Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:127151
Date: Fri, 18 Apr 2025 21:04:04 +0200 (CEST)
To: Jakub Zelenka <bukka@php.net>,
	PHP internals list <internals@lists.php.net>
Message-ID: <741043039.151003.1745003044092@email.ionos.de>
In-Reply-To: <CAEKnhAHORcGZtWOe9_2gOabTqMKHBGTMN6LEm=fFieWtZO30nQ@mail.gmail.com>
References: <CAEKnhAHORcGZtWOe9_2gOabTqMKHBGTMN6LEm=fFieWtZO30nQ@mail.gmail.com>
Subject: Re: [PHP-DEV] Requiring DCO (Developer Certificate of Origin)
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Importance: Normal
UI-OutboundReport: notjunk:1;M01:P0:DLByjj1Xr/0=;JKZksp0a2L4yFDpH4bx2EkBeKdu
 CdN2su+lRooEfDGl8jiqS6TeSSFda34M36/lEormkRV9+D+llodXI1T5FfupOfgnIqAiugtzj
 fD/RtHvSFTmzuXWYOBFL5TXfsACByGk6L1g5WtKS+rvc7bGkFd/9wRQzG/zV2gCpN4sthrs16
 r20dNe4Z5P/3LMhQFgHtJo6+ZqTe1xaHhaz/wIYMRSvHGEVKs3VnPnNQuJuIhqtG3ks8UkyJZ
 qH9JntMxYFRy1Zzw8wfhEP1CXYwj3PwRRZ4ho6Vb3BTf0Fvvi7fv0Zs38tqvBzn14R0+VKagK
 x9nwy0UshqmEnp32wGbAnwTYppdq+d3KBIgTjG3KXpi09uKNY2D9/vLFuFKmf7CIUV5Ws6sOe
 tBcVr5trzO0h9CUwBegY/pMwKIQCFVNgvBUohcOH0xOwN8T8LW098u9O/lbcM0kVTeBQI0r8l
 pWMnM/rMYoVciHEQgs4WXF4XOrLdfwFL5YYVt9mQ6bvoruealX4yNrJfXU+17f+xMkQpw6MzC
 mEqTGAB/9tspIUgYFWSoPgJ57fniP9rY4qvkMXOHbc0/RXs85pG/gZUljqIF0fIzpSwQqE9PK
 R0OPROMu4fONEXd6LhryPmHp3GrR60A2gcu1jCgeKM0NM/m63J03HUcQ0JNlLtmkCaHM5FfUv
 TlA74T1k58pJVjlZ5TXwcz9wUZG0t7z3WB1AJ/o3Uk5DMmwkMc0QSF+NW1DfJBnnR0IzHOPtN
 BabWeZNzXb1Hz46alTfxDjQRjEJ/DREy2hZMw0Ohc2BYysELJIWv5wmn4mADZW4jAH+Ct4FhY
 S91hnC8ld6dRLED2TCmkyb16tHCyby4TchHEJMDDZOHwgIacwQu04oswi2k5uUo70c0DId3zz
 wSc9nivpGcpPdDW+aYK5oKwsNtXqePL/xalRP+WTUAqKdGAKEuNb2mPwLuCVaGofbe/4hH5Et
 UaEZak7pBKpOi0efI474JzkTXWbmvfqZV/f73ovEyh9s+a3NDachoihwqSTi9j18hEmyxvDkR
 /Q308tonJPSUB36FUUVTpW187KW2vXFaTbgZI0ooWdCg7qIfntEOZb24Svan1eMNNrOC8NojG
 mo7p284K3v/eXWfE2P8rDfc1TC1CY/RRei1g/oIE4bPdxH16q8folGuhtdR++pUWaXry8SlFX
 Zb87P0uXB6DvkqXK5LKwDrw7oYRprbZ9Vfc9+Ipn8QoC72j/U0AG8rumYXfhSG5B/e6+ivjO0
 7467u/CN1RtiyguqmqDGBmvtJJnD/1zxIF1xrmPSKobvQl3cXFi7i0iBxbJCmqgShLDRxE1bH
 gMgQZD56gTp0kA+5y2kc0ZGi//xPQduN4qqy87FcZ6VnRlEG4O4UKX2BkzHrqjJvSkbbB4q0M
 YNemJuuthn/OM2hQ==
From: mails@thomasbley.de (Sai Liu)

<!doctype html>
<html>
 <head>
  <meta charset=3D"UTF-8">
 </head>
 <body>
  <div>
   &nbsp;
  </div>
  <blockquote type=3D"cite">
   <div>
    Jakub Zelenka &lt;bukka@php.net&gt; hat am 18.04.2025 18:37 CEST gesch=
rieben:
   </div>
   <div>
    &nbsp;
   </div>
   <div>
    &nbsp;
   </div>
   <div dir=3D"ltr">
    Hi,=20
    <div>
     &nbsp;
    </div>
    <div>
     We just had some private discussions about the implication of contrib=
uting under pseudonym. This is in general fine and we should not have prob=
lem with it and we actually never verified the contributors so this is pos=
sibly happening already.
    </div>
    <div>
     &nbsp;
    </div>
    <div>
     The only thing about it is that it might raise questions why the pseu=
donym is used. This is quite likely completely fine and it might be just t=
hat the author does not want to share their personal details. We should no=
t be asking those authors to provide their identity because it's their per=
sonal choice and we should respect it.
    </div>
    <div>
     &nbsp;
    </div>
    <div>
     That said we also need to think about the project and possible risk t=
hat this can also bring. One of those is potentially hiding the identity b=
ecause the author does not have rights to contribute (e.g. their employer =
has that right). Even though this unlikely, it's a problem that we should =
consider. There is quite easy solution for such problem though - it's a De=
veloper Certificate of Origin. It's pretty easy to integrate and I put tog=
ether a quick PR to add it:&nbsp;<a href=3D"https://github.com/php/php-src=
/pull/18350">https://github.com/php/php-src/pull/18350</a> .
    </div>
    <div>
     &nbsp;
    </div>
    <div>
     The implication of that is that it means that all commits (except the=
 merge ones) in the PR will need to have signed-off-by header with the aut=
hor of the commit. This is still fine to be signed off by the pseudonym. T=
his also applies to users with legal name because the same issue applies t=
o them too potentially.
    </div>
    <div>
     &nbsp;
    </div>
    <div>
     Please let me know if you have any concerns or thoughts about this!
    </div>
    <div>
     &nbsp;
    </div>
    <div>
     Kind regards,
    </div>
    <div>
     &nbsp;
    </div>
    <div>
     Jakub
    </div>
    <div>
     &nbsp;
    </div>
    <div>
     &nbsp;
    </div>
   </div>
  </blockquote>
  <div>
   &nbsp;
  </div>
  <div class=3D"default-style">
   According to the license (see <a href=3D"https://github.com/php/php-src=
/blob/master/LICENSE">https://github.com/php/php-src/blob/master/LICENSE</=
a>):
  </div>
  <div class=3D"default-style">
   IN NO EVENT SHALL THE PHP
   <br>
   DEVELOPMENT TEAM OR ITS CONTRIBUTORS BE LIABLE
  </div>
  <div class=3D"default-style">
   &nbsp;
  </div>
  <div class=3D"default-style">
   From my understanding there is no liability for the project if people c=
ontribute that are not allowed to contribute, or contribute code without p=
roper IP rights.
  </div>
  <div class=3D"default-style">
   If there are valid complains from any third party, the project can remo=
ve the code that is questioned.
  </div>
  <div class=3D"default-style">
   &nbsp;
  </div>
  <div class=3D"default-style">
   Regards
  </div>
  <div class=3D"default-style">
   Thomas
  </div>
 </body>
</html>