logo

drewdevault.com

[mirror] blog and personal website of Drew DeVault git clone https://hacktivis.me/git/mirror/drewdevault.com.git

DCO.md (4954B)

    

  1. ---
  2. title: The Developer Certificate of Origin is a great alternative to a CLA
  3. date: 2021-04-12
  4. ---
  6. Today Amazon released their fork of ElasticSearch, [OpenSearch][0], and I want
  7. to take a moment to draw your attention to one good decision in particular: its
  8. use of the [Developer Certificate of Origin][1] (or "DCO").
  10. [0]: https://github.com/opensearch-project/OpenSearch
  11. [1]: https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#developer-certificate-of-origin
  13. ---
  15. Previously:
  17. - [ElasticSearch does not belong to Elastic](https://drewdevault.com/2021/01/19/Elasticsearch-does-not-belong-to-Elastic.html)
  18. - [Open source means surrendering your monopoly over commercial exploitation](https://drewdevault.com/2021/01/20/FOSS-is-to-surrender-your-monopoly.html)
  19. - [Don't sign a CLA](https://drewdevault.com/2018/10/05/Dont-sign-a-CLA.html)
  21. ---
  23. Elastic betrayed its community when they changed to a proprietary license.  We
  24. could have seen it coming because of a particular trait of their contribution
  25. process: the use of a Contributor License Agreement, or CLA. In principle, a CLA
  26. aims to address legitimate concerns of ownership and copyright, but in practice,
  27. they are a promise that one day the stewards of the codebase will take your work
  28. and relicense it under a nonfree license. And, ultimately, this is exactly what
  29. Elastic did, and exactly what most other projects which ask you to sign a CLA
  30. are *planning* to do. If you ask me, that's a crappy deal, and I refrain from
  31. contributing to those projects as a result.
  33. However, there are some legitimate questions of ownership which a project owner
  34. might rightfully wish to address before accepting a contribution. As is often
  35. the case, we can look to git itself for an answer to this problem. Git was
  36. designed for the Linux kernel, and patch ownership is a problem they faced and
  37. solved a long time ago. Their answer is the [Developer Certificate of
  38. Origin](https://developercertificate.org/), or DCO, and tools for working with
  39. it are already built into git.
  41. git provides the -s flag for git commit, which adds the following text to your
  42. commit message:
  44. ```
  45. Signed-off-by: Drew DeVault <sir@cmpwn.com>
  46. ```
  48. The specific meaning varies from project to project, but it is usually used to
  49. indicate that you have read and agreed to the DCO, which reads as follows:
  51. > By making a contribution to this project, I certify that:
  52. > 
  53. > 1. The contribution was created in whole or in part by me and I have the right
  54. >    to submit it under the open source license indicated in the file; or
  55. > 2. The contribution is based upon previous work that, to the best of my
  56. >    knowledge, is covered under an appropriate open source license and I have
  57. >    the right under that license to submit that work with modifications,
  58. >    whether created in whole or in part by me, under the same open source
  59. >    license (unless I am permitted to submit under a different license), as
  60. >    indicated in the file; or
  61. > 3. The contribution was provided directly to me by some other person who
  62. >    certified (1), (2) or (3) and I have not modified it.
  63. > 4. I understand and agree that this project and the contribution are public
  64. >    and that a record of the contribution (including all personal information I
  65. >    submit with it, including my sign-off) is maintained indefinitely and may
  66. >    be redistributed consistent with this project or the open source license(s)
  67. >    involved.
  69. This neatly answers all concerns of copyright. You license your contribution
  70. under the original license (Apache 2.0 in the case of OpenSearch), and attest
  71. that you have sufficient ownership over your changes to do so. You retain your
  72. copyright and you don't leave the door open for the maintainers to relicense
  73. your work under some other terms in the future. This offers the maintainers the
  74. same rights that they extended to the community themselves.
  76. This is the strategy that Amazon chose for OpenSearch, and it's a good thing
  77. they did, because it strongly signals to the community that it will not fall to
  78. the same fate that ElasticSearch has. By doing this, they have imposed on
  79. themselves a great deal of difficulty to any future attempt to change their
  80. copyright obligations. I applaud Amazon for this move, and I'm optimistic about
  81. the future of OpenSearch under their stewardship.
  83. If you have a project of your own that is concerned about the copyright of
  84. third-party contributions, then please consider adopting the DCO instead of a
  85. CLA. And, as a contributor, if someone asks you to sign a CLA, consider
  86. withholding your contribution: a CLA is a promise to the contributors that
  87. someday their work will be taken from them and monetized to the exclusive
  88. benefit of the project's lords. This affects my personal contributions, too
  89. &mdash; for example, I avoid contributing to Golang as a result of their CLA
  90. requirement. Your work is important, and the projects you offer it to should
  91. respect that.