Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:127147
Precedence: bulk
MIME-Version: 1.0
Date: Fri, 18 Apr 2025 18:37:19 +0200
Message-ID: <CAEKnhAHORcGZtWOe9_2gOabTqMKHBGTMN6LEm=fFieWtZO30nQ@mail.gmail.com>
Subject: [PHP-DEV] Requiring DCO (Developer Certificate of Origin)
To: PHP internals list <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000077125e0633102224"
From: bukka@php.net (Jakub Zelenka)

--00000000000077125e0633102224
Content-Type: text/plain; charset="UTF-8"

Hi,

We just had some private discussions about the implication of contributing
under pseudonym. This is in general fine and we should not have problem
with it and we actually never verified the contributors so this is possibly
happening already.

The only thing about it is that it might raise questions why the pseudonym
is used. This is quite likely completely fine and it might be just that the
author does not want to share their personal details. We should not be
asking those authors to provide their identity because it's their personal
choice and we should respect it.

That said we also need to think about the project and possible risk that
this can also bring. One of those is potentially hiding the identity
because the author does not have rights to contribute (e.g. their employer
has that right). Even though this unlikely, it's a problem that we should
consider. There is quite easy solution for such problem though - it's a
Developer Certificate of Origin. It's pretty easy to integrate and I put
together a quick PR to add it: https://github.com/php/php-src/pull/18350 .

The implication of that is that it means that all commits (except the merge
ones) in the PR will need to have signed-off-by header with the author of
the commit. This is still fine to be signed off by the pseudonym. This also
applies to users with legal name because the same issue applies to them too
potentially.

Please let me know if you have any concerns or thoughts about this!

Kind regards,

Jakub

--00000000000077125e0633102224
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<div><br></div><div>We just had some private discussion=
s about the implication of contributing under pseudonym. This is in general=
 fine and we should not have problem with it and we actually never verified=
 the contributors so this is possibly happening already.</div><div><br></di=
v><div>The only thing about it is that it might raise questions why the pse=
udonym is used. This is quite likely completely fine and it might be just t=
hat the author does not want to share their personal details. We should not=
 be asking those authors to provide their identity because it&#39;s their p=
ersonal choice and we should respect it.</div><div><br></div><div>That said=
 we also need to think about the project and possible risk that this can al=
so bring. One of those is potentially hiding the identity because the autho=
r does not have rights to contribute (e.g. their employer has that right). =
Even though this unlikely, it&#39;s a problem that we should consider. Ther=
e is quite easy solution for such problem though - it&#39;s a Developer Cer=
tificate of Origin. It&#39;s pretty easy to integrate and I put together a =
quick PR to add it:=C2=A0<a href=3D"https://github.com/php/php-src/pull/183=
50">https://github.com/php/php-src/pull/18350</a> .</div><div><br></div><di=
v>The implication of that is that it means that all commits (except the mer=
ge ones) in the PR will need to have signed-off-by header with the author o=
f the commit. This is still fine to be signed off by the pseudonym. This al=
so applies to users with legal name because the same issue applies to them =
too potentially.</div><div><br></div><div>Please let me know if you have an=
y concerns or thoughts about this!</div><div><br></div><div>Kind regards,</=
div><div><br></div><div>Jakub</div><div><br></div><div><br></div></div>

--00000000000077125e0633102224--