Re: [gentoo-project] Taking the signoff bait

[Michael Jones]

I'm sorry that you felt like I was trying to troll-bait. It wasn't an
attempt to do so.

I've refused to change a pull request to include "signed-off by" for
multiple projects, including for Gentoo, in the past and had even trivial
1-liners rejected, so it's a real blocker for at least one person to
contribute more to the project. Whether I'm alone in this is unknown to me.

"signed-off by" in plain english simply means "Approved by" in the vast
majority of non-subject-matter-expert's interpretation of it. Further,
different projects *do* use it in that meaning (not in the license
attestation meaning), and other projects use it to mean "I assert that I
hold the right to submit this under this license".  I've also seen, in
multiple different projects, such as OpenWRT, people "helpfully" add the
"signed-off by" line to commits on behalf of people without permission from
the submitter or author.

I would have much less objection if Gentoo used a combination "authored by"
and "license attestation from" or something like that, so that it was clear
in the line itself what the legal ramifications are. Simply saying "for
Gentoo, it means X" is not sufficient to prevent mistakes unless you're
going to plaster it everywhere and require acknowledgement clicks. The room
for misunderstanding the meaning is very high due to the use of a 3-word
term to mean something quite legally complicated when it has a trivial
native-English meaning with no relationship to the legal meaning that the
project (Gentoo) chooses to use it for.

Further considering that they are merely text-lines in a commit statement,
it's rather silly that "signed-off by" is used by Gentoo to have *more*
meaning than the built-in git-commit fields for author name and email.
Though, in fairness, a lot of projects abuse this concept, instead of
adding these custom fields to Git directly.

On Sun, Jun 19, 2022 at 5:33 AM Ulrich Mueller <ulm@g.o> wrote:

> >>>>> On Sun, 19 Jun 2022, Anna Vyalkova wrote:
>
> > On 2022-06-18 19:35, Michael Jones wrote:
> >> Re-evaluating your "signed off by" requirements on github, when
> >> that's legally meaningless, and already covered by the existing
> >> github terms of use, would also go a long way.
> >>
> >> I explicitly will not contribute to a project that has that
> >> requirement.
> >>
> >>
> https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#d-user-generated-content
>
> Maybe I am missing something, but where do the GitHub ToS say that we
> can take a contribution from a GitHub PR and distribute it outside?
>
>
From the linked terms of use page.
3. Ownership of Content, Right to Post, and License Grants

You retain ownership of and responsibility for Your Content. If you're
posting anything you did not create yourself or do not own the rights to,
you agree that you are responsible for any Content you post; that you will
only submit Content that you have the right to post; and that you will
fully comply with any third party licenses relating to Content you post.

Because you retain ownership of and responsibility for Your Content, we
need you to grant us — and other GitHub Users — certain legal permissions,
listed in Sections D.4 — D.7. These license grants apply to Your Content.
If you upload Content that already comes with a license granting GitHub the
permissions we need to run our Service, no additional license is required.
You understand that you will not receive any payment for any of the rights
granted in Sections D.4 — D.7. The licenses you grant to us will end when
you remove Your Content from our servers, unless other Users have forked it.
No one may post a pull request to a project hosted on github that they do
not hold the right to post, whether they are the author, or merely posting
on behalf of another.

6. Contributions Under Repository License

Whenever you add Content to a repository containing notice of a license,
you license that Content under the same terms, and you agree that you have
the right to license that Content under those terms. If you have a separate
agreement to license that Content under different terms, such as a
contributor license agreement, that agreement will supersede.

Isn't this just how it works already? Yep. This is widely accepted as the
norm in the open-source community; it's commonly referred to by the
shorthand "inbound=outbound". We're just making it explicit.

Contributions made to a repository that have an explicitly configured
license in the github project's settings are licensed under the terms of
that project's license, unless otherwise explicitly stated or agreed to via
some other mechanism (e.g. the commit message or contents of the commit
have wording to indicate an alternative license). It's the project's
responsibility to ensure that pull requests / commits that have wording to
indicate an explicit license are not merged unless the explicitly specified
license is acceptable. If no explicit license wording is present, then the
Github project's configured license (e.g. whatever Gentoo set on github) is
explicitly the license for the contribution.

As such, there is no need to use "signed-off by" for contributions made on
github, as the same legal infrastructure for assuring that commits are
legally/rightfully contributed by random internet strangers that Github has
also applies to the Gentoo project (mirror or otherwise) on Github.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

From this point, it appears you're responding to someone else, but I'll
attempt to answer.

> 1) We can't see if a commit comes from GitHub or somewhere else in the
> > git history. This not only makes verification but also breaks
> > verification tools (commit without signoff are rejected by gitolite's
> > pre-push hook, github is just a mirror).
>

That's something that could be solved by tooling, either by changing the
license that's configured on github to say that any PRs will be modified to
include the "signed-off by" line, or by using Merge commits from the PR ->
the official git repository done by an automated system that contains
wording like "This was a contribution made under the github.com terms of
use, blahblahblah".

Many (most?) drive-by contributors won't have any interest in contributing
to Gentoo via gitolite. If you don't plan to accept PRs on github in the
future, then this discussion is rather irrelevant, and I'm sorry for
stirring the pot.

But since we are discussing in the original thread how to improve external
contributions, I advise adjusting your tooling to be more welcoming, rather
than insisting external contributors accept your tooling's limitations.


> > 2) Gentoo has plans to move to their own GitLab instance. So binding
> > themselves to GitHub ToS (that can be changes at any time and controlled
> > by Miscro$oft) is stupid.
>

I don't think this is very helpful to the stated intention of improving the
situation with external contributions. Moving to GitLab doesn't do anything
useful from the perspective of external contributors. I have a github
account. I won't be making one on the Gentoo GitLab, unless it's.... via
logging into Github, which many GitLab instances allow.

The Github terms of use are basically harmless to Gentoo, and they provide
Gentoo with plenty of legal backing in terms of attesting that a
contribution was done legitimately. Which asking for random internet people
to add "signed-off by" does *not* provide. When I was asked to add
"signed-off by" for multiple projects, including Gentoo, no explanation of
the legal meaning behind that was given. I *assumed* they were asking me to
attest that the PR wouldn't introduce any QA problems, which is the plain
meaning of "signed-off by" in English to non-legal experts. Rather the
opposite of what Gentoo wants to use it for.

However, the Github terms of use are quite clear and easy to understand. No
one can be confused by what the expectations are for contributions made on
Github, and you'd be able to point any legal trouble at the Github legal
team for violations of the Github TOS. Since Github's entire business model
requires that their terms of use apply properly, they would have a heavy
incentive to defend Gentoo on that issue if the commit came from a Github
PR.

Further, Microsoft hosts and accepts PRs for some of its own commercial
products like Visual Studio's standard library for C++, without a CLA as
far as I know. How is this legally fine for Microsoft for a product they
commercially sell, but not for Gentoo which does not commercially sell
anything (that I know of, anyway)?



> > 3) Commit author != GitHub user.
>
> I think it's even three entities: author, committer, and GitHub user,
> which can all be different.
>
>
That seems accurate.


> > 4) **Most important point!** These ToS apply only to content hosted on
> > GitHub! And you retain ownership only on github PRs, not the canonical
> > repo.
>

I don't see how this is accurate. Gentoo doesn't own any of the PRs or
commits or patches submitted to it in the first place. That ownership is
retained by the original author, or whoever they've assigned the ownership
of. Are you telling me that the handful of patches / ebuilds that I've sent
to Bugzilla are somehow no longer owned by me? That's a surprise...

"signed-off by" is not a transfer of ownership, even in the flawed way that
Gentoo is trying to use it.

If you're expecting to see ownership transfer, you need a real contributor
license agreement that explicitly transfers ownership, which I've not seen
anyone ever discussing on the Gentoo mailing list (which could mean I
simply missed the discussion).

Once the commit is made on GitHub, the GitHub TOS assures Gentoo that the
person who submitted the PR had the right to do so under the Github TOS and
the license that the PR was submitted as. Now that the license is
established, Gentoo can do whatever Gentoo want's to with that PR, so long
as the license it was submitted under allows it. No need for "signed-off
by" or ownership transfer, unless you're planning to re-license things?



> > * the only thing I dislike and sabotage in Gentoo's signoff policy is
> >   that uses "legal name" instead of "real name" - change that already...
>
> That wording went through several iterations, the last of which changed
> it from "real name" to "legal name" [1].
>
> IIRC, the rationale behind this change was that "real name" was deemed
> to vague, and to account for officially registered pseudonyms.
> For example, the German passport has an optional field "religious name
> or pseudonym" [2].
>
> Ulrich
>
> [1]
> https://gitweb.gentoo.org/data/glep.git/commit/glep-0076.rst?id=dcc841a715dfa077258fa3f8bef5f15ee22148cb
> [2] https://en.wikipedia.org/wiki/German_passport#Following_page


I find it really weird that I was able to make an account on Github, and
submit code through them, without needing to provide my real *or* legal
name.

What makes Gentoo special that it needs this additional information, when
Github (and thus Microsoft) does not, even for Microsoft's own commercial
products hosted on Github?