Re: [gentoo-project] Repo mirror & CI: official statement wrt GitHub

[kuzetsa]

On 06/15/2018 12:11 PM, Rich Freeman wrote:
> On Fri, Jun 15, 2018 at 12:03 PM kuzetsa <kuzetsa@×××××.com> wrote:
>>
>> from: "$ man git-commit" :  [...] The meaning of a
>> signoff depends on the project, but it typically
>> certifies that committer has the rights to submit
>> this work [...]
>>
>> this is frustratingly vague (to me), but I suppose
>> the extra metadata included in the same paragraph
>> has a link to: https://developercertificate.org/
>
> Well, we aren't using that as-is, but a modified version of this.
> Gentoo policies aren't contained in manpages.
>
> The Gentoo policy is in draft GLEP 76:
> https://gitweb.gentoo.org/data/glep.git/tree/glep-0076.rst
>
> (It was posted a few days ago on this list, and discussed here in
> various forms over the last few years.)
>
>> ^ took me a few minutes to figure out what you meant,
>> or where that particular quote came from:
>
> It came from GLEP 76 (still in draft).  It is of course based on the
> Linux DCO (which I believe is attributed in the GLEP).
>
>> I had never considered this, because historically,
>> gentoo developers who use their PGP key to commit
>> rarely use the --signoff feature when committing the
>> submissions of a contributor, and even if they had,
>> there's not a stable definition.
>
> Today they shouldn't be using --signoff, because there IS no official
> policy.  They will be required to do so once GLEP 76 is approved (this
> will be enforced with a commit hook).
>
>> "some other person who certified" - does this mean the
>> contributor needs to use their PGP key to sign or...?
>>
>> it would be good for gentoo to have clarity on this.
>
> IMO it is up to the certifier to decide what constitutes a
> certification made by somebody else.  This is necessarily outside of
> Gentoo so to try to impose a particular mechanism would make it harder
> to use outside code.  For example, all Linux commits have a DCO
> signoff, but these have no GPG signoffs to go with them.  We wouldn't
> want to block people from using GPL2 Linux code just because they use
> a different mechanism to track such things.
>
> The Gentoo DCO is an agreement between the Gentoo committer (a Gentoo
> dev) and Gentoo.
>
> That is roughly how I see it at least.
>
> --
> Rich
>

well golly. that's swell. I hadn't been keeping up with
those details. sounds good. like real good.

(I'll likely be silent for a few days. busy.)

-- kuza