N3 88FhfHzg/Yi5cTKm2uSRU+q/lBf31TTjzsFNBFj5szgBEACodliMRp6XsVb4TNbZK9JMGAx/ zV4HZOW7LMrDuauU2AGeY8MdzLEWhH3gARzgwnji4zoNi1mftrN5m7l5Mo8LR0MSfEzISA0o bbIqPG6bHRUV2i3zVjxIZQUoc5p4CwYdt2R1EMrfwe3o0RSQae1W0aiZCRRVFvyHImuQo1oG 5GNmhB1TW0RBL6OoFHKkBTdhT9Kkl/bNL1pWlXIkUYH1zmvwUIbswlRq9vnr2nGroS4pONKj mXFnOyzQrSw+HokwWi1mIJTfUWwJVKFTeWcD1MG6LEQhSSy3/h8EHfxzt0DDSgVdoPEzQ5g/ vjQV79rBSDiDSC3eGfpEzDabFlq16zKR3VKZ+b19NWIF6o4ZIfp2R08GHwFSzx9VNw/3RqSp UuJuRGS6+IRE0uGLzEmIzD+hYpMvcawT1QOgcbf/1dbtx9yt3W4EADT+cIReThjs8TtLd+4b Q26TnP0ZRweU3cvKZTsCLSupC2bzYQUpCK9lT/G5ZG2RZ8cA4gyGcqXFwPgJ1qPXpQv/1esd WcJ1pBXYyj/rTzFysjzrkXiW5n4jkhIx/QAvZ//+Q+m174AY2BRsNq4BVLS3BzwpiAx32Tp6 FcEUZWxjZ2r2ra1PyO1EMuKqnNmiynwlBoA/TISV8l/hok6HZF0zdef5lULdprGrdIDlPLhv J27N/7sdjQARAQABwsFlBBgBAgAPBQJY+bM4AhsMBQkDwmcAAAoJELvNRitMMx01xBsP/2e8 a6drTDEsUYvz5IyQMOu86mp5KTnovRDuTTMfgQVXHWwJMzcOmqrajVYaBeebi+AgbDWRZs4F 0MXWIlI2zfUVjgdEltqtr0HNKR+UdbRaCrSUQAb3Bkx7OSx1GnJktVv94517TXrLoRephN/v fnLe0rue8tfGP2ue41WKvdRq6yangJGa0FlSw6FpYxtO2eZyA49YLnXUGOLnr3hgM7lj8jRj RjkBe6C2l+X0B5H3NxtNv2NuwWGVvCBYKrdnT71Q6UoDWjsUlmO8PbysGQ0zRzblqMZru6O1 GaSyN0e0ChvngtBL2vFqZwuZFDMExOAEslJRxztVvbSKy2o/uQsvdPEHLtn0QbZglsgCjSDh r+Sp//5jEL87CDr+vInXbSKHeqnfkWXJq/DBGmreAqnHVho7UVtnyi/v8B9gPC9Bn/Zq2H6l BuvN+Km1tBfDY/2ILKdA5jhO1Osedip7BvBHPpq+JnTFQtsu5bhPBEI1xf7ghaklm25uR+2m vBzgLYqfSVcXQT1IQLYJOCJXTzebhbpzenxnUkfDShEjtNR4HZJjc+3kq+vfmbiCA8en4Yw9 3XpPx+FGGRi8Zn+ZKsMxN6ifwyJurW9aqZfRjnTiWp5i9kEY9X9l0JcuLTpPEF6rsiGUokQe S/3mELhhbHjD5l6T3DV70/Wg8L7qdF4Y Message-ID: <0a9228f1-338e-06a3-f3f4-6b27eea71408@iee.org> Date: Mon, 25 Jun 2018 15:46:29 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Project discussion list X-BeenThere: gentoo-project@lists.gentoo.org Reply-To: gentoo-project@lists.gentoo.org MIME-Version: 1.0 In-Reply-To: <23344.65054.620110.958503@a1i15.kph.uni-mainz.de> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="W6Fy8kiVmFpN28EVac24LGiImxiam75lr" X-Provags-ID: V03:K1:i5HirdJKbwtHNw7EtJAfklaftXEATe8dXJK1K9unR/KCNurv8eg jx6mYCigmXiChhMt8BwDq89FsA5X2Bw70+YfQCAywsUAZ8aNmRoMr1r8H3p4zLUUVeG9Q5y vqq+kLQy60MEMUqXfx7b6zHP04bEOobFmhmqBaNvv7ryLwT2jzxaJNQin4AYRUivhiDU1xb zYEtokRhp7dD1jnT3yU7Q== X-UI-Out-Filterresults: notjunk:1;V01:K0:5ywOSzA1KGg=:lKn8WnPffHMeegtrHAlrbb VWi6fu51UQ77NpLEQHtZJjOLowlEIphhXFRD8BEA1DG12aSCHVkHe/OtzoMIhkbAuN/aZTEj7 TKIYmirq/Ni2nkII3XAhyPboAMpMkhiGMneHbFkZELYD5flPkRqwfPs38BdKx1DeTkaOZEXfM YNCJsF+cIBHcdbZWEnUYW+WHwY2mXYIsL1SZQOdM66hne7RH6N4MtCKRg1keGVgmcUs1ke5l5 sN26nxPqH0QjYlLWN/ek68Iy2eCgkgO1SXWA0E2sjY4PYOutrmzMFrx4liVmn9CCryrS5KbQP JipGaTdBIWA/MFU1Jhkpyp+jSEUdgWrW4fIEDVY74vvp1VZwCOmXdSZEAc1kekJ3CH1ER1RFH xDf9JLIxt1yaXQTbKdwXI7ER9nP/SfY7eauLbl7E+sRsPOlXJaLt0LL/6/NDkxteAm0kGTlUT p+aGMi6zudzCq+yvln0pzbVqfZbdFaDco6rRoPSRvKres3xjq/gCnzm02/vjRCRrHrhQGNGhU lfOSd/ITkgVJPYisqYQEXW13yR0Yr3qqM4MvqvvfQphwCOedWKRRMPX222Yn/NmQGELrjJ9kL G4lGlHAi8EbsdVUJPb85GX4YsesogdJ7Kgsh0O49ZQQgKiy2L9SPz5UtXGN3n7z0Hx82UvaFc yZJkxe+KXGCJQBnLlzyH3bdzrcSTLTuXlrpQeGowARLEYG2ebBP5k8rYc8kDduF3Ysv5vyxou ttMj9deFu1rtWuEuJWSWdP0tyLesFJIKME8fWNpKKSV/4VQTC3NMJYw77tc= X-Archives-Salt: ab2b8b28-5992-4506-a0b3-98d7a61ee207 X-Archives-Hash: 2646baa6dab18a6cc73844c8a0e13519 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --W6Fy8kiVmFpN28EVac24LGiImxiam75lr Content-Type: multipart/mixed; boundary="YGf33smI4UjCGlPSCAwr2FSUPCp1kJQ8V"; protected-headers="v1" From: "M. J. Everitt" To: gentoo-project@lists.gentoo.org Message-ID: <0a9228f1-338e-06a3-f3f4-6b27eea71408@iee.org> Subject: Re: [gentoo-project] Re: [gentoo-core] Re: Poll: Would you sign a Contributer License Agreement? References: <23310.46809.293787.611345@a1i15.kph.uni-mainz.de> <23317.12829.91552.529904@a1i15.kph.uni-mainz.de> <20180625013334.GA28404@kroah.com> <23344.37042.753481.563752@a1i15.kph.uni-mainz.de> <20180625070525.GA6151@kroah.com> <23344.40875.105369.227774@a1i15.kph.uni-mainz.de> <20180625110540.GB3058@kroah.com> <23344.65054.620110.958503@a1i15.kph.uni-mainz.de> In-Reply-To: <23344.65054.620110.958503@a1i15.kph.uni-mainz.de> --YGf33smI4UjCGlPSCAwr2FSUPCp1kJQ8V Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-GB On 25/06/18 15:37, Ulrich Mueller wrote: >>>>>> On Mon, 25 Jun 2018, Greg KH wrote: >> And I'm dragging this back to -core, as I'm not on -project, so my >> responses are not even going there, and you started this on -core. > Nope, I started the thread on -project on 2018-05-30: > https://archives.gentoo.org/gentoo-project/message/b1d92fc4275c15a052cf= 27bb2a5d75dd > I cross-posted to -core once (on 2018-06-04) for wider audience, > because I had received only a handful of replies by then. > > Otherwise, there is no reason why this discussion should take place in > private, so it is off-topic in -core. > >>> With the license currently listed at https://developercertificate.org= / >>> ("changing is not allowed") nobody would even be allowed to commit >>> the DCO to a repository under it's own terms. Catch-22. >> And as the Debian developers said, "that's crazy-talk, don't worry >> about it." Seriously, don't. > If anyone worries about non-free files in their repositories, then > it's Debian. Certainly much more than we do. > > Also, encouraging people to falsely certify things (and "don't worry > about it") is exactly what we want to avoid. If there is a S-o-b line > included with a commit, then there must not be any doubt that this > commit conforms to the wording of the certificate. If we allow people > to commit non-free files and certify them under the Linux DCO 1.1 then > the whole exercise is useless. > >> And if you do have a lawyer who is worried about such a thing, >> please let me talk to them and I'll be glad to put them in contact >> with loads of other lawyers who will be glad to discuss it. >> What company or legal entity has concern with the DCO as-written? > Everybody who wants to commit a license file to the Gentoo repository, > and with the DCO 1.1 would have to lie about its status? > >> That's not the only thing that you have changed here, as you state. >> You changed the wording of the types of licenses (hint, "free >> software" is not the same as "open source" and has consequences by >> changing that wording.) > It is generally acknowledged that "open source" licenses and "free > software licenses" are mostly congruent. (There are very few OSI > approved licenses like Artistic 1.0 which the FSF classifies as > non-free. The other way around, I am not aware of any.) > > Nevertheless, I don't have a strong opinion here. Our Social Contract > says "free software", so we changed it to that for consistency, but > replacement of the term alone wouldn't be a sufficient reason to > create a modified version. > >>> Do you think that anybody would have difficulties understanding >>> this? Then please propose a better wording. >> I am saying, over and over and over, that it's not up to me to >> change the wording. I want _you_ to justify the change by getting a >> solid legal opinion that what you are changing actually does what >> you think it does, and is even needed in the first place. >> Again, don't try to arm-chair legal issues. That ends up causing >> many more problems than you can ever imagine. There's a good reason >> that lawyers write licenses and legal texts as they understand >> things that are not obvious to non-legally-trained people. > (Sometimes I wonder how some people survive. Do they ask their lawyers > before passing a green traffic light? Or before agreeing to a contract > of sale in the grocery store? :-) > >> And again, you are ignoring the fact that we all are now going to >> have to get the legal departments of our companies to evaluate this. >> That will NOT take just 1 minute. If you use the DCO as-is, that >> would only take 1 minute. > How about the following change then: > > --- a/glep-0076.rst > +++ b/glep-0076.rst > @@ -133,12 +133,17 @@ with the project's license. > For commits made using a VCS, the committer shall certify agreement > to the Gentoo DCO by adding ``Signed-off-by: Name `` to the > commit message as a separate line. Committers must use their real > name, i.e., the name that would appear in an official document like > a passport. > =20 > +As an alternative to the above, commits may be certified with the > +Linux Kernel DCO 1.1. Committers shall clearly indicate this by > +adding ``(Linux DCO 1.1)`` at the end of the ``Signed-off-by`` line. > +Using the Gentoo DCO is strongly preferred, though. > + > The following is the current Gentoo DCO:: > =20 > Gentoo Developer's Certificate of Origin, revision 1 > =20 > By making a contribution to this project, I certify that: > =20 > > It would allow anyone who has issues with our modified version to > commit under the original Linux DCO instead. Of course, certain files > they couldn't commit then. > > Ulrich I make a simple observation based on the thread here. I would personally probably be more comfortable under a DCO that has "large organisation" backing eg. Linux kernel, as the effort required to make changes is likely to be significant, and it is likely to have been vetted by "qualified persons". By contrast, Gentoo is likely to have been cobbled together by a consensus of unqualified persons, and is quite unlikely to be defended in court, -should- it come to that (see recent legal case of McHardy et al). Not that I have any issue with Gentoo having it's own, but it lacks teeth and claws. ----- another 2c from the peanut gallery. Apologies. --YGf33smI4UjCGlPSCAwr2FSUPCp1kJQ8V-- --W6Fy8kiVmFpN28EVac24LGiImxiam75lr Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEERR5DB4J2baXtk4AVu81GK0wzHTUFAlsxAEUACgkQu81GK0wz HTVzmw//SMmQL1tDF2UslI2EG+KoVK//5Jz2Wx8jWS3Up6xp77sfwszLDrSbGAHt C1+3fLvbIfrxTSWGxx3oaDgFoH2OfaMP5gpLOym1yLaeTgETNaQV8KE98eUKPQWo UfvYcSR90u2CPBhFTqkKGPrYoS+8PjWUINkiMEvdZFEloSOZ0hEAfIc+7UG4cz4v ssE1gqmytl55fFk3WalqYHaYh0nEijdssjRNTVWNyqaJBGAf8azv6/oAHSM7MnA1 xW1BH4ROCDQ8jeZ9SaF3dzO+/mgSTVsw7wMAPGiulZCs9OzLId9RjZvLxayNHQBB 3pMcCQQynnKiR/fToUlSAbQu76tQHRBlX6L6kPINcEVp6Mn4g9x55GSOQ8p8eh09 EliG2LdRkJ+GdKxo5jnJeHi3/HLpIFtJG8nLezBMXp6oo1eAt0GgdD1aMS9DX697 gCEVjQsEEt+BvF5G6JYE7Wl+jIQHxqNhqy6zH1P6RGdk3T2UOA+seIjJDRsErdQ5 plKoBuL9J6dFSDi1ENx9WV93af7drdiqmX+WWmudyYonxJqD53wGaGahw92xzIyc KhVxWUQ9nBCT+pHGKt5fTkyPjB5PyGRLBuYC4A3BDhP1HjnOc3uOltNE+KOcZAk2 NMmdDV55aFHZXU8GAnBGPJ/tpQGEmLVVAX12Kzy6TKmhBtFGTYQ= =l6HU -----END PGP SIGNATURE----- --W6Fy8kiVmFpN28EVac24LGiImxiam75lr--