Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements

[Rich Freeman <rich0@gentoo.org>]

On Wed, Jul 28, 2021 at 7:22 AM Ulrich Mueller <ulm@gentoo.org> wrote:
>
> >>>>> On Wed, 28 Jul 2021, Andrew Ammerlaan wrote:
>
> > So if we allow contributions without a sign-off from the contributor
> > the sign-off from the developer is meaningless since neither 1, 2, 3,
> > or 4 applies to the commit.
>
> if there's even the slightest chance that the contribution could be
> taken from proprietary software, you are well-advised _not_ to accept it
> unless it carries a sign-off of its contributor.

In the US at least (and probably most countries), ALL code is
proprietary, unless the author of the code has released it under an
open source license.

If the original contributor hasn't signed off on the DCO, or somehow
otherwise communicated how they have licensed it, under what basis
would you conclude that it isn't anything other than proprietary
software?  At best you'd have to determine whether the contribution is
so trivial as to not be copyrightable, and that seems like a road we
wouldn't want to go down.  (Note: copyrightable patches to GPL
software are not automatically GPL, even if they are illegal to
distribute under anything other than the GPL.  The author STILL has to
actively license it under the GPL, otherwise it basically becomes
non-distributable due to license conflict.)

Now, whether we want to require real names/etc from outside
contributors is another matter.

Part of the purpose of the DCO is to be a streamlined way for
contributors to communicate the copyright status of their
contributions.  If we're not going to accept pseudonyms there, then it
doesn't make sense to instead accept them using non-standard wording
in random emails that are themselves backed only by a pseudonym, or
random non-logged conversations.  If we are going to want committers
to somehow confirm that the contributor has made the contribution FOSS
then we might as well just have the contributors sign the DCO however
they wish since that at least systematically captures this event.

I'd suggest maybe clarifying that the real-name requirement only
applies to committers, and that the 4 elements of the DCO always
apply, and the 4th element can be accomplished by having the
contributor sign the DCO however they wish.  Basically that would be
the status quo in terms of what is actually going on, as I understand
it.

-- 
Rich