Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements

[Andrew Ammerlaan]

On 28/07/2021 06:07, Joonas Niilola wrote:
> Summary:
> Make it clearer that a sign-off to a git commit is only required from
> the committer, not from the author. It's only encouraged for the
> authors.

I am not a lawyer so I might be completely wrong, but to me this is very 
confusing. According to the GLEP the whole point of the sign-off is to 
state agreement to the Certificate of Origin, the purpose of which "is 
to declare that the contribution can be modified and redistributed in 
accordance with the project's license".

Now if I read this Certificate of Origin, and apply it to the situation 
where I am merging an user contribution:

 > 1. The contribution was created in whole or in part by me, and I have 
the right to submit it under the free software license indicated in the 
file; or

1 does not apply since I did not create the contribution, I am only 
merging it.

 > 2. The contribution is based upon previous work that, to the best of 
my knowledge, is covered under an appropriate free software license, and 
I have the right under that license to submit that work with 
modifications, whether created in whole or in part by me, under the same 
free software license (unless I am permitted to submit under a different 
license), as indicated in the file; or

2 may or may not apply depending on what the contribution exactly is. 
e.g. a new ebuild may or may not be based on previous work. (Though one 
could argue that everything is based on something (e.g. on an example in 
the devmanual), but in this interpretation point 2 more or less loses 
all meaning since it would apply to *everything*)

 > 3. The contribution is a license text (or a file of similar nature), 
and verbatim distribution is allowed; or

3 applies only if it is a license, for the sake of argument lets assume 
this contribution is not a license file.

 > 4. The contribution was provided directly to me by some other person 
who certified 1., 2., 3., or 4., and I have not modified it.

4 applies, but here's the catch. It only applies if the contributor has 
also included a sign-off.

So if we allow contributions without a sign-off from the contributor the 
sign-off from the developer is meaningless since neither 1, 2, 3, or 4 
applies to the commit.

Given the rationale outlined below, I do agree that something should 
change. However, I'm a bit concerned that the suggested solution of only 
requiring the sign-off from the developer kinda breaks the whole point 
of having the sign-offs in the first place since it breaks the 
Certificate of Origin.

Which brings me to my second point. As far as I know, pseudonyms can in 
fact hold (and therefore transfer and sign-off) copyright. There are 
many examples of books and other texts written by authors using a 
different name then their 'legal name'. Such texts are not treated 
(fundamentally) different under copyright law simply because the author 
chose to use a pseudonym. Now a book is not an ebuild, but why wouldn't 
the same apply here?

So given the above, why not simply drop the requirement for using a 
persons 'legal name' (which we cannot enforce anyway), and allow the use 
of pseudonyms? Isn't this a way easier solution to the problem that 
doesn't break the whole point of the sign-off?

But then again, I am not a lawyer, so please correct me if my analysis 
is wrong.

> Rationale:
> 1. We're actively rejecting contributions from people who do not wish to
> have their real name shown in public, or link it to their Git*
> accounts.
>
> 2. We have no way of knowing or confirming whether the given name is
> "legal". I'd rather not have the sign-off from the author in the first
> place than see clearly made up names in there, with a fresh-made Git*
> account with no prior activity.
>
> 3. Recently we've had a couple of cases where our long-standing
> contributors, with ~300 commits in total, reveal they've been using
> pseudonyms. I'm sure there are many others. AFAIK all their commits
> should then be revoked, and possibly future contributions rejected
> due to trust issues?
>
> 4. As said, there are already devs committing work from people we
> know to have made-up names. And/or there are devs committing patches
> without the sign-off to begin with.
>
> 5. The infra git-hooks currently only check for a matching sign-off
> from the committer anyway.
>
> Final words:
> So currently, this GLEP can be interpreted in two different ways: the
> sign-off is and isn't required from the author. This does harm
> towards contributors who work with devs who do require the sign-off
> from the author, and thus the GLEP needs to be updated and enforced
> one way or the other. I vote what benefits our contributors, and
> therefore us, better.
>
> Signed-off-by: Joonas Niilola <juippis@g.o>
> ---
>   glep-0076.rst | 15 +++++++++++----
>   1 file changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/glep-0076.rst b/glep-0076.rst
> index 4aa5ee5..faa760d 100644
> --- a/glep-0076.rst
> +++ b/glep-0076.rst
> @@ -8,10 +8,11 @@ Author: Richard Freeman <rich0@g.o>,
>           Michał Górny <mgorny@g.o>
>   Type: Informational
>   Status: Active
> -Version: 1.1
> +Version: 1.2
>   Created: 2013-04-23
> -Last-Modified: 2018-12-09
> -Post-History: 2018-06-10, 2018-06-19, 2018-08-31, 2018-09-26
> +Last-Modified: 2021-07-28
> +Post-History: 2018-06-10, 2018-06-19, 2018-08-31, 2018-09-26,
> +              2021-07-28
>   Content-Type: text/x-rst
>   ---
>
> @@ -138,7 +139,10 @@ the Certificate of Origin by adding ::
>
>   to the commit message as a separate line.  The sign-off must contain
>   the committer's legal name as a natural person, i.e., the name that
> -would appear in a government issued document.
> +would appear in a government issued document. It's strongly encouraged
> +that the original contribution author also adds their sign-off, to at
> +least indicate they are aware of this GLEP. But it's required only
> +from the committer.
>
>   The following is the current Gentoo Certificate of Origin, revision 1:
>
> @@ -301,6 +305,9 @@ iv.  The original point (d) has been transformed into a stand-alone
>   v.   The term "open source" has been replaced by "free software"
>        throughout.
>
> +vi.  Clarify that a sign-off is only strictly required from the
> +     committer, not from the author.
> +
>   The new point was deemed necessary to allow committing license files
>   into the Gentoo repository, since those files usually do not permit
>   modification.  It has been established that adding a clear provision
>