Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements

[Ulrich Mueller]

>>>>> On Wed, 28 Jul 2021, Marek Szuba wrote:

> On 2021-07-28 12:22, Ulrich Mueller wrote:
>> This isn't about defending the copyright of the contributor (for which
>> a pseudonym would be fine, or at least it would be a problem of the
>> contributor). It is about due diligence when accepting contributions,
>> to make sure their origin is traceable.

> I agree with the "due diligence" bit but not with the traceability
> requirement. The "Certificate of Origin" section of GLEP-76 clearly
> states that the purpose of the sign-off (which by the way applies only
> contributions made via VCS commits, as the GLEP stands there are no
> specific mechanisms described for contributions submitted in forms
> other than full Git commits, e.g. patches uploaded to Bugzilla or sent
> by e-mail) is "to declare that the contribution can be modified and
> redistributed in accordance with the project's license", and nothing
> in GCOv1 itself appears to me to contradict that statement. Finally,
> between what GAFAM, NSA/GCHQ, $country government etc. have been doing
> on the Internet, I am rather allergic to the whole idea of
> facilitating the tracking of people.

Please read again what I've written. The origin of the contribution
should be traceable, not the contributor.

> In short, I feel that since a) the whole point here is to establish
> ground rules for the copyright of Gentoo contributions, b) it is
> pretty much entirely based on to-the-best-of-one's-knowledge
> statements and acting in good faith, and c) we've got neither the
> means nor the authority to verify personal details provided by the
> contributors, I strongly feel there isn't much point in disallowing
> pseudonymous contributions. I for one would very much rather accept a
> steady stream of contributions from a single anonymous entity than
> have them scattered across fake but ostensibly real-name contributors.
> And it someone contributes something potentially lifted from
> proprietary software or otherwise fishy? It's up to the people pushing
> these commits to our repos to exercise their common sense and due
> diligence.

We have taken the blueprint for the certificate-of-origin model from
Linux, and it does have a real name requirement. I'd rather not change
any element of it without getting legal advice first.

Ulrich