Re: DCO: Was: Re: Contributing to gdb

[Luis Machado via Gdb <gdb@sourceware.org>]

On 1/14/25 15:10, Simon Marchi wrote:
> 
> 
> On 2025-01-14 04:49, Luis Machado via Gdb wrote:
>> While I agree having gdb be the sole bureaucratic entity not accepting DCO
>> with the other GNU tools projects accepting it (in particular because we
>> share code with binutils, so technically we'd have to make a joint decision),
>> DCO's don't seem to come for free, as we need to track each and every one of
>> those contributions so we can refer back to them when/if we ever decide to
>> update/switch licenses or if a legal problem arises.
>>
>> The contributions are not gdb's, they are still owned by their contributors,
>> but those are granted the right to be distributed by gdb under the GPL, if I
>> understand it correctly.
>>
>> That is potentially a lot of work, and really needs to be taken seriously if
>> we really want to do things by the book. Makes me wonder how we're supposed
>> to track this.
> 
> My understanding is that the tracking is done using the "Signed-off-by"
> git trailer.  I don't know of any project tracking contributions more
> extensively than that.
> 
> Simon

That's what I see as well. But my understanding is that the identifier used
in the Signed-off-by needs to translate to a reachable entity/person. If ever
there is a problem with a particular contribution, whether it needs to be
reverted or the code ownership is being challenged, that person needs to
be reachable so appropriate action could be taken to rectify the situation.

Also, if the project ever wants to do a change/move to new licensing terms,
the project will need the approval of these contributors. Hence my observation
that this seems like a significant amount of work (for the project) that needs to
be done to ensure these contributors are always known and reachable.

From reading things about DCO, it seems to rely on country-specific
interpretations and legal systems. The Signed-off-by git tag may or
may not be enough guarantee compared to CLA's.

Obvious disclaimer, this is from doing some research on the topic. I don't
have a background in legal. But it doesn't seem to me like DCO's are as simple
as just adding tags to git commits as some seem to assume.