Re: [gentoo-dev] Contributed ebuilds and copyright questions

2016-10-24 Thread Daniel Campbell
On 10/24/2016 04:18 PM, Rich Freeman wrote:
> On Mon, Oct 24, 2016 at 7:12 PM, Matt Turner  wrote:
>> On Mon, Oct 24, 2016 at 4:03 PM, Rich Freeman  wrote:
>>> You cannot currently commit anything with a different copyright notice
>>> to gentoo.git
>>
>> According to whom or what?
>>
> 
> https://devmanual.gentoo.org/ebuild-writing/file-format/index.html
> Under ebuild header.
> 
> This is a Gentoo policy.  Repoman will complain if you violate this.
> It will get noticed and treecleaned if you ignore repoman.  Devs who
> violate the policy will be warned, etc.
> 
> The policy could be changed, and there have been discussions around
> improvements:
> https://dev.gentoo.org/~rich0/copyrightpolicy.xml
> 
> The main issue I'm aware of with that draft is that it is painful to
> track who has copyright on what to put the proper copyright notice on
> each file.  Suggestions are welcome.
> 
This made me think of another scenario; let's say I have my own fork of
Gentoo, maintained in an overlay complete with docs, etc, under an MIT
or BSD license, but as a Gentoo developer, I must copyright under GPL.
Could I do such dual licensing on a case-by-case basis because (in this
hypothetical) I'm the original author of the ebuilds?

If so, then Matt's coworker could offer the same ebuild under a
Gentoo-friendly license and maintain copyright on Google's overlay. The
only question at that point would be Google's own copyright policy and
whether or not its employees own any of what they produce on company time.

-- 
Daniel Campbell - Gentoo Developer
OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net
fpr: AE03 9064 AE00 053C 270C  1DE4 6F7A 9091 1EA0 55D6



signature.asc
Description: OpenPGP digital signature


Re: [gentoo-dev] Contributed ebuilds and copyright questions

2016-10-24 Thread Rich Freeman
On Mon, Oct 24, 2016 at 7:47 PM, Matt Turner  wrote:
> On Mon, Oct 24, 2016 at 4:43 PM, Rich Freeman  wrote:
>> I personally tend to favor a mandatory DCO (we absolutely need to know
>> the copyright status of our code), and a voluntary FLA (which I tend
>> to prefer to outright assignment as I think it lines up well with our
>> always-free social contract).
>
> Do you have any ideas about how that might work for previous
> contributions? Plenty of developers have come and gone (and died!)
> since gentoo began accepting commits.
>

Existing copyright headers would be grandfathered as-is unless
somebody comes forward with a specific concern.  Over time the tree
just improves.  That is my suggestion at least, it is certainly no
worse than we are today, and a decade from now the really old stuff
will be gone.

-- 
Rich



[gentoo-dev] Commented packages in the @system set

2016-10-24 Thread Michael Orlitzky
Looking at profiles/base/packages, I see a bunch of lines that are
commented out. For example,

  *sys-apps/which
  #*sys-devel/autoconf
  #*sys-devel/automake
  *sys-devel/binutils
  #*sys-devel/bison
  #*sys-devel/flex
  *sys-devel/gcc

Does anyone know why those are commented as opposed to just.. not there?




Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread Matthias Maier
> Well, depending on how this is done the main harm is in administrative
> overhead, unless this is automated, or we use a simplistic approach of
> just continuing to append names.

The pragmatic approach would be to remove the policy and associated
repoman warning and allow contributors to use an alternative copyright
line instead. We could provide a "I don't care" skeleton of the form:

  # Copyright 1999-2016 Gentoo developers and contributors
  # Distributed under the terms of the GNU General Public License v2
  # Author(s): John Doe , ...

(with, or without the Author(s) line)

A modified repoman check could enforce a layout of the form

  # Copyright - [...]
  # Distributed under the terms of the GNU General Public License v2
 [# Author(s): [...]]


We don't have to modify all existing ebuilds to do that. Alternatively,
we can simply change all headers to

  # Copyright 1999-2016 Gentoo developers and contributors

(if the Gentoo Foundation is OK with the few ebuilds were it holds a
copyright ^^).


Best,
Matthias



Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread Rich Freeman
On Mon, Oct 24, 2016 at 7:32 PM, Gordon Pettey  wrote:
> On Mon, Oct 24, 2016 at 5:40 PM, Ciaran McCreesh
>  wrote:
>>
>> On Mon, 24 Oct 2016 15:34:14 -0700
>> Matt Turner  wrote:
>> > In order to contribute to GNU projects, one must sign a copyright
>> > assignment statement.
>> >
>> > Gentoo doesn't have anything similar as far as I'm aware, which makes
>> > me question the legitimacy of "Gentoo Foundation" copyrights.
>
>
> That style makes no sense to begin with. Something is copyrighted as of the
> date it is created (whether originally or as an updated edited work), from
> that date until X years in the future depending on what country you're in.
> At worst, that range implies "This file was created in 1999 but in 20xx
> we're making it public domain". Assuming Gentoo still exists in 200 years
> and a certain mouse doesn't extend copyright durations again, a header that
> says "1999-2216" would be quite invalid. Just use the single year as of the
> date of editing. See http://www.copyright.gov/fls/fl100.html.

The end date (which is the one that matters the most) is only updated
when the file is changed.  Legally somebody could use an earlier
version of the file when its copyright expired, but they could only
use the latest version when its later copyright expires.

I do tend to agree that we should probably make the start date in each
file depend on when that file was created, but I'm not sure that
legally the start date really matters as much.

You'll see plenty of ebuilds in the tree with pre-2016 copyright end
dates.  Repoman will issue a warning if they're modified to warn devs
to update the date, which is completely appropriate legally (setting
aside the issue of who owns the copyright).

-- 
Rich



Re: [gentoo-dev] Contributed ebuilds and copyright questions

2016-10-24 Thread Matt Turner
On Mon, Oct 24, 2016 at 4:43 PM, Rich Freeman  wrote:
> I personally tend to favor a mandatory DCO (we absolutely need to know
> the copyright status of our code), and a voluntary FLA (which I tend
> to prefer to outright assignment as I think it lines up well with our
> always-free social contract).

Do you have any ideas about how that might work for previous
contributions? Plenty of developers have come and gone (and died!)
since gentoo began accepting commits.



Re: [gentoo-dev] Contributed ebuilds and copyright questions

2016-10-24 Thread Rich Freeman
On Mon, Oct 24, 2016 at 7:31 PM, Matt Turner  wrote:
>
> Yeah, it seems to be painful no matter what you do (CLA, copyright
> assignment, listing copyright holders) just in different ways :)
>

Well, the advantage of assignment is that it does simplify copyright
tracking, since you own the copyright on everything.

The problem is that it potentially cuts out a lot of contributions.
There is also the problem of nations that do not allow assignment
(though that could also be fixed in theory by just ending the Gentoo
German conspiracy).

I personally tend to favor a mandatory DCO (we absolutely need to know
the copyright status of our code), and a voluntary FLA (which I tend
to prefer to outright assignment as I think it lines up well with our
always-free social contract).

The issue remains of what to do with the copyright notice.  I
suggested just having enough names on the line to account for 51% of
the code, which as far as I can tell is completely legal.  That
doesn't preclude just listing all the names (which is ugly, but
administratively simple).  But, that does help cover us in cases where
we have some ebuild where we can only account for 60% of it.  It also
allows us to borrow anything from any other project that already has
its copyrights well-documented.

FYI, one of the original sparks that drove some of this thinking was
the eudev copyright fiasco (which like a lot of systemd-related stuff
was blown out of proportion IMO with things being attributed to malice
which were simply a lack of thinking things through).  This was the
first time Gentoo really forked and internalized a major external
project, and there was a clash between our previous practices designed
for dev-written code and the large import of external code.  Under the
draft copyright policy we'd have just maintained the previous
copyright headers, perhaps just reformatting them to the top of the
file per our convention if they weren't already there (which is
completely legal).  If at some point enough code in a file got
rewritten to have majority-FLA authorship we'd have the option to
change it to Gentoo and others, though we wouldn't have to.

-- 
Rich



Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread William L. Thomson Jr.
On Monday, October 24, 2016 7:28:45 PM EDT Rich Freeman wrote:
>
> Completely true, which is why devs aren't supposed to add ebuilds they
> don't hold copyright on without permission.  A DCO would probably help
> with this, which is why that is generally considered a best practice.

I think it is ok if you credit original work with copyright statement and link 
to source. More complex if ebuild development is ongoing. Less so if its a one 
time add to tree and is maintained under Gentoo copyright from there.

That at least should address any legalities temporarily. Though not best long 
term solution.

-- 
William L. Thomson Jr.


signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-dev] Contributed ebuilds and copyright questions

2016-10-24 Thread Matt Turner
On Mon, Oct 24, 2016 at 4:18 PM, Rich Freeman  wrote:
> On Mon, Oct 24, 2016 at 7:12 PM, Matt Turner  wrote:
>> On Mon, Oct 24, 2016 at 4:03 PM, Rich Freeman  wrote:
>>> You cannot currently commit anything with a different copyright notice
>>> to gentoo.git
>>
>> According to whom or what?
>>
>
> https://devmanual.gentoo.org/ebuild-writing/file-format/index.html
> Under ebuild header.

Thank you.

> This is a Gentoo policy.  Repoman will complain if you violate this.
> It will get noticed and treecleaned if you ignore repoman.  Devs who
> violate the policy will be warned, etc.
>
> The policy could be changed, and there have been discussions around
> improvements:
> https://dev.gentoo.org/~rich0/copyrightpolicy.xml
>
> The main issue I'm aware of with that draft is that it is painful to
> track who has copyright on what to put the proper copyright notice on
> each file.  Suggestions are welcome.

Yeah, it seems to be painful no matter what you do (CLA, copyright
assignment, listing copyright holders) just in different ways :)



Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread Gordon Pettey
On Mon, Oct 24, 2016 at 5:40 PM, Ciaran McCreesh <
ciaran.mccre...@googlemail.com> wrote:

> On Mon, 24 Oct 2016 15:34:14 -0700
> Matt Turner  wrote:
> > In order to contribute to GNU projects, one must sign a copyright
> > assignment statement.
> >
> > Gentoo doesn't have anything similar as far as I'm aware, which makes
> > me question the legitimacy of "Gentoo Foundation" copyrights.


That style makes no sense to begin with. Something is copyrighted as of the
date it is created (whether originally or as an updated edited work), from
that date until X years in the future depending on what country you're in.
At worst, that range implies "This file was created in 1999 but in 20xx
we're making it public domain". Assuming Gentoo still exists in 200 years
and a certain mouse doesn't extend copyright durations again, a header that
says "1999-2216" would be quite invalid. Just use the single year as of the
date of editing. See http://www.copyright.gov/fls/fl100.html.


Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread Rich Freeman
On Mon, Oct 24, 2016 at 7:25 PM, William L. Thomson Jr.
 wrote:
> On Monday, October 24, 2016 7:07:41 PM EDT Rich Freeman wrote:
>>
>> I think you could make an argument that voluntarily placing that header on
>> your work is an assignment of copyright.
>
> For the original author. That is not the case if adding another's ebuild to
> tree. Which seems to be the problem in the other thread.
>

Completely true, which is why devs aren't supposed to add ebuilds they
don't hold copyright on without permission.  A DCO would probably help
with this, which is why that is generally considered a best practice.

-- 
Rich



Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread Rich Freeman
On Mon, Oct 24, 2016 at 7:21 PM, Matthias Maier  wrote:
>> I think you could make an argument that voluntarily placing that
>> header on your work is an assignment of copyright.
>
> I very much doubt that.
>

Well, like I said you can argue it either way.  Everybody is going to
have an opinion, but the only ones that matter are those of the
various top-level courts internationally, especially the US Supreme
Court (since US law tends to get enforced extra-judicially).

>
> And I see absolutely no harm in explicitly annotating the actual
> copyright in gentoo ebuilds.
>

Well, depending on how this is done the main harm is in administrative
overhead, unless this is automated, or we use a simplistic approach of
just continuing to append names.

-- 
Rich



Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread William L. Thomson Jr.
On Monday, October 24, 2016 7:07:41 PM EDT Rich Freeman wrote:
>
> I think you could make an argument that voluntarily placing that header on  
> your work is an assignment of copyright. 

For the original author. That is not the case if adding another's ebuild to 
tree. Which seems to be the problem in the other thread.

-- 
William L. Thomson Jr.


signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread Matthias Maier
> I think you could make an argument that voluntarily placing that
> header on your work is an assignment of copyright.

I very much doubt that.



> Personally I'd rather move to an explicit system.

Yes!

And I see absolutely no harm in explicitly annotating the actual
copyright in gentoo ebuilds.



Best,
Matthias



Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread Rich Freeman
On Mon, Oct 24, 2016 at 7:10 PM, Matt Turner  wrote:
> On Mon, Oct 24, 2016 at 4:07 PM, Rich Freeman  wrote:
>> On Mon, Oct 24, 2016 at 6:34 PM, Matt Turner  wrote:
>>> In order to contribute to GNU projects, one must sign a copyright
>>> assignment statement.
>>>
>>> Gentoo doesn't have anything similar as far as I'm aware, which makes
>>> me question the legitimacy of "Gentoo Foundation" copyrights.
>>>
>>> What is the story?
>>>
>>
>> The story of what?
>>
>> Are you asking whether they're legally binding?  You'd have to sue
>> somebody to find out, because as far as I'm aware the matter is
>> untested in court.  I think you could make an argument that
>> voluntarily placing that header on your work is an assignment of
>> copyright.  You could also argue otherwise.  A court would decide who
>> wins.
>
> I'm asking whether we're just cargo-culting it along, or if we have
> (had) some kind of system in place to assign copyright. I think Ciaran
> answered: we used to but not anymore.
>

As I said, you could debate whether the present system already assigns
copyright.  I don't think it is ideal.  It certainly isn't backed by
any court decisions that I'm aware of.  That doesn't necessarily mean
that it wouldn't be upheld if it did go to court.  There is really no
way to be certain without trying it.

But, it is better to rely upon methods that are already proven in
court over ones that have yet to be proven.  I'm not disputing that.

-- 
Rich



Re: [gentoo-dev] Contributed ebuilds and copyright questions

2016-10-24 Thread Rich Freeman
On Mon, Oct 24, 2016 at 7:12 PM, Matt Turner  wrote:
> On Mon, Oct 24, 2016 at 4:03 PM, Rich Freeman  wrote:
>> You cannot currently commit anything with a different copyright notice
>> to gentoo.git
>
> According to whom or what?
>

https://devmanual.gentoo.org/ebuild-writing/file-format/index.html
Under ebuild header.

This is a Gentoo policy.  Repoman will complain if you violate this.
It will get noticed and treecleaned if you ignore repoman.  Devs who
violate the policy will be warned, etc.

The policy could be changed, and there have been discussions around
improvements:
https://dev.gentoo.org/~rich0/copyrightpolicy.xml

The main issue I'm aware of with that draft is that it is painful to
track who has copyright on what to put the proper copyright notice on
each file.  Suggestions are welcome.

-- 
Rich



Re: [gentoo-dev] Contributed ebuilds and copyright questions

2016-10-24 Thread Matt Turner
On Mon, Oct 24, 2016 at 4:03 PM, Rich Freeman  wrote:
> You cannot currently commit anything with a different copyright notice
> to gentoo.git

According to whom or what?



Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread Matt Turner
On Mon, Oct 24, 2016 at 4:07 PM, Rich Freeman  wrote:
> On Mon, Oct 24, 2016 at 6:34 PM, Matt Turner  wrote:
>> In order to contribute to GNU projects, one must sign a copyright
>> assignment statement.
>>
>> Gentoo doesn't have anything similar as far as I'm aware, which makes
>> me question the legitimacy of "Gentoo Foundation" copyrights.
>>
>> What is the story?
>>
>
> The story of what?
>
> Are you asking whether they're legally binding?  You'd have to sue
> somebody to find out, because as far as I'm aware the matter is
> untested in court.  I think you could make an argument that
> voluntarily placing that header on your work is an assignment of
> copyright.  You could also argue otherwise.  A court would decide who
> wins.

I'm asking whether we're just cargo-culting it along, or if we have
(had) some kind of system in place to assign copyright. I think Ciaran
answered: we used to but not anymore.



Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread Rich Freeman
On Mon, Oct 24, 2016 at 6:34 PM, Matt Turner  wrote:
> In order to contribute to GNU projects, one must sign a copyright
> assignment statement.
>
> Gentoo doesn't have anything similar as far as I'm aware, which makes
> me question the legitimacy of "Gentoo Foundation" copyrights.
>
> What is the story?
>

The story of what?

Are you asking whether they're legally binding?  You'd have to sue
somebody to find out, because as far as I'm aware the matter is
untested in court.  I think you could make an argument that
voluntarily placing that header on your work is an assignment of
copyright.  You could also argue otherwise.  A court would decide who
wins.

Personally I'd rather move to an explicit system.

-- 
Rich



Re: [gentoo-dev] Contributed ebuilds and copyright questions

2016-10-24 Thread Rich Freeman
On Mon, Oct 24, 2016 at 6:29 PM, Matt Turner  wrote:
> A former co-worker of mine is now at Google and wants to contribute
> ebuilds he wrote for ChromeOS to Gentoo. They add packages necessary
> for Vulkan (new 3D graphics API).
>
> For instance: 
> https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/master/media-libs/vulkan-loader/vulkan-loader-1.0.24.0.ebuild
>
> The copyright header says "Copyright 2016 The Chromium OS Authors. All
> rights reserved." All ebuilds in gentoo.git say "Copyright 1999-20xx
> Gentoo Foundation".
>
> Can I add ebuilds copyrighted by others to gentoo.git?
>

As long as you have their permission to change the copyright notice.
You cannot currently commit anything with a different copyright notice
to gentoo.git, and you cannot legally change it without permission.

-- 
Rich



Re: [gentoo-dev] Contributed ebuilds and copyright questions

2016-10-24 Thread William L. Thomson Jr.
On Monday, October 24, 2016 3:29:30 PM EDT Matt Turner wrote:
> A former co-worker of mine is now at Google and wants to contribute
> ebuilds he wrote for ChromeOS to Gentoo. They add packages necessary
> for Vulkan (new 3D graphics API).
> 
> For instance:
> https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/
> master/media-libs/vulkan-loader/vulkan-loader-1.0.24.0.ebuild
> 
> The copyright header says "Copyright 2016 The Chromium OS Authors. All
> rights reserved." All ebuilds in gentoo.git say "Copyright 1999-20xx
> Gentoo Foundation".
> 
> Can I add ebuilds copyrighted by others to gentoo.git?

For the time being since there is not another way to address. I have been 
going with the following. Which should suffice for now, but could clutter up 
ebuilds if it happens to allot. At the same time it should reflect origin 
somewhere, and not sure buried VC commit log  is enough.

# Copyright 1999-2016 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Id$
#
# Original work Copyright 2016 Obsidian-Studios, Inc.
# Ebuild written by "William L. Thomson Jr." 
# 

Per my readme
https://github.com/Obsidian-StudiosInc/os-xtoo

It was inspired by from source icedtea ebuilds. I can't recall where I saw the 
original work but got it from some where.

-- 
William L. Thomson Jr.


signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread Ciaran McCreesh
On Mon, 24 Oct 2016 15:34:14 -0700
Matt Turner  wrote:
> In order to contribute to GNU projects, one must sign a copyright
> assignment statement.
> 
> Gentoo doesn't have anything similar as far as I'm aware, which makes
> me question the legitimacy of "Gentoo Foundation" copyrights.
> 
> What is the story?

Gentoo did have a copyright transfer agreement at one point, which was
written by an actual paid-for lawyer. Developers had to agree to hand
over their floppy disks and monitors to the Foundation upon request.
Developers who were recruited in a particular time window had to sign
it, but anyone who started before didn't.

-- 
Ciaran McCreesh



[gentoo-dev] Are "Copyright 1999-20xx Gentoo Foundation" headers bogus?

2016-10-24 Thread Matt Turner
In order to contribute to GNU projects, one must sign a copyright
assignment statement.

Gentoo doesn't have anything similar as far as I'm aware, which makes
me question the legitimacy of "Gentoo Foundation" copyrights.

What is the story?

(I thought my other thread "Contributed ebuilds and copyright
questions" might devolve into a discussion on this point, so this is
my preventative attempt to contain it here)



[gentoo-dev] Contributed ebuilds and copyright questions

2016-10-24 Thread Matt Turner
A former co-worker of mine is now at Google and wants to contribute
ebuilds he wrote for ChromeOS to Gentoo. They add packages necessary
for Vulkan (new 3D graphics API).

For instance: 
https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/master/media-libs/vulkan-loader/vulkan-loader-1.0.24.0.ebuild

The copyright header says "Copyright 2016 The Chromium OS Authors. All
rights reserved." All ebuilds in gentoo.git say "Copyright 1999-20xx
Gentoo Foundation".

Can I add ebuilds copyrighted by others to gentoo.git?



Re: [gentoo-dev] Dealing with GitHub Pull Requests the easy way

2016-10-24 Thread Rich Freeman
On Mon, Oct 24, 2016 at 3:21 AM, Daniel Campbell (zlg)  wrote:
>
> On October 23, 2016 11:29:49 PM PDT, "Michał Górny"  wrote:
>>Dnia 24 października 2016 07:32:26 CEST, Daniel Campbell
>> napisał(a):
>>>On 10/19/2016 02:10 AM, Ulrich Mueller wrote:
 Maybe I have missed something, but why would one use --signoff for
 a Gentoo commit?

 For Linux (the kernel), the meaning of the line is that the
 contributor certifies the DCO (Developer's Certificate of Origin)
>>>[1].
 As we don't have a Gentoo DCO, it is not at all clear to me what the
 meaning of a Signed-off-by: line would be in the context of the
>>>gentoo
 tree.

 Even worse, I see commits having Signed-off-by: lines with obvious
 pseudonyms instead of a real name, which would be meaningless even
>>if
 one would say that the Linux rules apply. (Also, we have the rule
>>>that
 real names must be provided for all developers, with no exceptions
>>to
 be made for people doing copyrightable work [2].)

 [1]
>>>http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/SubmittingPatches?id=dca22a63fd036c3ebb50212060eba0080f178126#n428
 [2]
>>>https://wiki.gentoo.org/wiki/Project:Recruiters#What_does_the_recruitment_process_involve.3F

>>>The way I understood "signed off by" for Gentoo is "I am a developer
>>>who
>>>looked at the code and tested it, confirming it works on my system".
>>If
>>>an AT signs off, they are certifying that it passes their test muster.
>>>
>>>It's a more formal "looks good to me", and provides a point of
>>>accountability if the commit _isn't_ up to par.
>>
>>How about Gentoo developers stopping to reuse things that have
>>well-defined meaning for something completely different?
>
> I did say "to my understanding". I wasn't aware of DCOs. Regardless, 
> practices and workflows differ between projects, and it doesn't surprise me 
> to see projects that use the same words differently. Not that we should, of 
> course. What would you call what I decribed, though; Acked?

I don't think we need a git header for the purpose of saying that
something looks good to somebody else.  If you commit something and it
doesn't work, we'll ask you to stop doing it.  If you keep doing it
we'll take away your commit access.  This is purely an internal
problem.

The purpose of a DCO is to withstand external scrutiny.  It helps
protect Gentoo in the event that somebody else's copyrighted code
makes it into the distro.  The audience for a signed-off-by header
isn't Comrel or QA, but rather a court of law.  It makes it harder to
contribute something to Gentoo and then argue that you didn't intend
for Gentoo to redistribute it under the GPL, or that now that you've
had a falling out you'd prefer that Gentoo remove all your past
contributions.

However, it has absolutely no meaning at all if it isn't 100% clear
what is being signed.  And if we have a long history of people adding
the header when it doesn't mean anything legally then it will probably
make it harder to argue that it suddenly means something when the
policy changes.

For example, suppose we institute a DCO tomorrow.  Then zlg ragequits
in 2 years and claims he never gave us permission to redistribute his
code under the GPL.  We point to his signed-off-by headers but he says
he never heard of the DCO policy and that it was just some default
setting in his config, and that he was adding the headers long before
the policy went into effect.  I don't think it would stick but it
really isn't an out we want to give people.  IMO infra should reject
commits with this header until we have a DCO, and then it should
reject commits without this header.  Alternatively, we could skip the
first part but require all existing devs to ack the new copyright
policy whenever it happens.

-- 
Rich



Re: [gentoo-dev] Dealing with GitHub Pull Requests the easy way

2016-10-24 Thread Kristian Fiskerstrand
On 10/24/2016 09:21 AM, Daniel Campbell (zlg) wrote:
> What would you call what I decribed, though; Acked?

Acked-By and/or Reviewed-By (although we don't have a specific
reviewer's statement in Gentoo (yet?))

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3



signature.asc
Description: OpenPGP digital signature


Re: [gentoo-dev] Dealing with GitHub Pull Requests the easy way

2016-10-24 Thread Daniel Campbell (zlg)
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On October 23, 2016 11:29:49 PM PDT, "Michał Górny"  wrote:
>Dnia 24 października 2016 07:32:26 CEST, Daniel Campbell
> napisał(a):
>>On 10/19/2016 02:10 AM, Ulrich Mueller wrote:
 On Wed, 19 Oct 2016, Kent Fredric wrote:
>>>
 On Tue, 18 Oct 2016 21:45:05 -0500
 Matthew Thode  wrote:
>>>
> Does pram allow you to pass options to git
> am (signedoffby for instance)?
>>>
 It doesn't presently allow arbitrary arguments, and it would
 probably be wise to avoid need for such arguments and prefer
 convention over configuration, given what this is.
>>>
 --signoff is already a default:
>>>

>>https://metacpan.org/source/MONSIEURP/Gentoo-App-Pram-0.003000/lib/Gentoo/App/Pram.pm#L71
>>>
>>> Maybe I have missed something, but why would one use --signoff for
>>> a Gentoo commit?
>>>
>>> For Linux (the kernel), the meaning of the line is that the
>>> contributor certifies the DCO (Developer's Certificate of Origin)
>>[1].
>>> As we don't have a Gentoo DCO, it is not at all clear to me what the
>>> meaning of a Signed-off-by: line would be in the context of the
>>gentoo
>>> tree.
>>>
>>> Even worse, I see commits having Signed-off-by: lines with obvious
>>> pseudonyms instead of a real name, which would be meaningless even
>if
>>> one would say that the Linux rules apply. (Also, we have the rule
>>that
>>> real names must be provided for all developers, with no exceptions
>to
>>> be made for people doing copyrightable work [2].)
>>>
>>> Ulrich
>>>
>>> [1]
>>http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/SubmittingPatches?id=dca22a63fd036c3ebb50212060eba0080f178126#n428
>>> [2]
>>https://wiki.gentoo.org/wiki/Project:Recruiters#What_does_the_recruitment_process_involve.3F
>>>
>>The way I understood "signed off by" for Gentoo is "I am a developer
>>who
>>looked at the code and tested it, confirming it works on my system".
>If
>>an AT signs off, they are certifying that it passes their test muster.
>>
>>It's a more formal "looks good to me", and provides a point of
>>accountability if the commit _isn't_ up to par.
>
>How about Gentoo developers stopping to reuse things that have
>well-defined meaning for something completely different?

I did say "to my understanding". I wasn't aware of DCOs. Regardless, practices 
and workflows differ between projects, and it doesn't surprise me to see 
projects that use the same words differently. Not that we should, of course. 
What would you call what I decribed, though; Acked?
- --
Sent from my Android device with K-9 Mail. Please excuse my brevity.
-BEGIN PGP SIGNATURE-

iQJRBAEBCgA7NBxEYW5pZWwgQ2FtcGJlbGwgKEdlbnRvbyBEZXZlbG9wZXIpIDx6
bGdAZ2VudG9vLm9yZz4FAlgNtlQACgkQASQOlFA54XDmhw/9HbEDo60eZp38AUMf
TgCnj8fYka65Pc9CjLBpJAcvekM2oRcSHB61FdAy8tqIVb7Zx8IvIXNXseOc9sP4
0qNSy89gOKkNRIPx/DC8JFVlmK6YoD5ezZ05tKdzFwcdBvHcJWhKfbO2R2f6L/g5
woLZb4qgxQdFNwOykDy2Ux83W075hFbHaAw9zwpVKAb9LvtMfiJJ2AYEecmnOZDx
uVVnkxMrOpAKABhcUqc3d8MnB2NCPwZogL3Z+71duy3puU+71Y338w64vrXDioBY
4pPVIrXk4Ifa799xjCj+Wr2sWYzgHqdJe/cReYZXjRMRzxbvLiZo1PWLejMWgczk
CRX0lh6o0cohDxX8oEMiY3s3COqQvD928FzppGkW+8+XQaqXE64VEyHszMuILPL3
cLBbRt39ujmSPJUp/5mX3yUA761QcvRv4wPaDAf81NYllepLoYh2IL9j+5Iqfrf4
QNm/bUeuwxnvLZOMNGTyih/5w2GvhKhLunp170Lm4LGf6BQoEw60ZYot6OlvKFLF
Th8oaacTc9acVa7K2lDlH+2ARsqFvfwQgEjGaLczfhFXi8lzIckgtb7Shn1UjEB5
u/7AwgGmO0rC3Mt9GXL7P5xYgWInNxEeyNP+O0d7Lu5CnBsKI9fUvoYnGZblSAWn
yt44aBJYOgIzLklGfuQm6xhgdDc=
=eesR
-END PGP SIGNATURE-