Re: [gentoo-project] [RFC] glep-0076: add clarification about the sign-off requirements

[Andrew Ammerlaan]

On 28/07/2021 16:47, Ulrich Mueller wrote:
>>>>>> On Wed, 28 Jul 2021, Marek Szuba wrote:
>
>> On 2021-07-28 12:22, Ulrich Mueller wrote:
>>> This isn't about defending the copyright of the contributor (for which
>>> a pseudonym would be fine, or at least it would be a problem of the
>>> contributor). It is about due diligence when accepting contributions,
>>> to make sure their origin is traceable.
>
>> I agree with the "due diligence" bit but not with the traceability
>> requirement. The "Certificate of Origin" section of GLEP-76 clearly
>> states that the purpose of the sign-off (which by the way applies only
>> contributions made via VCS commits, as the GLEP stands there are no
>> specific mechanisms described for contributions submitted in forms
>> other than full Git commits, e.g. patches uploaded to Bugzilla or sent
>> by e-mail) is "to declare that the contribution can be modified and
>> redistributed in accordance with the project's license", and nothing
>> in GCOv1 itself appears to me to contradict that statement. Finally,
>> between what GAFAM, NSA/GCHQ, $country government etc. have been doing
>> on the Internet, I am rather allergic to the whole idea of
>> facilitating the tracking of people.
>
> Please read again what I've written. The origin of the contribution
> should be traceable, not the contributor.

What exactly is the difference? It seems to me that if a contributor 
authors a commit, then he or she *is* the origin of that commit.

>> In short, I feel that since a) the whole point here is to establish
>> ground rules for the copyright of Gentoo contributions, b) it is
>> pretty much entirely based on to-the-best-of-one's-knowledge
>> statements and acting in good faith, and c) we've got neither the
>> means nor the authority to verify personal details provided by the
>> contributors, I strongly feel there isn't much point in disallowing
>> pseudonymous contributions. I for one would very much rather accept a
>> steady stream of contributions from a single anonymous entity than
>> have them scattered across fake but ostensibly real-name contributors.
>> And it someone contributes something potentially lifted from
>> proprietary software or otherwise fishy? It's up to the people pushing
>> these commits to our repos to exercise their common sense and due
>> diligence.
>
> We have taken the blueprint for the certificate-of-origin model from
> Linux, and it does have a real name requirement. I'd rather not change
> any element of it without getting legal advice first.

It's a rule we cannot enforce and as such it is pointless imho. We can 
encourage people to use their real name, but unless we start collecting 
copies of IDs we can never be sure. Besides, how does a legal name make 
the origin of a contribution more traceable? Say some proprietary code 
ends up in Gentoo, and we trace this back to some commit which was 
signed off by an external contributor, then what? How does the 'legal 
name' help?

As a general rule of thumb, one should never collect personal 
information that one does not strictly require. And at the moment I 
still don't really understand why we *need* someone's 'legal name' 
(especially given that we cannot verify it).