public inbox for gentoo-project@lists.gentoo.org
 help / color / mirror / Atom feed
* [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
@ 2021-07-28  4:07 Joonas Niilola
  2021-07-28  4:29 ` Sam James
                   ` (4 more replies)
  0 siblings, 5 replies; 31+ messages in thread
From: Joonas Niilola @ 2021-07-28  4:07 UTC (permalink / raw
  To: gentoo-project; +Cc: Joonas Niilola

Summary:
Make it clearer that a sign-off to a git commit is only required from
the committer, not from the author. It's only encouraged for the
authors.

Rationale:
1. We're actively rejecting contributions from people who do not wish to
have their real name shown in public, or link it to their Git*
accounts.

2. We have no way of knowing or confirming whether the given name is
"legal". I'd rather not have the sign-off from the author in the first
place than see clearly made up names in there, with a fresh-made Git*
account with no prior activity.

3. Recently we've had a couple of cases where our long-standing
contributors, with ~300 commits in total, reveal they've been using
pseudonyms. I'm sure there are many others. AFAIK all their commits
should then be revoked, and possibly future contributions rejected
due to trust issues?

4. As said, there are already devs committing work from people we
know to have made-up names. And/or there are devs committing patches
without the sign-off to begin with.

5. The infra git-hooks currently only check for a matching sign-off
from the committer anyway.

Final words:
So currently, this GLEP can be interpreted in two different ways: the
sign-off is and isn't required from the author. This does harm
towards contributors who work with devs who do require the sign-off
from the author, and thus the GLEP needs to be updated and enforced
one way or the other. I vote what benefits our contributors, and
therefore us, better.

Signed-off-by: Joonas Niilola <juippis@gentoo.org>
---
 glep-0076.rst | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/glep-0076.rst b/glep-0076.rst
index 4aa5ee5..faa760d 100644
--- a/glep-0076.rst
+++ b/glep-0076.rst
@@ -8,10 +8,11 @@ Author: Richard Freeman <rich0@gentoo.org>,
         Michał Górny <mgorny@gentoo.org>
 Type: Informational
 Status: Active
-Version: 1.1
+Version: 1.2
 Created: 2013-04-23
-Last-Modified: 2018-12-09
-Post-History: 2018-06-10, 2018-06-19, 2018-08-31, 2018-09-26
+Last-Modified: 2021-07-28
+Post-History: 2018-06-10, 2018-06-19, 2018-08-31, 2018-09-26,
+              2021-07-28
 Content-Type: text/x-rst
 ---
 
@@ -138,7 +139,10 @@ the Certificate of Origin by adding ::
 
 to the commit message as a separate line.  The sign-off must contain
 the committer's legal name as a natural person, i.e., the name that
-would appear in a government issued document.
+would appear in a government issued document. It's strongly encouraged
+that the original contribution author also adds their sign-off, to at
+least indicate they are aware of this GLEP. But it's required only
+from the committer.
 
 The following is the current Gentoo Certificate of Origin, revision 1:
 
@@ -301,6 +305,9 @@ iv.  The original point (d) has been transformed into a stand-alone
 v.   The term "open source" has been replaced by "free software"
      throughout.
 
+vi.  Clarify that a sign-off is only strictly required from the
+     committer, not from the author.
+
 The new point was deemed necessary to allow committing license files
 into the Gentoo repository, since those files usually do not permit
 modification.  It has been established that adding a clear provision
-- 
2.31.1



^ permalink raw reply related	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28  4:07 [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements Joonas Niilola
@ 2021-07-28  4:29 ` Sam James
  2021-07-28  9:49   ` Emily Rowlands
  2021-07-28  7:14 ` Michał Górny
                   ` (3 subsequent siblings)
  4 siblings, 1 reply; 31+ messages in thread
From: Sam James @ 2021-07-28  4:29 UTC (permalink / raw
  To: gentoo-project; +Cc: Joonas Niilola

[-- Attachment #1: Type: text/plain, Size: 3789 bytes --]



> On 28 Jul 2021, at 05:07, Joonas Niilola <juippis@gentoo.org> wrote:
> 
> Summary:
> Make it clearer that a sign-off to a git commit is only required from
> the committer, not from the author. It's only encouraged for the
> authors.
> 

Big thanks for working on this. It seems reasonable to me and you know
that I've got strong feelings on including more contributors -- as have you!

I have some thoughts I've outlined below about _possible_ clarifications
we could make, but they're not objections to this as-is.

For the benefit of the archive/anyone who isn't caught up:
it may be worth reading robbat2's thread for additional context/thoughts/
discussion on this [0].

> Rationale:
> 1. We're actively rejecting contributions from people who do not wish to
> have their real name shown in public, or link it to their Git*
> accounts.
> 

This has been a matter of complaint from contributors, often wanting to make
trivial or small changes for quite some time, and is the real motivation
for me in wanting to see a change.

> 2. We have no way of knowing or confirming whether the given name is
> "legal". I'd rather not have the sign-off from the author in the first
> place than see clearly made up names in there, with a fresh-made Git*
> account with no prior activity.
> 

Maybe we could add that developers should drop signoffs from people
with pseudonyms (I'm thinking where the contributor freely admits such,
not where we're guessing - in case it's added accidentally or out of habit,
etc).

I understand if you'd rather not get into that, but I was thinking
this would be useful to avoid having the debates in future if someone
ends up retaining it. I'd like to know if I should be dropping it in such cases,
but maybe we can just reach that via consensus on the ML.

Just a thought.

> 3. Recently we've had a couple of cases where our long-standing
> contributors, with ~300 commits in total, reveal they've been using
> pseudonyms. I'm sure there are many others. AFAIK all their commits
> should then be revoked, and possibly future contributions rejected
> due to trust issues?

I don't think that's written down anywhere and part of the problem
is that at least in the UK, AFAIK, if it's a name you're legitimately using,
it's yours -- even if you weren't born with it, and so on.

So, my point is, even if a contributor is trying to be honest with us,
it doesn't mean we can assume anything about the validity of past statements.

But again, not looking to get into that either way. I'm generally happy
people have felt comfortable enough to be honest with us knowing
the potential risks.

> 
> 4. As said, there are already devs committing work from people we
> know to have made-up names. And/or there are devs committing patches
> without the sign-off to begin with.
> 

Yep. I think the worst thing for everybody is when developers end up committing
as themselves but note the patch is from XYZ because it just makes the git
history slightly less useful. It doesn't change the contribution at all.

> 5. The infra git-hooks currently only check for a matching sign-off
> from the committer anyway.
> 
> Final words:
> So currently, this GLEP can be interpreted in two different ways: the
> sign-off is and isn't required from the author. This does harm
> towards contributors who work with devs who do require the sign-off
> from the author, and thus the GLEP needs to be updated and enforced
> one way or the other. I vote what benefits our contributors, and
> therefore us, better.

+1.

> 
> Signed-off-by: Joonas Niilola <juippis@gentoo.org>
> ---
> [snip]

[0] https://archives.gentoo.org/gentoo-project/message/26d68349541e4db54a93edf57d6e7404

best,
sam

[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28  4:07 [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements Joonas Niilola
  2021-07-28  4:29 ` Sam James
@ 2021-07-28  7:14 ` Michał Górny
  2021-07-28 10:39   ` Ulrich Mueller
  2021-07-28 10:49 ` Andrew Ammerlaan
                   ` (2 subsequent siblings)
  4 siblings, 1 reply; 31+ messages in thread
From: Michał Górny @ 2021-07-28  7:14 UTC (permalink / raw
  To: gentoo-project; +Cc: Joonas Niilola

On Wed, 2021-07-28 at 07:07 +0300, Joonas Niilola wrote:
> @@ -138,7 +139,10 @@ the Certificate of Origin by adding ::
>  
>  to the commit message as a separate line.  The sign-off must contain
>  the committer's legal name as a natural person, i.e., the name that
> -would appear in a government issued document.
> +would appear in a government issued document. It's strongly encouraged
> +that the original contribution author also adds their sign-off, to at
> +least indicate they are aware of this GLEP. But it's required only
> +from the committer.

To be honest, the wording sounds a bit backwards.  'Commiters must do X
but we encourage everyone to do X but it's only required from
committers.'

Let's maybe start by replacing 'the committer shall' with 'the committer
must'.  As the next sentence, something akin 'Other authors contributing
to the change are also encouraged to include their sign-off but
the committer decides whether these sign-offs are required'.  And then
the common part about real name, as it applies the same to both.

>  
>  The following is the current Gentoo Certificate of Origin, revision 1:
>  
> @@ -301,6 +305,9 @@ iv.  The original point (d) has been transformed into a stand-alone
>  v.   The term "open source" has been replaced by "free software"
>       throughout.
>  
> +vi.  Clarify that a sign-off is only strictly required from the
> +     committer, not from the author.
> +
>  The new point was deemed necessary to allow committing license files
>  into the Gentoo repository, since those files usually do not permit
>  modification.  It has been established that adding a clear provision

-- 
Best regards,
Michał Górny




^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28  4:29 ` Sam James
@ 2021-07-28  9:49   ` Emily Rowlands
  0 siblings, 0 replies; 31+ messages in thread
From: Emily Rowlands @ 2021-07-28  9:49 UTC (permalink / raw
  To: gentoo-project

On 28/07/2021 05:29, Sam James wrote:

>> 3. Recently we've had a couple of cases where our long-standing
>> contributors, with ~300 commits in total, reveal they've been using
>> pseudonyms. I'm sure there are many others. AFAIK all their commits
>> should then be revoked, and possibly future contributions rejected
>> due to trust issues?
> 
> I don't think that's written down anywhere and part of the problem
> is that at least in the UK, AFAIK, if it's a name you're legitimately using,
> it's yours -- even if you weren't born with it, and so on.

This is true, the requirement for changing your name in the UK is simply
"write some magic legal words on a bit of paper and have a friend sign
it". There is no central register of "legal names", aside from perhaps
the list of people who have passports/driving licenses etc. More
information can be found here: https://www.freedeedpoll.org.uk/free

Emily


^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28  7:14 ` Michał Górny
@ 2021-07-28 10:39   ` Ulrich Mueller
  2021-07-28 11:50     ` Thomas Deutschmann
  0 siblings, 1 reply; 31+ messages in thread
From: Ulrich Mueller @ 2021-07-28 10:39 UTC (permalink / raw
  To: Michał Górny; +Cc: gentoo-project, Joonas Niilola

[-- Attachment #1: Type: text/plain, Size: 2268 bytes --]

>>>>> On Wed, 28 Jul 2021, Michał Górny wrote:

> On Wed, 2021-07-28 at 07:07 +0300, Joonas Niilola wrote:
>> @@ -138,7 +139,10 @@ the Certificate of Origin by adding ::
>>  
>>  to the commit message as a separate line.  The sign-off must contain
>>  the committer's legal name as a natural person, i.e., the name that
>> -would appear in a government issued document.
>> +would appear in a government issued document. It's strongly encouraged
>> +that the original contribution author also adds their sign-off, to at
>> +least indicate they are aware of this GLEP. But it's required only
>> +from the committer.

> To be honest, the wording sounds a bit backwards. 'Commiters must do X
> but we encourage everyone to do X but it's only required from
> committers.'

+1

> Let's maybe start by replacing 'the committer shall' with 'the
> committer must'.

I tend to disagree. "Shall" means that it is mandatory, see (e.g.)
RFC 2119 [1]. Also I am pretty sure that we've discussed this point when
drafting the original version.

> As the next sentence, something akin 'Other authors contributing to
> the change are also encouraged to include their sign-off but the
> committer decides whether these sign-offs are required'.

Honestly, that isn't much better. It is optional for authors but the
committer decides if it is mandatory?

Maybe something along the lines of: "It is strongly recommended that
contributors also include their sign-offs. In particular circumstances,
the committer may decide that these sign-offs are not required. In this
case, the committer cannot certify the contribution by point 4., but
must certify it by point 1., 2., or 3."

("Recommended" and "in particular circumstances" borrowed from RFC 2119,
too.)

> And then the common part about real name, as it applies the same to
> both.

+1

>> +vi.  Clarify that a sign-off is only strictly required from the
>> +     committer, not from the author.
>> +

This hunk should be omitted because it is not related to the certificate
of origin. The GLEP editors will add a note under "Status" when (and if)
the update is reapproved by council and board of trustees.

Ulrich

[1] https://datatracker.ietf.org/doc/html/rfc2119

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28  4:07 [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements Joonas Niilola
  2021-07-28  4:29 ` Sam James
  2021-07-28  7:14 ` Michał Górny
@ 2021-07-28 10:49 ` Andrew Ammerlaan
  2021-07-28 11:22   ` Ulrich Mueller
  2021-07-28 17:30 ` Alec Warner
  2021-08-05  6:01 ` Anna Vyalkova
  4 siblings, 1 reply; 31+ messages in thread
From: Andrew Ammerlaan @ 2021-07-28 10:49 UTC (permalink / raw
  To: gentoo-project

On 28/07/2021 06:07, Joonas Niilola wrote:
> Summary:
> Make it clearer that a sign-off to a git commit is only required from
> the committer, not from the author. It's only encouraged for the
> authors.

I am not a lawyer so I might be completely wrong, but to me this is very 
confusing. According to the GLEP the whole point of the sign-off is to 
state agreement to the Certificate of Origin, the purpose of which "is 
to declare that the contribution can be modified and redistributed in 
accordance with the project's license".

Now if I read this Certificate of Origin, and apply it to the situation 
where I am merging an user contribution:

 > 1. The contribution was created in whole or in part by me, and I have 
the right to submit it under the free software license indicated in the 
file; or

1 does not apply since I did not create the contribution, I am only 
merging it.

 > 2. The contribution is based upon previous work that, to the best of 
my knowledge, is covered under an appropriate free software license, and 
I have the right under that license to submit that work with 
modifications, whether created in whole or in part by me, under the same 
free software license (unless I am permitted to submit under a different 
license), as indicated in the file; or

2 may or may not apply depending on what the contribution exactly is. 
e.g. a new ebuild may or may not be based on previous work. (Though one 
could argue that everything is based on something (e.g. on an example in 
the devmanual), but in this interpretation point 2 more or less loses 
all meaning since it would apply to *everything*)

 > 3. The contribution is a license text (or a file of similar nature), 
and verbatim distribution is allowed; or

3 applies only if it is a license, for the sake of argument lets assume 
this contribution is not a license file.

 > 4. The contribution was provided directly to me by some other person 
who certified 1., 2., 3., or 4., and I have not modified it.

4 applies, but here's the catch. It only applies if the contributor has 
also included a sign-off.

So if we allow contributions without a sign-off from the contributor the 
sign-off from the developer is meaningless since neither 1, 2, 3, or 4 
applies to the commit.

Given the rationale outlined below, I do agree that something should 
change. However, I'm a bit concerned that the suggested solution of only 
requiring the sign-off from the developer kinda breaks the whole point 
of having the sign-offs in the first place since it breaks the 
Certificate of Origin.

Which brings me to my second point. As far as I know, pseudonyms can in 
fact hold (and therefore transfer and sign-off) copyright. There are 
many examples of books and other texts written by authors using a 
different name then their 'legal name'. Such texts are not treated 
(fundamentally) different under copyright law simply because the author 
chose to use a pseudonym. Now a book is not an ebuild, but why wouldn't 
the same apply here?

So given the above, why not simply drop the requirement for using a 
persons 'legal name' (which we cannot enforce anyway), and allow the use 
of pseudonyms? Isn't this a way easier solution to the problem that 
doesn't break the whole point of the sign-off?

But then again, I am not a lawyer, so please correct me if my analysis 
is wrong.

> Rationale:
> 1. We're actively rejecting contributions from people who do not wish to
> have their real name shown in public, or link it to their Git*
> accounts.
> 
> 2. We have no way of knowing or confirming whether the given name is
> "legal". I'd rather not have the sign-off from the author in the first
> place than see clearly made up names in there, with a fresh-made Git*
> account with no prior activity.
> 
> 3. Recently we've had a couple of cases where our long-standing
> contributors, with ~300 commits in total, reveal they've been using
> pseudonyms. I'm sure there are many others. AFAIK all their commits
> should then be revoked, and possibly future contributions rejected
> due to trust issues?
> 
> 4. As said, there are already devs committing work from people we
> know to have made-up names. And/or there are devs committing patches
> without the sign-off to begin with.
> 
> 5. The infra git-hooks currently only check for a matching sign-off
> from the committer anyway.
> 
> Final words:
> So currently, this GLEP can be interpreted in two different ways: the
> sign-off is and isn't required from the author. This does harm
> towards contributors who work with devs who do require the sign-off
> from the author, and thus the GLEP needs to be updated and enforced
> one way or the other. I vote what benefits our contributors, and
> therefore us, better.
> 
> Signed-off-by: Joonas Niilola <juippis@gentoo.org>
> ---
>   glep-0076.rst | 15 +++++++++++----
>   1 file changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/glep-0076.rst b/glep-0076.rst
> index 4aa5ee5..faa760d 100644
> --- a/glep-0076.rst
> +++ b/glep-0076.rst
> @@ -8,10 +8,11 @@ Author: Richard Freeman <rich0@gentoo.org>,
>           Michał Górny <mgorny@gentoo.org>
>   Type: Informational
>   Status: Active
> -Version: 1.1
> +Version: 1.2
>   Created: 2013-04-23
> -Last-Modified: 2018-12-09
> -Post-History: 2018-06-10, 2018-06-19, 2018-08-31, 2018-09-26
> +Last-Modified: 2021-07-28
> +Post-History: 2018-06-10, 2018-06-19, 2018-08-31, 2018-09-26,
> +              2021-07-28
>   Content-Type: text/x-rst
>   ---
>   
> @@ -138,7 +139,10 @@ the Certificate of Origin by adding ::
>   
>   to the commit message as a separate line.  The sign-off must contain
>   the committer's legal name as a natural person, i.e., the name that
> -would appear in a government issued document.
> +would appear in a government issued document. It's strongly encouraged
> +that the original contribution author also adds their sign-off, to at
> +least indicate they are aware of this GLEP. But it's required only
> +from the committer.
>   
>   The following is the current Gentoo Certificate of Origin, revision 1:
>   
> @@ -301,6 +305,9 @@ iv.  The original point (d) has been transformed into a stand-alone
>   v.   The term "open source" has been replaced by "free software"
>        throughout.
>   
> +vi.  Clarify that a sign-off is only strictly required from the
> +     committer, not from the author.
> +
>   The new point was deemed necessary to allow committing license files
>   into the Gentoo repository, since those files usually do not permit
>   modification.  It has been established that adding a clear provision
> 



^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 10:49 ` Andrew Ammerlaan
@ 2021-07-28 11:22   ` Ulrich Mueller
  2021-07-28 14:08     ` Marek Szuba
  2021-07-28 14:33     ` Rich Freeman
  0 siblings, 2 replies; 31+ messages in thread
From: Ulrich Mueller @ 2021-07-28 11:22 UTC (permalink / raw
  To: Andrew Ammerlaan; +Cc: gentoo-project

[-- Attachment #1: Type: text/plain, Size: 1486 bytes --]

>>>>> On Wed, 28 Jul 2021, Andrew Ammerlaan wrote:

> 4 applies, but here's the catch. It only applies if the contributor
> has also included a sign-off.

Exactly.

> So if we allow contributions without a sign-off from the contributor
> the sign-off from the developer is meaningless since neither 1, 2, 3,
> or 4 applies to the commit.

Typically, the committer would certify the contribution under 2. It's
the same situation when adding a patch taken from somewhere else, you
must certify it's free software "to the best of [your] knowledge".

So if there's even the slightest chance that the contribution could be
taken from proprietary software, you are well-advised _not_ to accept it
unless it carries a sign-off of its contributor.

> Which brings me to my second point. As far as I know, pseudonyms can
> in fact hold (and therefore transfer and sign-off) copyright. There
> are many examples of books and other texts written by authors using a
> different name then their 'legal name'. Such texts are not treated
> (fundamentally) different under copyright law simply because the
> author chose to use a pseudonym. Now a book is not an ebuild, but why
> wouldn't the same apply here?

This isn't about defending the copyright of the contributor (for which
a pseudonym would be fine, or at least it would be a problem of the
contributor). It is about due diligence when accepting contributions,
to make sure their origin is traceable. 

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 10:39   ` Ulrich Mueller
@ 2021-07-28 11:50     ` Thomas Deutschmann
  2021-07-28 15:42       ` Sam James
  0 siblings, 1 reply; 31+ messages in thread
From: Thomas Deutschmann @ 2021-07-28 11:50 UTC (permalink / raw
  To: gentoo-project


[-- Attachment #1.1: Type: text/plain, Size: 968 bytes --]

Hi,

this was also my understanding. GLEP 76 applies to everyone -- no 
exception and during discussion we explicit agreed that it's better to 
reject any contribution from individual(s) who cannot do the sign-off 
for whatever reason.

Keep in mind: Whoever will proxy such a commit will be 100% responsible 
in the end. For purely self-protection reasons nobody should proxy a 
commit he/she doesn't understand, doesn't know the origin or in general 
has any doubts about. _You_ will be responsible for this because _you_ 
introduced the commit in Gentoo.

That said, an individual who doesn't want to do the sign-off for 
whatever reason could also contribute without getting attribution if 
contributor will find a developer who is willing to do this (=what 
happens for most small proposed bug fixes via b.g.o for example).


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
fpr: C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 11:22   ` Ulrich Mueller
@ 2021-07-28 14:08     ` Marek Szuba
  2021-07-28 14:47       ` Ulrich Mueller
  2021-07-28 14:33     ` Rich Freeman
  1 sibling, 1 reply; 31+ messages in thread
From: Marek Szuba @ 2021-07-28 14:08 UTC (permalink / raw
  To: gentoo-project


[-- Attachment #1.1: Type: text/plain, Size: 1972 bytes --]

On 2021-07-28 12:22, Ulrich Mueller wrote:

> This isn't about defending the copyright of the contributor (for which
> a pseudonym would be fine, or at least it would be a problem of the
> contributor). It is about due diligence when accepting contributions,
> to make sure their origin is traceable.

I agree with the "due diligence" bit but not with the traceability 
requirement. The "Certificate of Origin" section of GLEP-76 clearly 
states that the purpose of the sign-off (which by the way applies only 
contributions made via VCS commits, as the GLEP stands there are no 
specific mechanisms described for contributions submitted in forms other 
than full Git commits, e.g. patches uploaded to Bugzilla or sent by 
e-mail) is "to declare that the contribution can be modified and 
redistributed in accordance with the project's license", and nothing in 
GCOv1 itself appears to me to contradict that statement. Finally, 
between what GAFAM, NSA/GCHQ, $country government etc. have been doing 
on the Internet, I am rather allergic to the whole idea of facilitating 
the tracking of people.

In short, I feel that since a) the whole point here is to establish 
ground rules for the copyright of Gentoo contributions, b) it is pretty 
much entirely based on to-the-best-of-one's-knowledge statements and 
acting in good faith, and c) we've got neither the means nor the 
authority to verify personal details provided by the contributors, I 
strongly feel there isn't much point in disallowing pseudonymous 
contributions. I for one would very much rather accept a steady stream 
of contributions from a single anonymous entity than have them scattered 
across fake but ostensibly real-name contributors. And it someone 
contributes something potentially lifted from proprietary software or 
otherwise fishy? It's up to the people pushing these commits to our 
repos to exercise their common sense and due diligence.

-- 
Marecki


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 11:22   ` Ulrich Mueller
  2021-07-28 14:08     ` Marek Szuba
@ 2021-07-28 14:33     ` Rich Freeman
  2021-07-29  6:39       ` Joonas Niilola
  1 sibling, 1 reply; 31+ messages in thread
From: Rich Freeman @ 2021-07-28 14:33 UTC (permalink / raw
  To: gentoo-project; +Cc: Andrew Ammerlaan

On Wed, Jul 28, 2021 at 7:22 AM Ulrich Mueller <ulm@gentoo.org> wrote:
>
> >>>>> On Wed, 28 Jul 2021, Andrew Ammerlaan wrote:
>
> > So if we allow contributions without a sign-off from the contributor
> > the sign-off from the developer is meaningless since neither 1, 2, 3,
> > or 4 applies to the commit.
>
> if there's even the slightest chance that the contribution could be
> taken from proprietary software, you are well-advised _not_ to accept it
> unless it carries a sign-off of its contributor.

In the US at least (and probably most countries), ALL code is
proprietary, unless the author of the code has released it under an
open source license.

If the original contributor hasn't signed off on the DCO, or somehow
otherwise communicated how they have licensed it, under what basis
would you conclude that it isn't anything other than proprietary
software?  At best you'd have to determine whether the contribution is
so trivial as to not be copyrightable, and that seems like a road we
wouldn't want to go down.  (Note: copyrightable patches to GPL
software are not automatically GPL, even if they are illegal to
distribute under anything other than the GPL.  The author STILL has to
actively license it under the GPL, otherwise it basically becomes
non-distributable due to license conflict.)

Now, whether we want to require real names/etc from outside
contributors is another matter.

Part of the purpose of the DCO is to be a streamlined way for
contributors to communicate the copyright status of their
contributions.  If we're not going to accept pseudonyms there, then it
doesn't make sense to instead accept them using non-standard wording
in random emails that are themselves backed only by a pseudonym, or
random non-logged conversations.  If we are going to want committers
to somehow confirm that the contributor has made the contribution FOSS
then we might as well just have the contributors sign the DCO however
they wish since that at least systematically captures this event.

I'd suggest maybe clarifying that the real-name requirement only
applies to committers, and that the 4 elements of the DCO always
apply, and the 4th element can be accomplished by having the
contributor sign the DCO however they wish.  Basically that would be
the status quo in terms of what is actually going on, as I understand
it.

-- 
Rich


^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 14:08     ` Marek Szuba
@ 2021-07-28 14:47       ` Ulrich Mueller
  2021-07-28 15:03         ` Rich Freeman
  2021-07-28 15:12         ` Andrew Ammerlaan
  0 siblings, 2 replies; 31+ messages in thread
From: Ulrich Mueller @ 2021-07-28 14:47 UTC (permalink / raw
  To: Marek Szuba; +Cc: gentoo-project

[-- Attachment #1: Type: text/plain, Size: 2363 bytes --]

>>>>> On Wed, 28 Jul 2021, Marek Szuba wrote:

> On 2021-07-28 12:22, Ulrich Mueller wrote:
>> This isn't about defending the copyright of the contributor (for which
>> a pseudonym would be fine, or at least it would be a problem of the
>> contributor). It is about due diligence when accepting contributions,
>> to make sure their origin is traceable.

> I agree with the "due diligence" bit but not with the traceability
> requirement. The "Certificate of Origin" section of GLEP-76 clearly 
> states that the purpose of the sign-off (which by the way applies only
> contributions made via VCS commits, as the GLEP stands there are no 
> specific mechanisms described for contributions submitted in forms
> other than full Git commits, e.g. patches uploaded to Bugzilla or sent
> by e-mail) is "to declare that the contribution can be modified and 
> redistributed in accordance with the project's license", and nothing
> in GCOv1 itself appears to me to contradict that statement. Finally, 
> between what GAFAM, NSA/GCHQ, $country government etc. have been doing
> on the Internet, I am rather allergic to the whole idea of
> facilitating the tracking of people.

Please read again what I've written. The origin of the contribution
should be traceable, not the contributor.

> In short, I feel that since a) the whole point here is to establish
> ground rules for the copyright of Gentoo contributions, b) it is
> pretty much entirely based on to-the-best-of-one's-knowledge
> statements and acting in good faith, and c) we've got neither the
> means nor the authority to verify personal details provided by the
> contributors, I strongly feel there isn't much point in disallowing
> pseudonymous contributions. I for one would very much rather accept a
> steady stream of contributions from a single anonymous entity than
> have them scattered across fake but ostensibly real-name contributors.
> And it someone contributes something potentially lifted from
> proprietary software or otherwise fishy? It's up to the people pushing
> these commits to our repos to exercise their common sense and due
> diligence.

We have taken the blueprint for the certificate-of-origin model from
Linux, and it does have a real name requirement. I'd rather not change
any element of it without getting legal advice first.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 14:47       ` Ulrich Mueller
@ 2021-07-28 15:03         ` Rich Freeman
  2021-07-28 15:08           ` Ulrich Mueller
  2021-07-29  6:36           ` Joonas Niilola
  2021-07-28 15:12         ` Andrew Ammerlaan
  1 sibling, 2 replies; 31+ messages in thread
From: Rich Freeman @ 2021-07-28 15:03 UTC (permalink / raw
  To: gentoo-project; +Cc: Marek Szuba

On Wed, Jul 28, 2021 at 10:47 AM Ulrich Mueller <ulm@gentoo.org> wrote:
>
> We have taken the blueprint for the certificate-of-origin model from
> Linux, and it does have a real name requirement. I'd rather not change
> any element of it without getting legal advice first.
>

While I completely get the sentiment, and tend to be a proponent of
real-name at least from Gentoo contributors, we have to keep in mind
that we're not Linux.

The Linux Foundation can afford to push people away, because half of
their contributions are probably corporate at this point, and most
contributors have a lot of motivation to get their patches included.
Their customers (who also are their board members and financial
backers) probably also value a more conservative approach.

I'm sure a lawyer will tell you that you're taking less risk if you
require legal names.  I'll go ahead and add my own advice that
everybody reading this will also be taking less risk if they never get
in a car or better still don't get out of bed.  Getting legal advice
isn't a bad idea, but ultimately the organization has to decide
whether the risks/benefits are worth it.  A lawyer might be able to
help the organization better understand these tradeoffs, but if you're
going to wait for somebody else to call the lawyer for you it isn't
likely to happen.  I suspect that most anonymous contributors don't
care THAT much - they're just going to stop contributing.

I think the key is to find the balance.  You can make an argument
either way, and I'm not sure how essential these anonymous
contributions are.  If we're better off without them then just be
aware that is the choice we're making...

-- 
Rich


^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 15:03         ` Rich Freeman
@ 2021-07-28 15:08           ` Ulrich Mueller
  2021-07-28 15:15             ` Rich Freeman
  2021-07-29  6:36           ` Joonas Niilola
  1 sibling, 1 reply; 31+ messages in thread
From: Ulrich Mueller @ 2021-07-28 15:08 UTC (permalink / raw
  To: Rich Freeman; +Cc: gentoo-project, Marek Szuba

[-- Attachment #1: Type: text/plain, Size: 1641 bytes --]

>>>>> On Wed, 28 Jul 2021, Rich Freeman wrote:

> While I completely get the sentiment, and tend to be a proponent of
> real-name at least from Gentoo contributors, we have to keep in mind
> that we're not Linux.

> The Linux Foundation can afford to push people away, because half of
> their contributions are probably corporate at this point, and most
> contributors have a lot of motivation to get their patches included.
> Their customers (who also are their board members and financial
> backers) probably also value a more conservative approach.

> I'm sure a lawyer will tell you that you're taking less risk if you
> require legal names.  I'll go ahead and add my own advice that
> everybody reading this will also be taking less risk if they never get
> in a car or better still don't get out of bed.  Getting legal advice
> isn't a bad idea, but ultimately the organization has to decide
> whether the risks/benefits are worth it.  A lawyer might be able to
> help the organization better understand these tradeoffs, but if you're
> going to wait for somebody else to call the lawyer for you it isn't
> likely to happen.  I suspect that most anonymous contributors don't
> care THAT much - they're just going to stop contributing.

> I think the key is to find the balance.  You can make an argument
> either way, and I'm not sure how essential these anonymous
> contributions are.  If we're better off without them then just be
> aware that is the choice we're making...

So what is the tl;dr of this? We stay with the complete chain of s-o-b
lines, but keep the strict real name requirement only for the final
committer?

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 14:47       ` Ulrich Mueller
  2021-07-28 15:03         ` Rich Freeman
@ 2021-07-28 15:12         ` Andrew Ammerlaan
  2021-07-28 15:14           ` Marek Szuba
  1 sibling, 1 reply; 31+ messages in thread
From: Andrew Ammerlaan @ 2021-07-28 15:12 UTC (permalink / raw
  To: gentoo-project

On 28/07/2021 16:47, Ulrich Mueller wrote:
>>>>>> On Wed, 28 Jul 2021, Marek Szuba wrote:
> 
>> On 2021-07-28 12:22, Ulrich Mueller wrote:
>>> This isn't about defending the copyright of the contributor (for which
>>> a pseudonym would be fine, or at least it would be a problem of the
>>> contributor). It is about due diligence when accepting contributions,
>>> to make sure their origin is traceable.
> 
>> I agree with the "due diligence" bit but not with the traceability
>> requirement. The "Certificate of Origin" section of GLEP-76 clearly
>> states that the purpose of the sign-off (which by the way applies only
>> contributions made via VCS commits, as the GLEP stands there are no
>> specific mechanisms described for contributions submitted in forms
>> other than full Git commits, e.g. patches uploaded to Bugzilla or sent
>> by e-mail) is "to declare that the contribution can be modified and
>> redistributed in accordance with the project's license", and nothing
>> in GCOv1 itself appears to me to contradict that statement. Finally,
>> between what GAFAM, NSA/GCHQ, $country government etc. have been doing
>> on the Internet, I am rather allergic to the whole idea of
>> facilitating the tracking of people.
> 
> Please read again what I've written. The origin of the contribution
> should be traceable, not the contributor.

What exactly is the difference? It seems to me that if a contributor 
authors a commit, then he or she *is* the origin of that commit.

>> In short, I feel that since a) the whole point here is to establish
>> ground rules for the copyright of Gentoo contributions, b) it is
>> pretty much entirely based on to-the-best-of-one's-knowledge
>> statements and acting in good faith, and c) we've got neither the
>> means nor the authority to verify personal details provided by the
>> contributors, I strongly feel there isn't much point in disallowing
>> pseudonymous contributions. I for one would very much rather accept a
>> steady stream of contributions from a single anonymous entity than
>> have them scattered across fake but ostensibly real-name contributors.
>> And it someone contributes something potentially lifted from
>> proprietary software or otherwise fishy? It's up to the people pushing
>> these commits to our repos to exercise their common sense and due
>> diligence.
> 
> We have taken the blueprint for the certificate-of-origin model from
> Linux, and it does have a real name requirement. I'd rather not change
> any element of it without getting legal advice first.

It's a rule we cannot enforce and as such it is pointless imho. We can 
encourage people to use their real name, but unless we start collecting 
copies of IDs we can never be sure. Besides, how does a legal name make 
the origin of a contribution more traceable? Say some proprietary code 
ends up in Gentoo, and we trace this back to some commit which was 
signed off by an external contributor, then what? How does the 'legal 
name' help?

As a general rule of thumb, one should never collect personal 
information that one does not strictly require. And at the moment I 
still don't really understand why we *need* someone's 'legal name' 
(especially given that we cannot verify it).


^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 15:12         ` Andrew Ammerlaan
@ 2021-07-28 15:14           ` Marek Szuba
  0 siblings, 0 replies; 31+ messages in thread
From: Marek Szuba @ 2021-07-28 15:14 UTC (permalink / raw
  To: gentoo-project


[-- Attachment #1.1: Type: text/plain, Size: 633 bytes --]

On 2021-07-28 16:12, Andrew Ammerlaan wrote:

>> Please read again what I've written. The origin of the contribution
>> should be traceable, not the contributor.
> 
> What exactly is the difference? It seems to me that if a contributor 
> authors a commit, then he or she *is* the origin of that commit.

That is how this looks to me as well.

> As a general rule of thumb, one should never collect personal 
> information that one does not strictly require. And at the moment I 
> still don't really understand why we *need* someone's 'legal name' 
> (especially given that we cannot verify it).

This.

-- 
MS


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 15:08           ` Ulrich Mueller
@ 2021-07-28 15:15             ` Rich Freeman
  2021-07-28 15:49               ` Ulrich Mueller
  0 siblings, 1 reply; 31+ messages in thread
From: Rich Freeman @ 2021-07-28 15:15 UTC (permalink / raw
  To: Ulrich Mueller; +Cc: gentoo-project, Marek Szuba

On Wed, Jul 28, 2021 at 11:08 AM Ulrich Mueller <ulm@gentoo.org> wrote:
>
> So what is the tl;dr of this? We stay with the complete chain of s-o-b
> lines, but keep the strict real name requirement only for the final
> committer?
>

That is my sense of it (which I spelled out a bit more in my prior
email), but I really don't have a strong opinion on the real name for
outside contributors.  Having it reduces risk, but I'm not sure it
makes sense considering the type of org we are, and what we'd give up
vs what we get.  As others have said pseudonyms usually are legal and
it isn't like we're checking passports even for the real names.  I'm
not sure if we have any numbers on how many are impacted, but I'm
sympathetic.

I guess we could always ask people to at least use the real-name
generator instead of the scifi-name generator to come up with them, if
Rachael Lincoln sounds better than CommanderSkyshadow328.

-- 
Rich


^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 11:50     ` Thomas Deutschmann
@ 2021-07-28 15:42       ` Sam James
  2021-07-28 17:26         ` Michael Jones
  0 siblings, 1 reply; 31+ messages in thread
From: Sam James @ 2021-07-28 15:42 UTC (permalink / raw
  To: gentoo-project

[-- Attachment #1: Type: text/plain, Size: 1374 bytes --]



> On 28 Jul 2021, at 12:50, Thomas Deutschmann <whissi@gentoo.org> wrote:
> 
> Hi,
> 
> this was also my understanding. GLEP 76 applies to everyone -- no exception and during discussion we explicit agreed that it's better to reject any contribution from individual(s) who cannot do the sign-off for whatever reason.
> 
> Keep in mind: Whoever will proxy such a commit will be 100% responsible in the end. For purely self-protection reasons nobody should proxy a commit he/she doesn't understand, doesn't know the origin or in general has any doubts about. _You_ will be responsible for this because _you_ introduced the commit in Gentoo.

Agreed, but s/commit/contribution/?

> 
> That said, an individual who doesn't want to do the sign-off for whatever reason could also contribute without getting attribution if contributor will find a developer who is willing to do this (=what happens for most small proposed bug fixes via b.g.o for example).
> 
> 

Right.

Part of the reason why I'm keen on this proposal is that there's no practical difference between accepting a patch on Bugzilla and re-committing it under my own name and just merging their PR. I suppose if we're clear on guidelines,
dropping signoffs where people admit their names are fake would be okay, but it still feels like extra work for developers when merging PRs.

best,
sam

[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 15:15             ` Rich Freeman
@ 2021-07-28 15:49               ` Ulrich Mueller
  0 siblings, 0 replies; 31+ messages in thread
From: Ulrich Mueller @ 2021-07-28 15:49 UTC (permalink / raw
  To: Rich Freeman; +Cc: gentoo-project, Marek Szuba

[-- Attachment #1: Type: text/plain, Size: 304 bytes --]

>>>>> On Wed, 28 Jul 2021, Rich Freeman wrote:

> I guess we could always ask people to at least use the real-name
> generator instead of the scifi-name generator to come up with them, if
> Rachael Lincoln sounds better than CommanderSkyshadow328.

Why would "sounds better" be important for pseudonyms?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 15:42       ` Sam James
@ 2021-07-28 17:26         ` Michael Jones
  0 siblings, 0 replies; 31+ messages in thread
From: Michael Jones @ 2021-07-28 17:26 UTC (permalink / raw
  To: gentoo-project; +Cc: sam

[-- Attachment #1: Type: text/plain, Size: 2562 bytes --]

On Wed, Jul 28, 2021 at 10:42 AM Sam James <sam@gentoo.org> wrote:

>
>
> > On 28 Jul 2021, at 12:50, Thomas Deutschmann <whissi@gentoo.org> wrote:
> >
> > Hi,
> >
> > this was also my understanding. GLEP 76 applies to everyone -- no
> exception and during discussion we explicit agreed that it's better to
> reject any contribution from individual(s) who cannot do the sign-off for
> whatever reason.
> >
> > Keep in mind: Whoever will proxy such a commit will be 100% responsible
> in the end. For purely self-protection reasons nobody should proxy a commit
> he/she doesn't understand, doesn't know the origin or in general has any
> doubts about. _You_ will be responsible for this because _you_ introduced
> the commit in Gentoo.
>
> Agreed, but s/commit/contribution/?
>
> >
> > That said, an individual who doesn't want to do the sign-off for
> whatever reason could also contribute without getting attribution if
> contributor will find a developer who is willing to do this (=what happens
> for most small proposed bug fixes via b.g.o for example).
> >
> >
>
> Right.
>
> Part of the reason why I'm keen on this proposal is that there's no
> practical difference between accepting a patch on Bugzilla and
> re-committing it under my own name and just merging their PR. I suppose if
> we're clear on guidelines,
> dropping signoffs where people admit their names are fake would be okay,
> but it still feels like extra work for developers when merging PRs.
>
> best,
> sam
>




I've not followed this full discussion, but has the propensity for projects
other than Gentoo to add the git signed-off-by field to commits on behalf
of people been brought up? I've seen that happen in OpenWRT twice, as well
as other random projects.

I can't imagine that using the git signed-off-by field is in any way
legally meaningful unless you're also requiring developers register their
public key with Gentoo, and then sign their commits with their pub/priv
key. You also have to consider that the signed-off-by field is used by
different projects in very different ways, and there's no legal precedent
that I'm aware of that implies that signed-off-by means "I wrote this",
since there are project that use it as "I've approved this".

Anything less than that is just asking for someone to, entirely plausibly,
claim that they were not the person who added the signed-off-by field to
the commit in question, and good luck proving otherwise. Or that they meant
something very different than what Gentoo thinks they did when they added
signed-off-by to their commit.

[-- Attachment #2: Type: text/html, Size: 3235 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28  4:07 [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements Joonas Niilola
                   ` (2 preceding siblings ...)
  2021-07-28 10:49 ` Andrew Ammerlaan
@ 2021-07-28 17:30 ` Alec Warner
  2021-07-29  6:28   ` Joonas Niilola
  2021-08-05  6:01 ` Anna Vyalkova
  4 siblings, 1 reply; 31+ messages in thread
From: Alec Warner @ 2021-07-28 17:30 UTC (permalink / raw
  To: gentoo-project; +Cc: Joonas Niilola

[-- Attachment #1: Type: text/plain, Size: 6149 bytes --]

On Tue, Jul 27, 2021 at 9:09 PM Joonas Niilola <juippis@gentoo.org> wrote:

> Summary:
> Make it clearer that a sign-off to a git commit is only required from
> the committer, not from the author. It's only encouraged for the
> authors.
>

> Rationale:
> 1. We're actively rejecting contributions from people who do not wish to
> have their real name shown in public, or link it to their Git*
> accounts.


So contribution rejection is a thing. 100% agree we could / should make
this better so we don't have to reject as many commits.


>
> 2. We have no way of knowing or confirming whether the given name is
> "legal". I'd rather not have the sign-off from the author in the first
> place than see clearly made up names in there, with a fresh-made Git*
> account with no prior activity.
>

So I want to be clear here. We require a real name; but we don't verify it.
This is a risk to us, that people will lie. When they lie it's fraud
(misrepresentation.)
I entirely expect some amount of fraud; this is the real world and people
do fraud from time to time. The point of policy is not to have no fraud.

This is part of the struggle I perceive where people want a "clear binary
world" where none exists. "Give me a list of rules to apply and I will
apply them" (but see below for more on this.)


>
> 3. Recently we've had a couple of cases where our long-standing
> contributors, with ~300 commits in total, reveal they've been using
> pseudonyms. I'm sure there are many others. AFAIK all their commits
> should then be revoked, and possibly future contributions rejected
> due to trust issues?
>

Like the recent LKML incident; I suspect we may need to review their
contributions to see if they were otherwise acceptable.


>
> 4. As said, there are already devs committing work from people we
> know to have made-up names. And/or there are devs committing patches
> without the sign-off to begin with.
>

As discussed on IRC (in #gentoo-trustees) I think we could do with more
guidelines here. I suspect many of the patches are OK to merge regardless
of the name in the SOB line and we could drop the contributor SOB line in
some cases.
This is true today (some developers don't require an SOB line from a
contributor) and so we should review when this is acceptable and clarify
the policy.


>
> 5. The infra git-hooks currently only check for a matching sign-off
> from the committer anyway.
>

When we accept a git commit, many judgments must be made. Some judgements
are automated (and we can reject commits that do not pass these judgments).
Some of them are not automatable, and we rely on committers to make that
judgement with their mind. Not all committers will judge things the same
way and that is OK; it's a risk they take on (as a committer) and that the
organization takes on (as, in the case above, we may need to audit
contributions from time to time.) I'm not certain it's a sane argument to
simply say "well this judgement is not automatable so we shouldn't have
that judgement at all."

The judgements are the value you bring (as a human committer.) If I could
automate your work then I would; then I wouldn't need committers anymore.
However I do not think this is possible in practice. This is my point
relating to the rules above. If there were a set of codified rules I could
program a computer to do them (make them automated judgements.) I'm
suggesting this is not the case and again you as a committer need to
exercise your own judgement when accepting a commit. There is still the
distinction of "how do I as a committer make good judgements" and it's
clear we are struggling in this area.



>
> Final words:
> So currently, this GLEP can be interpreted in two different ways: the
> sign-off is and isn't required from the author. This does harm
> towards contributors who work with devs who do require the sign-off
> from the author, and thus the GLEP needs to be updated and enforced
> one way or the other. I vote what benefits our contributors, and
> therefore us, better.
>

I suspect whether you need an SOB from the author will continue to vary;
but I'm happy to change the policy to have clearer guidelines.

-A


>
> Signed-off-by: Joonas Niilola <juippis@gentoo.org>
> ---
>  glep-0076.rst | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/glep-0076.rst b/glep-0076.rst
> index 4aa5ee5..faa760d 100644
> --- a/glep-0076.rst
> +++ b/glep-0076.rst
> @@ -8,10 +8,11 @@ Author: Richard Freeman <rich0@gentoo.org>,
>          Michał Górny <mgorny@gentoo.org>
>  Type: Informational
>  Status: Active
> -Version: 1.1
> +Version: 1.2
>  Created: 2013-04-23
> -Last-Modified: 2018-12-09
> -Post-History: 2018-06-10, 2018-06-19, 2018-08-31, 2018-09-26
> +Last-Modified: 2021-07-28
> +Post-History: 2018-06-10, 2018-06-19, 2018-08-31, 2018-09-26,
> +              2021-07-28
>  Content-Type: text/x-rst
>  ---
>
> @@ -138,7 +139,10 @@ the Certificate of Origin by adding ::
>
>  to the commit message as a separate line.  The sign-off must contain
>  the committer's legal name as a natural person, i.e., the name that
> -would appear in a government issued document.
> +would appear in a government issued document. It's strongly encouraged
> +that the original contribution author also adds their sign-off, to at
> +least indicate they are aware of this GLEP. But it's required only
> +from the committer.
>
>  The following is the current Gentoo Certificate of Origin, revision 1:
>
> @@ -301,6 +305,9 @@ iv.  The original point (d) has been transformed into
> a stand-alone
>  v.   The term "open source" has been replaced by "free software"
>       throughout.
>
> +vi.  Clarify that a sign-off is only strictly required from the
> +     committer, not from the author.
> +
>  The new point was deemed necessary to allow committing license files
>  into the Gentoo repository, since those files usually do not permit
>  modification.  It has been established that adding a clear provision
> --
> 2.31.1
>
>
>

[-- Attachment #2: Type: text/html, Size: 8181 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 17:30 ` Alec Warner
@ 2021-07-29  6:28   ` Joonas Niilola
  0 siblings, 0 replies; 31+ messages in thread
From: Joonas Niilola @ 2021-07-29  6:28 UTC (permalink / raw
  To: gentoo-project


[-- Attachment #1.1: Type: text/plain, Size: 1623 bytes --]

On 28.7.2021 20.30, Alec Warner wrote:
> 
> 
> When we accept a git commit, many judgments must be made. Some
> judgements are automated (and we can reject commits that do not pass
> these judgments). Some of them are not automatable, and we rely on
> committers to make that judgement with their mind. Not all committers
> will judge things the same way and that is OK; it's a risk they take on
> (as a committer) and that the organization takes on (as, in the case
> above, we may need to audit contributions from time to time.) I'm not
> certain it's a sane argument to simply say "well this judgement is not
> automatable so we shouldn't have that judgement at all."
> 
> The judgements are the value you bring (as a human committer.) If I
> could automate your work then I would; then I wouldn't need committers
> anymore. However I do not think this is possible in practice. This is my
> point relating to the rules above. If there were a set of codified rules
> I could program a computer to do them (make them automated judgements.)
> I'm suggesting this is not the case and again you as a committer need to
> exercise your own judgement when accepting a commit. There is still the
> distinction of "how do I as a committer make good judgements" and it's
> clear we are struggling in this area.
> 

Very vaguely, should a clarification / example be written, where for
example eclass code and newly introduced complex ebuild code *might*
require an acknowledged sign-off from the contributor? While simple
version bumps, EAPI-bumps with given new eclass functions don't?

-- juippis


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 15:03         ` Rich Freeman
  2021-07-28 15:08           ` Ulrich Mueller
@ 2021-07-29  6:36           ` Joonas Niilola
  1 sibling, 0 replies; 31+ messages in thread
From: Joonas Niilola @ 2021-07-29  6:36 UTC (permalink / raw
  To: gentoo-project


[-- Attachment #1.1: Type: text/plain, Size: 752 bytes --]

On 28.7.2021 18.03, Rich Freeman wrote:
> likely to happen.  I suspect that most anonymous contributors don't
> care THAT much - they're just going to stop contributing.
> 
> I think the key is to find the balance.  You can make an argument
> either way, and I'm not sure how essential these anonymous
> contributions are.  If we're better off without them then just be
> aware that is the choice we're making...
> 

In my eyes we ask our contributors to go around our rules that we can't
even verify. It's annoying and a joke at the same time.

And yes I'm aware of quite significant work done by people using
imaginary names. The overall health and interest of this distribution
would definitely suffer without those.

-- juippis


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28 14:33     ` Rich Freeman
@ 2021-07-29  6:39       ` Joonas Niilola
  2021-07-29  8:05         ` Ulrich Mueller
  0 siblings, 1 reply; 31+ messages in thread
From: Joonas Niilola @ 2021-07-29  6:39 UTC (permalink / raw
  To: gentoo-project


[-- Attachment #1.1: Type: text/plain, Size: 511 bytes --]

On 28.7.2021 17.33, Rich Freeman wrote:
> 
> In the US at least (and probably most countries), ALL code is
> proprietary, unless the author of the code has released it under an
> open source license.
> 

I do find this thinking a bit backwards, especially WHEN contributing to
an open-source project. I think this should be flipped around; Unless
stated otherwise, we presume a contribution to this open source project
is blablabla licensed / copyrightable under open source rules.

-- juippis



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-29  6:39       ` Joonas Niilola
@ 2021-07-29  8:05         ` Ulrich Mueller
  2021-07-29  8:31           ` Joonas Niilola
  0 siblings, 1 reply; 31+ messages in thread
From: Ulrich Mueller @ 2021-07-29  8:05 UTC (permalink / raw
  To: Joonas Niilola; +Cc: gentoo-project

[-- Attachment #1: Type: text/plain, Size: 2420 bytes --]

>>>>> On Thu, 29 Jul 2021, Joonas Niilola wrote:

> I do find this thinking a bit backwards, especially WHEN contributing
> to an open-source project. I think this should be flipped around;
> Unless stated otherwise, we presume a contribution to this open source
> project is blablabla licensed / copyrightable under open source rules.

Unfortunately, copyright law doesn't work like this.

Typically, a contribution will be an adaptation of an existing work.
By copyright law, it is a protected work, and the author has the
exclusive rights of reproduction and distribution, unless he or she
grants these rights to others, typically by releasing it under some
license.

This leaves us with the following cases (probably not a complete list):

a) A contribution with a Signed-off-by line and a known real name.
   ⇒ Can be accepted, because the author confirmed that it is under a
   free software license. The committer adds another S-o-b line and
   certifies the commit under point 4 of the GCO.

b) A contribution with a S-o-b line and a name known to be a pseudoym.
   ⇒ Same as a) but we may be in (more) trouble when it would turn out
   that the certification was false, i.e. the code was taken from
   somewhere else and the committer doesn't have the right to distribute
   it under a free software license. (Note that this case is not allowed
   by our existing copyright policy.)

c) A contribution with a S-o-b line and name of unknown status.
   ⇒ Same as a) or b)

d) A contribution without a S-o-b line but not legally significant
   (e.g. by the FSF's 15-lines rule of thumb [1]).
   ⇒ Can be accepted. The committer adds a S-o-b line and certifies the
   commit under GCO point 2.

e) A contribution without a S-o-b line and of significant size, but with
   an independent indication of its license (e.g. copyright and license
   notices in the file's header).
   ⇒ Can be accepted. The committer adds a S-o-b line and certifies the
   commit under GCO point 2.

f) A contribution without a S-o-b line and of significant size, without
   any other indication of its license.
   ⇒ Can _not_ be accepted. We have no indication that the author has
   released the work under a free license, therefore we must not
   distribute it.

Disclaimer: IANAL, TINLA

Ulrich

[1] https://www.gnu.org/prep/maintain/html_node/Legally-Significant.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-29  8:05         ` Ulrich Mueller
@ 2021-07-29  8:31           ` Joonas Niilola
  2021-07-29  9:53             ` Ulrich Mueller
  0 siblings, 1 reply; 31+ messages in thread
From: Joonas Niilola @ 2021-07-29  8:31 UTC (permalink / raw
  To: gentoo-project

On 29.7.2021 11.05, Ulrich Mueller wrote:
> 
> Unfortunately, copyright law doesn't work like this.
> 
> Typically, a contribution will be an adaptation of an existing work.
> By copyright law, it is a protected work, and the author has the
> exclusive rights of reproduction and distribution, unless he or she
> grants these rights to others, typically by releasing it under some
> license.

Just slap a notification when ever any Github PR is opened, or bugzilla
attachment added (same way as the GLEP-76 is now mentioned in them)
Stating "if you don't accept to these terms, close your PR or don't
upload your attachment". Hey, it works with cookies in *every* web site,
why couldn't it work here legally?

Does *any* other distribution require this to contribute? Or apart from
linux itself, *any* other open source project? Has *anyone* ever gotten
intro trouble due to this? It sounds a bit ridiculous having to signal
to contributors that "hey you need to random generate some kind of name
for yourself because of, hey, reasons you know" while literally no one
else asks for this.

-- juippis


^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-29  8:31           ` Joonas Niilola
@ 2021-07-29  9:53             ` Ulrich Mueller
  2021-07-29 10:30               ` Joonas Niilola
  0 siblings, 1 reply; 31+ messages in thread
From: Ulrich Mueller @ 2021-07-29  9:53 UTC (permalink / raw
  To: Joonas Niilola; +Cc: gentoo-project

[-- Attachment #1: Type: text/plain, Size: 1902 bytes --]

>>>>> On Thu, 29 Jul 2021, Joonas Niilola wrote:

> On 29.7.2021 11.05, Ulrich Mueller wrote:
>> 
>> Unfortunately, copyright law doesn't work like this.
>> 
>> Typically, a contribution will be an adaptation of an existing work.
>> By copyright law, it is a protected work, and the author has the
>> exclusive rights of reproduction and distribution, unless he or she
>> grants these rights to others, typically by releasing it under some
>> license.

> Just slap a notification when ever any Github PR is opened, or bugzilla
> attachment added (same way as the GLEP-76 is now mentioned in them)
> Stating "if you don't accept to these terms, close your PR or don't
> upload your attachment". Hey, it works with cookies in *every* web site,
> why couldn't it work here legally?

I think that contributions on Github can be counted as a subset of my
case e), i.e. they have an independent indication of their license.

This is by section D.6 of Github's terms of service [1]:

| Whenever you add Content to a repository containing notice of a
| license, you license that Content under the same terms, and you agree
| that you have the right to license that Content under those terms. If
| you have a separate agreement to license that Content under different
| terms, such as a contributor license agreement, that agreement will
| supersede.

> Does *any* other distribution require this to contribute? Or apart from
> linux itself, *any* other open source project?

Many, and much stricter conditions. For example, the FSF requires
signing of their copyright papers before accepting contributions.
(Also, they send the form by snail mail. So a postal address under your
name must exist, which is at least a rudimentary verification of your
identity.)

Ulrich

[1] https://docs.github.com/en/github/site-policy/github-terms-of-service#d-user-generated-content

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-29  9:53             ` Ulrich Mueller
@ 2021-07-29 10:30               ` Joonas Niilola
  2021-07-29 11:46                 ` Ulrich Mueller
  0 siblings, 1 reply; 31+ messages in thread
From: Joonas Niilola @ 2021-07-29 10:30 UTC (permalink / raw
  To: gentoo-project

On 29.7.2021 12.53, Ulrich Mueller wrote:
> 
> I think that contributions on Github can be counted as a subset of my
> case e), i.e. they have an independent indication of their license.
> 
> This is by section D.6 of Github's terms of service [1]:
> 
> | Whenever you add Content to a repository containing notice of a
> | license, you license that Content under the same terms, and you agree
> | that you have the right to license that Content under those terms. If
> | you have a separate agreement to license that Content under different
> | terms, such as a contributor license agreement, that agreement will
> | supersede.
> 

Works for me, your examples from a. to f. looks good, but how do you
suggest the GLEP is to be updated so these become clear for everyone?
Talking about contributors, and final contribution committers (devs). I
could imagine a simple "examples" paragraph with your suggestion written
in it word-to-word.

-- juippis



^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-29 10:30               ` Joonas Niilola
@ 2021-07-29 11:46                 ` Ulrich Mueller
  0 siblings, 0 replies; 31+ messages in thread
From: Ulrich Mueller @ 2021-07-29 11:46 UTC (permalink / raw
  To: Joonas Niilola; +Cc: gentoo-project

[-- Attachment #1: Type: text/plain, Size: 991 bytes --]

>>>>> On Thu, 29 Jul 2021, Joonas Niilola wrote:

> Works for me, your examples from a. to f. looks good, but how do you
> suggest the GLEP is to be updated so these become clear for everyone?
> Talking about contributors, and final contribution committers (devs).
> I could imagine a simple "examples" paragraph with your suggestion
> written in it word-to-word.

I'd rather not include that list of examples as part of the policy,
but document it elsewhere where it can be more easily updated, without
needing council and trustees for approval. For example, in the devmanual
or on a wiki page.

The question to be answered for the policy is whether we loosen the real
name requirement for everyone but the final committer, i.e. whether we
allow case b).

The alternative would be to leave the policy as-is, under the assumption
that most much contributions would fall back to cases d) or e). That is,
no s-o-b line but the committer can certify the contribution under GCO
point 2.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-07-28  4:07 [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements Joonas Niilola
                   ` (3 preceding siblings ...)
  2021-07-28 17:30 ` Alec Warner
@ 2021-08-05  6:01 ` Anna Vyalkova
  2021-08-05  9:43   ` Ulrich Mueller
  4 siblings, 1 reply; 31+ messages in thread
From: Anna Vyalkova @ 2021-08-05  6:01 UTC (permalink / raw
  To: gentoo-project

This would also improve transgender inclusiveness (in cases where legal
name is also a deadname[0] and deadnaming yourself is not an option).

However, the requirement will stay the same for committers. Maybe "legal
name" should be changed to "real name" (like in Linux kernel docs[1]) or
"preferred name" with examples other than government documents in
addition?

(also i'm not sure about sign-offs from plural[2] people)

[0]: https://en.wiktionary.org/wiki/deadname
[1]: https://www.kernel.org/doc/html/latest/process/submitting-patches.html
[2]: https://en.wikipedia.org/wiki/Multiplicity_(psychology)


^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-08-05  6:01 ` Anna Vyalkova
@ 2021-08-05  9:43   ` Ulrich Mueller
  2021-08-05 11:02     ` Anna Vyalkova
  0 siblings, 1 reply; 31+ messages in thread
From: Ulrich Mueller @ 2021-08-05  9:43 UTC (permalink / raw
  To: gentoo-project

[-- Attachment #1: Type: text/plain, Size: 1521 bytes --]

>>>>> On Thu, 05 Aug 2021, Anna Vyalkova wrote:

> This would also improve transgender inclusiveness (in cases where legal
> name is also a deadname[0] and deadnaming yourself is not an option).

> However, the requirement will stay the same for committers. Maybe "legal
> name" should be changed to "real name" (like in Linux kernel docs[1]) or
> "preferred name" with examples other than government documents in
> addition?

As a matter of fact, a previous version of the policy had "real name"
but we changed it to "legal name":
https://gitweb.gentoo.org/data/glep.git/commit/?id=dcc841a715dfa077258fa3f8bef5f15ee22148cb

This was the result of a long IRC discussion between Council members and
Trustees on 2018-09-26. The idea was to somewhat _widen_ the definition.
One case specifically mentioned during the discussion was to allow using
a religious name or pseudonym ("Ordens- oder Künstlername").

For example, the German Passport Act (PassG) allows such a name to be
listed, see Section 4, Subsection 1, second sentence, no. 4:
https://www.gesetze-im-internet.de/englisch_pa_g/englisch_pa_g.html#p0037
This would qualify as a "legal name" because it appears in an official
document, but not necessarily as a "real name".

> (also i'm not sure about sign-offs from plural[2] people)

> [0]: https://en.wiktionary.org/wiki/deadname
> [1]: https://www.kernel.org/doc/html/latest/process/submitting-patches.html
> [2]: https://en.wikipedia.org/wiki/Multiplicity_(psychology)

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements
  2021-08-05  9:43   ` Ulrich Mueller
@ 2021-08-05 11:02     ` Anna Vyalkova
  0 siblings, 0 replies; 31+ messages in thread
From: Anna Vyalkova @ 2021-08-05 11:02 UTC (permalink / raw
  To: gentoo-project

On 2021-08-05 11:43, Ulrich Mueller wrote:
> As a matter of fact, a previous version of the policy had "real name"
> but we changed it to "legal name":
> https://gitweb.gentoo.org/data/glep.git/commit/?id=dcc841a715dfa077258fa3f8bef5f15ee22148cb
> 
> This was the result of a long IRC discussion between Council members and
> Trustees on 2018-09-26. The idea was to somewhat _widen_ the definition.
> One case specifically mentioned during the discussion was to allow using
> a religious name or pseudonym ("Ordens- oder Künstlername").
"Preferred name" or "legal or real name" would solve both issues.

> This would qualify as a "legal name" because it appears in an official
> document, but not necessarily as a "real name".
The hardest part is making a name "appear in an official document", see
links on this website, for example:
https://transrightsmap.tgeu.org/home/legal-gender-recognition/cluster-map

Or there (for every country, see "Name change" sections):
https://ilga.org/trans-legal-mapping-report

I live in Russia, here it's impossibly to change a traditionally
masculine nave to a traditionally feminine one and vice versa without
getting a medical diagnosis, having one-two month's salary to pay for a
commission so they give (or they don't) a document which is only valid
for a year to change a birth certificate (with legislators constantly
trying to outlaw even this three-ring circus).


^ permalink raw reply	[flat|nested] 31+ messages in thread

end of thread, other threads:[~2021-08-05 11:02 UTC | newest]

Thread overview: 31+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-07-28  4:07 [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements Joonas Niilola
2021-07-28  4:29 ` Sam James
2021-07-28  9:49   ` Emily Rowlands
2021-07-28  7:14 ` Michał Górny
2021-07-28 10:39   ` Ulrich Mueller
2021-07-28 11:50     ` Thomas Deutschmann
2021-07-28 15:42       ` Sam James
2021-07-28 17:26         ` Michael Jones
2021-07-28 10:49 ` Andrew Ammerlaan
2021-07-28 11:22   ` Ulrich Mueller
2021-07-28 14:08     ` Marek Szuba
2021-07-28 14:47       ` Ulrich Mueller
2021-07-28 15:03         ` Rich Freeman
2021-07-28 15:08           ` Ulrich Mueller
2021-07-28 15:15             ` Rich Freeman
2021-07-28 15:49               ` Ulrich Mueller
2021-07-29  6:36           ` Joonas Niilola
2021-07-28 15:12         ` Andrew Ammerlaan
2021-07-28 15:14           ` Marek Szuba
2021-07-28 14:33     ` Rich Freeman
2021-07-29  6:39       ` Joonas Niilola
2021-07-29  8:05         ` Ulrich Mueller
2021-07-29  8:31           ` Joonas Niilola
2021-07-29  9:53             ` Ulrich Mueller
2021-07-29 10:30               ` Joonas Niilola
2021-07-29 11:46                 ` Ulrich Mueller
2021-07-28 17:30 ` Alec Warner
2021-07-29  6:28   ` Joonas Niilola
2021-08-05  6:01 ` Anna Vyalkova
2021-08-05  9:43   ` Ulrich Mueller
2021-08-05 11:02     ` Anna Vyalkova

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox