Re: Developer's Certificate of Origin

Soren Stoutner <[email protected]> Tue, 26 Nov 2024 12:57:44 -0700
Newsgroups	gmane.linux.debian.devel.legal
Organization	Debian
Message-ID	<4996965.SHZJYqZtLP@soren-desktop>
On Tuesday, November 26, 2024 11:29:56 AM MST Daniel Hakimi wrote:
> The DCO is very intentionally *not* a license of any kind. A Contributor
> License Agreement is a license. The DCO was invented because many
> contributors were uncomfortable with contributor license agreements for
> various reasons. All the DCO does is confirm that you have the right to
> make the contribution, it does not grant any permission from anybody to
> anybody.

I respectfully disagree with you on this point.

1.  The DCO itself says it is a license.

"Everyone is permitted to copy and distribute verbatim copies of this
*license* document, but changing it is not allowed."

2.  The DCO is designed to be paired with another document.  It expressly 
*grants the permissions* described in that second document, *and*, it states 
that the person doing so has the *rights to grant* that license.  In that 
sense, it is similar to a copyright statement, without which a license is not 
complete (because only a copyright holder can grant a license to another 
person), but it is more specifically a partial license that is fully understood 
when paired with the other part of the license referenced in the other file, 
like the abbreviated GPL statement in the header of a source code file that 
references the full GPL text at a URL.

"By making a contribution to this project, I certify that:"

"(a) The contribution was created in whole or in part *by me* and I
    have the *right to submit* it under the *open source license
    indicated in the file*; or"

"(b) The contribution is based upon previous work that, to the best
    of my knowledge, is covered under an appropriate open source
    license and *I have the right* under that license to submit that
    work with modifications, whether created in whole or in part
    by me, under the *same open source license* (unless I am
    permitted to submit under a different license), as indicated
    in the file; or"

The DCO was designed to be generic, but it is easier to see how it is a 
license if you replace the generic “open source license indicated in the file” 
with the name of whatever license is indicated in the file.  For example, in a 
specific case, the DCO could have the following effective meaning:

""(a) The contribution was created in whole or in part *by me* and I
    have the *right to submit* it under the *GPL
    indicated in the file*; or”

"(b) The contribution is based upon previous work that, to the best
    of my knowledge, is covered *GPL indicated in the file" and *I have the
    right* under *the GPL* to submit that
    work with modifications, whether created in whole or in part
    by me, under the *same open source license* (unless I am
    permitted to submit under a different license), as indicated
    in the file; or"

So, to summarize, the DCO is a license, but it is not the license under which 
the files are delivered to the end users.  Rather, it is part of the license 
under which the files are delivered from the contributor to the project.

-- 
Soren Stoutner
[email protected]
signature.asc (application/pgp-signature, 833 B)