Re: Developer's Certificate of Origin

Soren Stoutner <[email protected]> Tue, 26 Nov 2024 11:29:12 -0700
Newsgroups	gmane.linux.debian.devel.legal
Organization	Debian
Message-ID	<5592914.mo8hfmJPkB@soren-desktop>
On Tuesday, November 26, 2024 10:28:18 AM MST Daniel Hakimi wrote:
> The DCO is not technically a license, but it is a legal document that
> usually comes along with a license from the contributor to the project
> (that license usually being the project license). It also serves to replace
> a Contributor License Agreement, offering only a base level of assurances
> that the contributor has permission to make the contributions. Without a
> DCO, a contribution is legally suspect; it carries no inherent guarantee
> that the contributor wrote the code or owns the code, for all you know the
> contribution was just copied off stack overflow, or from the contributor's
> company's private code base.
> 
> In practice, although it is not a license, the DCO should be accepted as is
> for the same reasons license text is accepted; free software does not
> depend on the freedom to modify the DCO, and is in fact better served by a
> non-modifiable DCO. There is still no real reason why the DCO itself needs
> to be licensed under free terms, and plenty of reasons why it shouldn't.
> This is a non-issue.

I agree with the above sentiment, but I would disagree in the way the term 
“license” is being defined.

The GPL is a license granted from the project to users of the project.

The DCO is a license granted from contributors of code to the project, which 
then becomes part of the license the project grants to users.

Both are licenses.  Above it is stated that the DCO ”serves to replace a 
Contributor License Agreement”, but I think it would be more accurate to say, 
“the DCO *is* a Contributor License Agreement”.

The DCO identifies itself as a "license document”, and it is expressly stating 
how the contributor is licensing his contribution, which is, "under the open 
source license indicated in the file” and then certifies that the person giving 
this license has the appropriate authority to do so.

In regards to the question raised earlier about if this should appear in 
debian/copyright, the DCO itself shouldn’t appear, but the results of any 
contributions to the project made under the DCO should.  So, for example, the 
"open source license indicated in the file” referenced by the DCO should be in 
debian/copyright.  And, any copyright information the contributor listed in 
the file will also be there.

-- 
Soren Stoutner
[email protected]
signature.asc (application/pgp-signature, 833 B)