RTEMS | Adopt a Developer Certificate of Origin and an AI disclosure tag (#5657)

[Sebastian Huber (@sebhub)]

Sebastian Huber commented on a discussion: https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5657#note_156373


Why don't we make one step at a time? This looks like we don't want to take the first step, because we can't make the second step right now. With an explicit DCO.txt and the `Signed-off-by:` tag, the project gives contributors a clear message what is expected. The honest contributor will follow this contract. Your objection targets the evil contributor. Yes, a piece of text doesn't stop anyone doing harm.

What do you mean with "tighter reins on security" and "We can't verify who anyone is.". Does this imply that someone associated with the RTEMS Project should be able to authenticate the legal identity of contributors (natural persons) in the future?

For AI contributions, the template requires:

```
## AI Details
<!-- Make sure you have read our statement at https://www.rtems.org/generative-ai/ -->
[...]
### Access
<!-- Please state that you have not used a product that claims copyright and you have legitimate access. -->
```

Here, basically the DCO is already required, but it sits outside the repository. This is structurally an issue, since the contract state at the contribution commit time is unknown if you only have the repository.

-- 
View it on GitLab: https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5657#note_156373
You're receiving this email because of your account on gitlab.rtems.org. Unsubscribe from this thread: https://gitlab.rtems.org/-/sent_notifications/4-4q1dc9nrrvd8m3dm6rmfykkaf-1d/unsubscribe | Manage all notifications: https://gitlab.rtems.org/-/profile/notifications | Help: https://gitlab.rtems.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rtems.org/pipermail/bugs/attachments/20260803/94b186b4/attachment.htm>