Re: [gentoo-project] Repo mirror & CI: official statement wrt GitHub

[Rich Freeman <rich0@gentoo.org>]

On Fri, Jun 15, 2018 at 12:03 PM kuzetsa <kuzetsa@gmail.com> wrote:
>
> from: "$ man git-commit" :  [...] The meaning of a
> signoff depends on the project, but it typically
> certifies that committer has the rights to submit
> this work [...]
>
> this is frustratingly vague (to me), but I suppose
> the extra metadata included in the same paragraph
> has a link to: https://developercertificate.org/

Well, we aren't using that as-is, but a modified version of this.
Gentoo policies aren't contained in manpages.

The Gentoo policy is in draft GLEP 76:
https://gitweb.gentoo.org/data/glep.git/tree/glep-0076.rst

(It was posted a few days ago on this list, and discussed here in
various forms over the last few years.)

> ^ took me a few minutes to figure out what you meant,
> or where that particular quote came from:

It came from GLEP 76 (still in draft).  It is of course based on the
Linux DCO (which I believe is attributed in the GLEP).

> I had never considered this, because historically,
> gentoo developers who use their PGP key to commit
> rarely use the --signoff feature when committing the
> submissions of a contributor, and even if they had,
> there's not a stable definition.

Today they shouldn't be using --signoff, because there IS no official
policy.  They will be required to do so once GLEP 76 is approved (this
will be enforced with a commit hook).

> "some other person who certified" - does this mean the
> contributor needs to use their PGP key to sign or...?
>
> it would be good for gentoo to have clarity on this.

IMO it is up to the certifier to decide what constitutes a
certification made by somebody else.  This is necessarily outside of
Gentoo so to try to impose a particular mechanism would make it harder
to use outside code.  For example, all Linux commits have a DCO
signoff, but these have no GPG signoffs to go with them.  We wouldn't
want to block people from using GPL2 Linux code just because they use
a different mechanism to track such things.

The Gentoo DCO is an agreement between the Gentoo committer (a Gentoo
dev) and Gentoo.

That is roughly how I see it at least.

--
Rich