Re: [gentoo-dev] Dealing with GitHub Pull Requests the easy way

[Rich Freeman]

On Mon, Oct 24, 2016 at 3:21 AM, Daniel Campbell (zlg) <zlg@g.o> wrote:
>
> On October 23, 2016 11:29:49 PM PDT, "Michał Górny" <mgorny@g.o> wrote:
>>Dnia 24 października 2016 07:32:26 CEST, Daniel Campbell
>><zlg@g.o> napisał(a):
>>>On 10/19/2016 02:10 AM, Ulrich Mueller wrote:
>>>> Maybe I have missed something, but why would one use --signoff for
>>>> a Gentoo commit?
>>>>
>>>> For Linux (the kernel), the meaning of the line is that the
>>>> contributor certifies the DCO (Developer's Certificate of Origin)
>>>[1].
>>>> As we don't have a Gentoo DCO, it is not at all clear to me what the
>>>> meaning of a Signed-off-by: line would be in the context of the
>>>gentoo
>>>> tree.
>>>>
>>>> Even worse, I see commits having Signed-off-by: lines with obvious
>>>> pseudonyms instead of a real name, which would be meaningless even
>>if
>>>> one would say that the Linux rules apply. (Also, we have the rule
>>>that
>>>> real names must be provided for all developers, with no exceptions
>>to
>>>> be made for people doing copyrightable work [2].)
>>>>
>>>> [1]
>>>http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/SubmittingPatches?id=dca22a63fd036c3ebb50212060eba0080f178126#n428
>>>> [2]
>>>https://wiki.gentoo.org/wiki/Project:Recruiters#What_does_the_recruitment_process_involve.3F
>>>>
>>>The way I understood "signed off by" for Gentoo is "I am a developer
>>>who
>>>looked at the code and tested it, confirming it works on my system".
>>If
>>>an AT signs off, they are certifying that it passes their test muster.
>>>
>>>It's a more formal "looks good to me", and provides a point of
>>>accountability if the commit _isn't_ up to par.
>>
>>How about Gentoo developers stopping to reuse things that have
>>well-defined meaning for something completely different?
>
> I did say "to my understanding". I wasn't aware of DCOs. Regardless, practices and workflows differ between projects, and it doesn't surprise me to see projects that use the same words differently. Not that we should, of course. What would you call what I decribed, though; Acked?

I don't think we need a git header for the purpose of saying that
something looks good to somebody else.  If you commit something and it
doesn't work, we'll ask you to stop doing it.  If you keep doing it
we'll take away your commit access.  This is purely an internal
problem.

The purpose of a DCO is to withstand external scrutiny.  It helps
protect Gentoo in the event that somebody else's copyrighted code
makes it into the distro.  The audience for a signed-off-by header
isn't Comrel or QA, but rather a court of law.  It makes it harder to
contribute something to Gentoo and then argue that you didn't intend
for Gentoo to redistribute it under the GPL, or that now that you've
had a falling out you'd prefer that Gentoo remove all your past
contributions.

However, it has absolutely no meaning at all if it isn't 100% clear
what is being signed.  And if we have a long history of people adding
the header when it doesn't mean anything legally then it will probably
make it harder to argue that it suddenly means something when the
policy changes.

For example, suppose we institute a DCO tomorrow.  Then zlg ragequits
in 2 years and claims he never gave us permission to redistribute his
code under the GPL.  We point to his signed-off-by headers but he says
he never heard of the DCO policy and that it was just some default
setting in his config, and that he was adding the headers long before
the policy went into effect.  I don't think it would stick but it
really isn't an out we want to give people.  IMO infra should reject
commits with this header until we have a DCO, and then it should
reject commits without this header.  Alternatively, we could skip the
first part but require all existing devs to ack the new copyright
policy whenever it happens.

-- 
Rich