DCO: Was: Re: Contributing to gdb

[Eli Zaretskii]

> From: Florian Weimer <fweimer@redhat.com>
> Cc: Andrew Burgess <aburgess@redhat.com>,  Eli Zaretskii <eliz@gnu.org>,
>   luis.machado@arm.com,  tom@tromey.com,  blarsen@redhat.com,
>   pinskia@gmail.com
> Date: Fri, 17 Jan 2025 11:37:54 +0100
> 
> * Eli Zaretskii via Gdb:
> 
> > I mostly fear that by accepting DCOs we will open ourselves to
> > contributions from people who are not authorized to contribute their
> > code (e.g., it was copied from somewhere, or their employment contract
> > makes all their code the property of their employer, or something of
> > that nature).  DCO makes it much easier to submit code based on
> > incorrect understanding of what the DCO text says, so the probability
> > for honest mistakes is higher than with CA.
> 
> It is possible that someone signs a copyright assignment without being
> authorized to do so, which is exactly the same problem.  As far as I
> know, the FSF doesn't verify that the signer has been authorized by the
> organization that owns the rights.

verification is not the issue here, the issue is whether the
contributor is at all aware of this aspect.

The copyright assignment process includes the contributor filling a
form, where he/she is asked whether they have an employer that should
be included in the process:

  [Do you have an employer who might have a basis to claim to own
  your changes?  Do you attend a school which might make such a claim?]

I think reasonable people will always know to answer those questions,
or at least ask the FSF copyright clerk what is the meaning of "an
employer who might have a basis to claim to own your changes" (and
similarly the meaning of the question about the school).

By contrast, AFAIK there's no such process in sending the DCO.