Re: [gentoo-project] Repo mirror & CI: official statement wrt GitHub

[Rich Freeman <rich0@gentoo.org>]

On Fri, Jun 15, 2018 at 10:55 AM kuzetsa <kuzetsa@gmail.com> wrote:
>
> "Gentoo Developer's Certificate of Origin" - shouldn't
> the author / contributor themselves be involved in this?
>

It already requires this.  The committer would have to certify:

" (4) The contribution was provided directly to me by some other person
        who certified (1), (2), (3), or (4), and I have not modified it."

(or one of the other items in the list, if they did modify it)

Ultimately the committer is the person Gentoo has a relationship with,
so they need to make the certification when they make the commit, even
if it is just certifying that somebody else certified it.

This goes along with something Thomas said earlier - ultimately the
committers are responsible for what they commit.  There really isn't a
sane alternative since the whole reason we try to control our
committers is to ensure that things don't end up in the repository
which shouldn't be there.  This isn't diminishing the value of 3rd
party contributors - but simply affirming the value-add of having
somebody we know actually look at what is being contributed.  That
includes the copyright/license and not just the code.  After all, all
this stuff ends up on all our users's systems so we want to protect
them as well as ourselves.  Users already have the freedom to use any
overlays they wish if they value these things differently.

--
Rich