Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements

[Alec Warner]

On Tue, Jul 27, 2021 at 9:09 PM Joonas Niilola <juippis@g.o> wrote:

> Summary:
> Make it clearer that a sign-off to a git commit is only required from
> the committer, not from the author. It's only encouraged for the
> authors.
>

> Rationale:
> 1. We're actively rejecting contributions from people who do not wish to
> have their real name shown in public, or link it to their Git*
> accounts.


So contribution rejection is a thing. 100% agree we could / should make
this better so we don't have to reject as many commits.


>
> 2. We have no way of knowing or confirming whether the given name is
> "legal". I'd rather not have the sign-off from the author in the first
> place than see clearly made up names in there, with a fresh-made Git*
> account with no prior activity.
>

So I want to be clear here. We require a real name; but we don't verify it.
This is a risk to us, that people will lie. When they lie it's fraud
(misrepresentation.)
I entirely expect some amount of fraud; this is the real world and people
do fraud from time to time. The point of policy is not to have no fraud.

This is part of the struggle I perceive where people want a "clear binary
world" where none exists. "Give me a list of rules to apply and I will
apply them" (but see below for more on this.)


>
> 3. Recently we've had a couple of cases where our long-standing
> contributors, with ~300 commits in total, reveal they've been using
> pseudonyms. I'm sure there are many others. AFAIK all their commits
> should then be revoked, and possibly future contributions rejected
> due to trust issues?
>

Like the recent LKML incident; I suspect we may need to review their
contributions to see if they were otherwise acceptable.


>
> 4. As said, there are already devs committing work from people we
> know to have made-up names. And/or there are devs committing patches
> without the sign-off to begin with.
>

As discussed on IRC (in #gentoo-trustees) I think we could do with more
guidelines here. I suspect many of the patches are OK to merge regardless
of the name in the SOB line and we could drop the contributor SOB line in
some cases.
This is true today (some developers don't require an SOB line from a
contributor) and so we should review when this is acceptable and clarify
the policy.


>
> 5. The infra git-hooks currently only check for a matching sign-off
> from the committer anyway.
>

When we accept a git commit, many judgments must be made. Some judgements
are automated (and we can reject commits that do not pass these judgments).
Some of them are not automatable, and we rely on committers to make that
judgement with their mind. Not all committers will judge things the same
way and that is OK; it's a risk they take on (as a committer) and that the
organization takes on (as, in the case above, we may need to audit
contributions from time to time.) I'm not certain it's a sane argument to
simply say "well this judgement is not automatable so we shouldn't have
that judgement at all."

The judgements are the value you bring (as a human committer.) If I could
automate your work then I would; then I wouldn't need committers anymore.
However I do not think this is possible in practice. This is my point
relating to the rules above. If there were a set of codified rules I could
program a computer to do them (make them automated judgements.) I'm
suggesting this is not the case and again you as a committer need to
exercise your own judgement when accepting a commit. There is still the
distinction of "how do I as a committer make good judgements" and it's
clear we are struggling in this area.



>
> Final words:
> So currently, this GLEP can be interpreted in two different ways: the
> sign-off is and isn't required from the author. This does harm
> towards contributors who work with devs who do require the sign-off
> from the author, and thus the GLEP needs to be updated and enforced
> one way or the other. I vote what benefits our contributors, and
> therefore us, better.
>

I suspect whether you need an SOB from the author will continue to vary;
but I'm happy to change the policy to have clearer guidelines.

-A


>
> Signed-off-by: Joonas Niilola <juippis@g.o>
> ---
>  glep-0076.rst | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/glep-0076.rst b/glep-0076.rst
> index 4aa5ee5..faa760d 100644
> --- a/glep-0076.rst
> +++ b/glep-0076.rst
> @@ -8,10 +8,11 @@ Author: Richard Freeman <rich0@g.o>,
>          Michał Górny <mgorny@g.o>
>  Type: Informational
>  Status: Active
> -Version: 1.1
> +Version: 1.2
>  Created: 2013-04-23
> -Last-Modified: 2018-12-09
> -Post-History: 2018-06-10, 2018-06-19, 2018-08-31, 2018-09-26
> +Last-Modified: 2021-07-28
> +Post-History: 2018-06-10, 2018-06-19, 2018-08-31, 2018-09-26,
> +              2021-07-28
>  Content-Type: text/x-rst
>  ---
>
> @@ -138,7 +139,10 @@ the Certificate of Origin by adding ::
>
>  to the commit message as a separate line.  The sign-off must contain
>  the committer's legal name as a natural person, i.e., the name that
> -would appear in a government issued document.
> +would appear in a government issued document. It's strongly encouraged
> +that the original contribution author also adds their sign-off, to at
> +least indicate they are aware of this GLEP. But it's required only
> +from the committer.
>
>  The following is the current Gentoo Certificate of Origin, revision 1:
>
> @@ -301,6 +305,9 @@ iv.  The original point (d) has been transformed into
> a stand-alone
>  v.   The term "open source" has been replaced by "free software"
>       throughout.
>
> +vi.  Clarify that a sign-off is only strictly required from the
> +     committer, not from the author.
> +
>  The new point was deemed necessary to allow committing license files
>  into the Gentoo repository, since those files usually do not permit
>  modification.  It has been established that adding a clear provision
> --
> 2.31.1
>
>
>