Re: DCO: Was: Re: Contributing to gdb

On 1/17/25 10:37, Florian Weimer wrote:
> * Eli Zaretskii via Gdb:
> 
>>> From: Andrew Burgess <[email protected]>
>>> Cc: Andrew Pinski <[email protected]>, GDB Development <[email protected]>,
>>>  Eli Zaretskii <[email protected]>
>>> Date: Mon, 13 Jan 2025 17:14:41 +0000
>>>
>>> I think that Eli believes the concerns with FSF assignment are
>>> overblown, and given the information provided, I'm inclined to agree.
>>> But at this point, with other components accepting DCO, I'm not sure
>>> that's really relevant.  Unless there's a super compelling reason why
>>> GDB should diverge ... I think we should fall into line with the other
>>> components.
>>
>> I mostly fear that by accepting DCOs we will open ourselves to
>> contributions from people who are not authorized to contribute their
>> code (e.g., it was copied from somewhere, or their employment contract
>> makes all their code the property of their employer, or something of
>> that nature).  DCO makes it much easier to submit code based on
>> incorrect understanding of what the DCO text says, so the probability
>> for honest mistakes is higher than with CA.
> 
> It is possible that someone signs a copyright assignment without being
> authorized to do so, which is exactly the same problem.  As far as I
> know, the FSF doesn't verify that the signer has been authorized by the
> organization that owns the rights.  In general, this can be quite
> difficult to do.  Whether that's more or less likely to happen than a
> DCO mis-submission is hard to tell.
> 
> Thanks,
> Florian
> 

I suppose someone going through the trouble of actually signing a contract
is a bit more effort than just sticking a Signed-Off-By tag in a commit.

Doesn't feel like those two things are at the same level, but others may
disagree.