[Discourse.ros.org] [Next Generation ROS] Starting to enforce Developer Certificate of Origin (DCO) for (some) ROS 2 repos

classic Classic list List threaded Threaded
7 messages Options
Reply | Threaded
Open this post in threaded view
|

[Discourse.ros.org] [Next Generation ROS] Starting to enforce Developer Certificate of Origin (DCO) for (some) ROS 2 repos

Risto Kojcev via Discourse.ros.org via ros-users


With the Crystal release being out of the door we will follow up on the previously mentioned goal to enforcement a [Developer Certificate of Origin (DCO)](https://developercertificate.org/) on contributions to core ROS 2 repositories [[1](https://discourse.ros.org/t/introducing-the-ros-2-technical-steering-committee/6132)]. We will use the following GitHub App to automate the check: https://github.com/probot/dco

After having done some testing with dummy repositories we will enable this for actually used repositories. We will start with a few (from two different orgs, repos with frequent contributions) and will add more repositories over time if we are confident that the process works well:

* [ament/ament_lint](https://github.com/ament/ament_lint/)
* [ros2/rcl](https://github.com/ros2/rcl)
* [ros2/rclcpp](https://github.com/ros2/rclcpp)
* [ros2/ros2cli](https://github.com/ros2/ros2cli)

In the beginning we won't require passing the DCO check in order to give us the freedom to merge already existing and reviewed PRs. But in the near future it will be mandatory so please consider reading about how to sign your commits of future contributions: https://help.github.com/articles/signing-commits/

Thanks,
Dirk





---
[Visit Topic](https://discourse.ros.org/t/starting-to-enforce-developer-certificate-of-origin-dco-for-some-ros-2-repos/7420/1) or reply to this email to respond.


If you do not want to receive messages from ros-users please use the unsubscribe link below. If you use the one above, you will stop all of ros-users from receiving updates.
______________________________________________________________________________
ros-users mailing list
[hidden email]
http://lists.ros.org/mailman/listinfo/ros-users
Unsubscribe: <http://lists.ros.org/mailman//options/ros-users>
Reply | Threaded
Open this post in threaded view
|

[Discourse.ros.org] [Next Generation ROS] Starting to enforce Developer Certificate of Origin (DCO) for (some) ROS 2 repos

Risto Kojcev via Discourse.ros.org via ros-users




[quote="dirk-thomas, post:1, topic:7420"]

With the Crystal release being out of the door we will follow up on the previously mentioned goal to enforcement a [Developer Certificate of Origin (DCO) ](https://developercertificate.org/) on contributions to core ROS 2 repositories [[1 ](https://discourse.ros.org/t/introducing-the-ros-2-technical-steering-committee/6132)].

[/quote]



In the linked post @gerkey doesn't give a rationale, it contains merely a statement of intent:



>  Were also working on updates to developer policies, such as enforcement of a [Developer Certificate of Origin (DCO) ](https://developercertificate.org/) on contributions to core ROS 2 repositories.



In https://discourse.ros.org/t/ros-2-tsc-meeting-minutes-july-24th-2018/6156 it's also only stated that DCO will be required. https://discourse.ros.org/t/ros-2-tsc-meeting-minutes-september-6th-2018/6157 states "Explain rationale, say that well take comments now and at ROSCon".



It's probably obvious, but could you perhaps provide some insight into the reasoning behind this decision?



I've probably missed it, so if there was any discussion at ROSCon about enforcing DCOs, my apologies.











---

[Visit Topic](https://discourse.ros.org/t/starting-to-enforce-developer-certificate-of-origin-dco-for-some-ros-2-repos/7420/2) or reply to this email to respond.







If you do not want to receive messages from ros-users please use the unsubscribe link below. If you use the one above, you will stop all of ros-users from receiving updates.
______________________________________________________________________________
ros-users mailing list
[hidden email]
http://lists.ros.org/mailman/listinfo/ros-users
Unsubscribe: <http://lists.ros.org/mailman//options/ros-users>
Reply | Threaded
Open this post in threaded view
|

[Discourse.ros.org] [Next Generation ROS] Starting to enforce Developer Certificate of Origin (DCO) for (some) ROS 2 repos

Risto Kojcev via Discourse.ros.org via ros-users


In short: (i) we decided to enforce a contribution mechanism because of strong support for doing so among industry partners generally over several years and among the ROS 2 TSC membership more specifically and recently; and (ii) we chose the DCO because it's become a commonly accepted practice for open source projects. As compared to other mechanisms (e.g., a CLA), the DCO is the lightest-weight tool that appears to convince a large fraction of the likely corporate stakeholders (and more importantly, their respective lawyers) that it's OK to use the output from and contribute to a project.

The goal here is to do the right thing with respect to preventing inappropriate contributions while having a minimal impact on the development workflow. FWIW we almost enabled a CLA for ROS 2 a few years back, but the tools weren't sufficient at the time to avoid having a bunch of manual steps; e.g., requiring people with commit rights to be checking github usernames against a spreadsheet before merging their PRs (we tried [CLAHub](https://www.clahub.com/), but it wasn't quite ready yet).





---
[Visit Topic](https://discourse.ros.org/t/starting-to-enforce-developer-certificate-of-origin-dco-for-some-ros-2-repos/7420/3) or reply to this email to respond.


If you do not want to receive messages from ros-users please use the unsubscribe link below. If you use the one above, you will stop all of ros-users from receiving updates.
______________________________________________________________________________
ros-users mailing list
[hidden email]
http://lists.ros.org/mailman/listinfo/ros-users
Unsubscribe: <http://lists.ros.org/mailman//options/ros-users>
Reply | Threaded
Open this post in threaded view
|

[Discourse.ros.org] [Next Generation ROS] Starting to enforce Developer Certificate of Origin (DCO) for (some) ROS 2 repos

Risto Kojcev via Discourse.ros.org via ros-users
In reply to this post by Risto Kojcev via Discourse.ros.org via ros-users


Are there any plans to move to a CLA in the future? It would give the ROS TSC more freedom over the code than the DCO appears to, although I imagine that would be negatively perceived by some people.





---
[Visit Topic](https://discourse.ros.org/t/starting-to-enforce-developer-certificate-of-origin-dco-for-some-ros-2-repos/7420/4) or reply to this email to respond.


If you do not want to receive messages from ros-users please use the unsubscribe link below. If you use the one above, you will stop all of ros-users from receiving updates.
______________________________________________________________________________
ros-users mailing list
[hidden email]
http://lists.ros.org/mailman/listinfo/ros-users
Unsubscribe: <http://lists.ros.org/mailman//options/ros-users>
Reply | Threaded
Open this post in threaded view
|

[Discourse.ros.org] [Next Generation ROS] Starting to enforce Developer Certificate of Origin (DCO) for (some) ROS 2 repos

Risto Kojcev via Discourse.ros.org via ros-users


[quote="gbiggs, post:4, topic:7420"]
Are there any plans to move to a CLA in the future?
[/quote]

No, not at the moment.





---
[Visit Topic](https://discourse.ros.org/t/starting-to-enforce-developer-certificate-of-origin-dco-for-some-ros-2-repos/7420/5) or reply to this email to respond.


If you do not want to receive messages from ros-users please use the unsubscribe link below. If you use the one above, you will stop all of ros-users from receiving updates.
______________________________________________________________________________
ros-users mailing list
[hidden email]
http://lists.ros.org/mailman/listinfo/ros-users
Unsubscribe: <http://lists.ros.org/mailman//options/ros-users>
Reply | Threaded
Open this post in threaded view
|

[Discourse.ros.org] [Next Generation ROS] Starting to enforce Developer Certificate of Origin (DCO) for (some) ROS 2 repos

Risto Kojcev via Discourse.ros.org via ros-users
In reply to this post by Risto Kojcev via Discourse.ros.org via ros-users




Im not disagreeing with that decision, but Im interested in knowing the basis for that envision. Brians explanation seems mainly to pertain to the state of things a few years ago and starting simple.











---

[Visit Topic](https://discourse.ros.org/t/starting-to-enforce-developer-certificate-of-origin-dco-for-some-ros-2-repos/7420/6) or reply to this email to respond.







If you do not want to receive messages from ros-users please use the unsubscribe link below. If you use the one above, you will stop all of ros-users from receiving updates.
______________________________________________________________________________
ros-users mailing list
[hidden email]
http://lists.ros.org/mailman/listinfo/ros-users
Unsubscribe: <http://lists.ros.org/mailman//options/ros-users>
Reply | Threaded
Open this post in threaded view
|

[Discourse.ros.org] [Next Generation ROS] Starting to enforce Developer Certificate of Origin (DCO) for (some) ROS 2 repos

Risto Kojcev via Discourse.ros.org via ros-users
In reply to this post by Risto Kojcev via Discourse.ros.org via ros-users


In the mean time we have enabled the DCO check to a number of repositories (see https://github.com/ros2/ros2cli/pull/210#issuecomment-474900128 for the complete list) and added a note about the DCO to the `CONTRIBUTING.md` file to each of these repositories.

Happy signing off :heavy_check_mark:





---
[Visit Topic](https://discourse.ros.org/t/starting-to-enforce-developer-certificate-of-origin-dco-for-some-ros-2-repos/7420/7) or reply to this email to respond.


If you do not want to receive messages from ros-users please use the unsubscribe link below. If you use the one above, you will stop all of ros-users from receiving updates.
______________________________________________________________________________
ros-users mailing list
[hidden email]
http://lists.ros.org/mailman/listinfo/ros-users
Unsubscribe: <http://lists.ros.org/mailman//options/ros-users>