Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Thomas Deutschmann <whissi@gentoo.org>]

[-- Attachment #1.1: Type: text/plain, Size: 2995 bytes --]

On 2019-07-01 00:27, Robin H. Johnson wrote:
> As a clear example of meaningful agreement to the DCO vs the
> autogenerated agreement that Patrick is concerned about, look at GnuPG's
> model:
> 
> 1. A new contributor must send a OpenPGP-signed copy of the GnuPG DCO
>    text to the public mailing list (the exact wording of the DCO
>    contains only a minor change s/open/free/ per FSF principles).
> 2. Signed-off-by trailer in the commit message is ALSO required, and is
>    only used to verify against the DCO registry.

From my understanding of Patrick's concerns, this doesn't change
anything for him: It's still possible to autogenerate such a statement.

From my understanding he is questioning the whole idea behind this: I.e.
is there really a chance that this will protect anyone/anything? Is
there really a chance that the committer can be legally held accountable?

At least in Europe, a GPG signature has no legal meaning. You will need
a qualified digital signature for any legal implications.

There are still companies/projects out there requiring that you add your
handwritten signature below the CLA (i.e. this will require that you
send the document via post or fax).

So if we are not 100% sure that this will fix a real problem and will
stand up in court if necessary, the whole thing was just a waste of time.

But maybe that's not what Patrick wanted to say :-)


I was told that the main driver for GLEP 76 was to protect the Gentoo
foundation: Whenever something happens within Gentoo namespace, Gentoo
foundation is the only accountable body.

In case someone violated DCO and added IP he/she didn't own, the main
interest of the actual copyright owner is to remove the IP in question.
I really hope we will never experience such a situation but judging from
GitHub's public DMCA log I would expect that we will either have to
spend a lot of money trying to defend Gentoo or would at least have to
prune (rewrite) repository to get rid of any affected fragment (which
could be challenging).

The copyright holder may also demand compensation.

It's important to understand that the foundation will have to pay for
this...

Now thanks to the DCO statement, the foundation is in the position to
get the money back from contributor who violated DCO and caused the
trouble. Because I don't expect that the contributor will say, "Oh
right, I am sorry, this was my fault, let me pay your expenses",
foundation will now have to sue the contributor. The chances of success
are very low if contributor isn't within same jurisdiction. In other
words: It will be hard for the foundation to sue anyone in Europe for
example because the GPG-signed statement has no legal significance for
Europeans.

So this is mainly a US-only thing from legal perspective, if at all (I
am not familiar with US law).


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]