Re: [gentoo-project] Repo mirror & CI: official statement wrt GitHub

[kuzetsa]

On 06/15/2018 11:31 AM, Rich Freeman wrote:
> On Fri, Jun 15, 2018 at 10:55 AM kuzetsa <kuzetsa@×××××.com> wrote:
>>
>> "Gentoo Developer's Certificate of Origin" - shouldn't
>> the author / contributor themselves be involved in this?
>>
>
> It already requires this.  The committer would have to certify:
>
> " (4) The contribution was provided directly to me by some other person
>         who certified (1), (2), (3), or (4), and I have not modified it."
>
> (or one of the other items in the list, if they did modify it)
>
> Ultimately the committer is the person Gentoo has a relationship with,
> so they need to make the certification when they make the commit, even
> if it is just certifying that somebody else certified it.
>
> This goes along with something Thomas said earlier - ultimately the
> committers are responsible for what they commit.  There really isn't a
> sane alternative since the whole reason we try to control our
> committers is to ensure that things don't end up in the repository
> which shouldn't be there.  This isn't diminishing the value of 3rd
> party contributors - but simply affirming the value-add of having
> somebody we know actually look at what is being contributed.  That
> includes the copyright/license and not just the code.  After all, all
> this stuff ends up on all our users's systems so we want to protect
> them as well as ourselves.  Users already have the freedom to use any
> overlays they wish if they value these things differently.
>
> --
> Rich
>

OH!!! (thanks, I completely missed that detail)

from: "$ man git-commit" :  [...] The meaning of a
signoff depends on the project, but it typically
certifies that committer has the rights to submit
this work [...]

this is frustratingly vague (to me), but I suppose
the extra metadata included in the same paragraph
has a link to: https://developercertificate.org/

---
(c) The contribution was provided directly to me
by some other person who certified (a), (b) or (c)
and I have not modified it.
---

^ took me a few minutes to figure out what you meant,
or where that particular quote came from:

I had never considered this, because historically,
gentoo developers who use their PGP key to commit
rarely use the --signoff feature when committing the
submissions of a contributor, and even if they had,
there's not a stable definition.

in particular, I'm considering the meaning of the phrase:

"some other person who certified" - does this mean the
contributor needs to use their PGP key to sign or...?

it would be good for gentoo to have clarity on this.

I think it could lessen feelings / perceptions that
contributors ought to maintain a copy of the work on a 3rd
party mirror until it is no longer useful (IMO, at least).

-- kuza