Re: DCO: Was: Re: Contributing to gdb

[Florian Weimer via Gdb <gdb@sourceware.org>]

* Eli Zaretskii via Gdb:

>> From: Andrew Burgess <aburgess@redhat.com>
>> Cc: Andrew Pinski <pinskia@gmail.com>, GDB Development <gdb@sourceware.org>,
>>  Eli Zaretskii <eliz@gnu.org>
>> Date: Mon, 13 Jan 2025 17:14:41 +0000
>> 
>> I think that Eli believes the concerns with FSF assignment are
>> overblown, and given the information provided, I'm inclined to agree.
>> But at this point, with other components accepting DCO, I'm not sure
>> that's really relevant.  Unless there's a super compelling reason why
>> GDB should diverge ... I think we should fall into line with the other
>> components.
>
> I mostly fear that by accepting DCOs we will open ourselves to
> contributions from people who are not authorized to contribute their
> code (e.g., it was copied from somewhere, or their employment contract
> makes all their code the property of their employer, or something of
> that nature).  DCO makes it much easier to submit code based on
> incorrect understanding of what the DCO text says, so the probability
> for honest mistakes is higher than with CA.

It is possible that someone signs a copyright assignment without being
authorized to do so, which is exactly the same problem.  As far as I
know, the FSF doesn't verify that the signer has been authorized by the
organization that owns the rights.  In general, this can be quite
difficult to do.  Whether that's more or less likely to happen than a
DCO mis-submission is hard to tell.

Thanks,
Florian