From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.ciao.gmane.io!not-for-mail From: =?UTF-8?Q?Cl=c3=a9ment_Pit-Claudel?= Newsgroups: gmane.emacs.devel Subject: Re: Why are so many great packages not trying to get included in GNU Emacs? Date: Tue, 12 May 2020 23:03:06 -0400 Message-ID: <960f9bf2-7931-1984-cb2f-ae32fe338928@gmail.com> References: <838shy9srs.fsf@gnu.org> <7f820b59-ebbc-18c7-9f08-104a7ba88dd2@gmail.com> <834kslao2y.fsf@gnu.org> <052569f9-0571-6471-7a27-f3d7b36497a0@gmail.com> <83sgg58ari.fsf@gnu.org> <837dxh847w.fsf@gnu.org> <834ksl833q.fsf@gnu.org> <20200512201727.GA50065@breton.holly.idiocy.org> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------C76A0FD7C3C329197FEFD2FF" Injection-Info: ciao.gmane.io; posting-host="ciao.gmane.io:159.69.161.202"; logging-data="130402"; mail-complaints-to="usenet@ciao.gmane.io" User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 To: Alan Third , Eli Zaretskii , casouri@gmail.com, rms@gnu.org, eric@ericabrahamsen.net, emacs-devel@gnu.org, monnier@iro.umontreal.ca, ndame@protonmail.com, phillip.lord@russet.org.uk Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Wed May 13 05:03:45 2020 Return-path: Envelope-to: ged-emacs-devel@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jYhgO-000Xp0-7o for ged-emacs-devel@m.gmane-mx.org; Wed, 13 May 2020 05:03:44 +0200 Original-Received: from localhost ([::1]:49720 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jYhgN-0000B9-9y for ged-emacs-devel@m.gmane-mx.org; Tue, 12 May 2020 23:03:43 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:52620) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jYhfr-00080t-Bq for emacs-devel@gnu.org; Tue, 12 May 2020 23:03:11 -0400 Original-Received: from mail-qk1-x741.google.com ([2607:f8b0:4864:20::741]:39472) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jYhfq-00043z-AJ; Tue, 12 May 2020 23:03:10 -0400 Original-Received: by mail-qk1-x741.google.com with SMTP id a136so7021108qkg.6; Tue, 12 May 2020 20:03:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language; bh=VdEoQbo1vpbEjNHeWgR7l9VxZbdsd2XmY7TVTJUmp+o=; b=gDBAgemAYCH+vTN0LWgKDR6jov6vFYrPB4XGghjRWurTWTiC9WF6uwIMZkU+E194Gw Vlczj4cJzJ72/vhoGfVbKb/o/ihxk47Mf+l/vX/Fyiyl4OF0yFF66z3W72vRmTOD+rwi px5AyXNkD/D4AKlstyxzsmCAU5jpYy/Dx4mAbl1qommpfVFpHimlwyykY8bJBQVlIU+n +xWB7GtBxYN+U0xb8B/6D5El7O7jrnLmTkaWMtafLE+r/mIhdudIJJL3Zrt8zIAW+cmS /8J1w4URmWEsSomGS0TgIMOohnRU+TMrvVObtyaQtKLQ6mU/O8WpuxQJ6LYOQ64kNKM9 T2NQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language; bh=VdEoQbo1vpbEjNHeWgR7l9VxZbdsd2XmY7TVTJUmp+o=; b=RwSJ5OfM2bzpVne/IgRtaHciAJoUDPdVzUGJ56Hai7uCZGBB9nEM518aVG8gODYMPE eq0XMlIXuZcGvswab19rTNlnblRyaoH3wXnD8EgGQ67EfljdjoQ83EJPX4ToCP+1i8e3 UEwBe4AcwtHZRUhMgJjipxCM9L/aT/CL2e9qH9Ap7b6QiwpFa8CteWPxKJFAKlhRtlRh gcNv66nX4GdbTaC4zt91EWQ1B2Zn7+qoT2GbgDQlifKX7CEk+kRY51euVozyIXT2SHP1 TiYRzL8wtFg0kMlg3jIWJRDOPJCdtaUyz36pGWQkxclFXAIenCsXCh/9Dhms43HNkiB6 YksQ== X-Gm-Message-State: AGi0PuYiFG/YhQgP+DsdhIDLfY09De2HKdrxYZ814FFbqDaMVJK8XDZN 6QK2AyTgq7Vo73T/ASfNjMk= X-Google-Smtp-Source: APiQypK9rIkcI5ZZ+H7C6Ec5d8eJyzKApqRNvn7iHVKeg65/UYoG62lLmhio5Lv3bEsBAp8oLHBBTA== X-Received: by 2002:a37:ac13:: with SMTP id e19mr25454662qkm.415.1589338988626; Tue, 12 May 2020 20:03:08 -0700 (PDT) Original-Received: from ?IPv6:2601:184:4180:66e7:4d17:b25e:8d9:2188? ([2601:184:4180:66e7:4d17:b25e:8d9:2188]) by smtp.googlemail.com with ESMTPSA id o67sm12769201qkc.2.2020.05.12.20.03.06 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 12 May 2020 20:03:07 -0700 (PDT) In-Reply-To: <20200512201727.GA50065@breton.holly.idiocy.org> Content-Language: en-GB Received-SPF: pass client-ip=2607:f8b0:4864:20::741; envelope-from=cpitclaudel@gmail.com; helo=mail-qk1-x741.google.com X-detected-operating-system: by eggs.gnu.org: No matching host in p0f cache. That's all we know. X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, WEIRD_PORT=0.001 autolearn=_AUTOLEARN X-Spam_action: no action X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.io gmane.emacs.devel:250072 Archived-At: This is a multi-part message in MIME format. --------------C76A0FD7C3C329197FEFD2FF Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit On 12/05/2020 16.17, Alan Third wrote: > On Tue, May 12, 2020 at 03:48:01PM -0400, Clément Pit-Claudel wrote: >> Now the problem is reduced to "does the author with this PGP key >> have an assignment on file"? But this question can be answered in a >> decentralized way (no need for an API): the FSF can just sign keys >> instead. > > As if there aren’t enough people complaining about copyright > assignment, now you want to force everyone to use the horror that is > PGP/GPG? No no, not at all! Definitely not force and definitely not everyone. I'm trying to find a way to allow package maintainers to check copyright assignments when they accept patches, that's all. There are easy cases: for Emacs committers like you, the list is already public, so that's no trouble (and thus signatures wouldn't be needed). For others, the signature would be one reliable option to determine whether they have papers on file. But the complexity of PGP is a valid concern. I operated under the assumption that most new contributors sign copyright papers with PGP, and so that PGP was a reasonable baseline. Concretely, how do you handle these cases? What am I supposed to do, when I get a patch, to check if the patch author has an assignment on file? Surely I can't bother Eli every time. Is it enough to take the author's word for it that they have an assignment? Alan, do you have advice on handling these situations? As an alternative, the attached python script implements a REST API to do the checking. I don't have access to fencepost, so I don't know what format the file tracking assignments is — I made a guess about that part. (Of course, having an API makes it possible to determine whether a given email address has copyright papers on file, but it gives no guarantees against impersonation.) Cheers, Clément. --------------C76A0FD7C3C329197FEFD2FF Content-Type: text/x-python; charset=UTF-8; name="fencepost_api.py" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="fencepost_api.py" #!/usr/bin/env python3 from flask import Flask # Usage: pip3 install flask # echo "user@domain some more data" > /tmp/assignments # FLASK_APP=fencepost_api.py flask run # firefox http://127.0.0.1:5000/has_assignment/name@domain57.org app = Flask(__name__) ASSIGNMENTS_FILE = "/tmp/assignments" def get_copyright_list(): with open(ASSIGNMENTS_FILE) as assignments: for line in assignments: yield line.split()[0].lower() @app.route('/has_assignment/') def check_assignment(email_address): return "yes" if email_address.lower() in get_copyright_list() else "no" --------------C76A0FD7C3C329197FEFD2FF--