Re: [Ietf-and-github] Mail regarding draft-ietf-git-github-wg-configuration, section 3.1 (Contributions)

["Brad Biddle" <[e-mail]>]

All — an idea, offered for discussion: what about using the 
CLA-assistant tool to ensure that participants affirmatively acknowledge 
the current CONTRIBUTING.MD text (or a similar variation on the Note 
Well text)? I.e., the tool could present this text and require an 
express acknowledgement.

See:
https://github.com/cla-assistant/cla-assistant
https://cla-assistant.io/

Several groups I work with use this tool in connection with their GitHub 
repositories, and I gather it’s pretty seamless. From a legal 
perspective it would offer a stronger argument that participants have in 
fact agreed to the relevant IETF terms than the current model.

—Brad

Brad Biddle | [e-mail] | +1.503.502.1259 (mobile) | 
http://biddle.law

On 4 Mar 2019, at 18:57, Stephan Wenger wrote:

> Hi Martin,
> Thanks for your comments.  Please see inline.
> S.
>
> On 3/4/19, 18:42, "Ietf-and-github on behalf of Martin Thomson" 
> <[e-mail] on behalf of [e-mail]> 
> wrote:
>
>     Hi Stephan,
>
>     I encourage you to attempt to contribute to a draft repository on 
> GitHub.  The BCP79 notice is perhaps not as prominent as you might 
> like, but there is a fairly clear path to it.
>
>     In case you can't find an example, here's a link where you can 
> create an issue for the draft I just posted: 
> https://github.com/martinthomson/hx-uri/issues/new
>
>     I tend to think that is adequate.  If you disagree, we can discuss 
> the pros and cons of searching for something more robust.
>
> StW: Yes, this seems adequate.  However, I thought the subject draft 
> is guidance for WGs setting up their own GitHub projects.  Nowhere it 
> is mandated that they use the IETF "tree" or whatever that thing may 
> be called.  In theory, I could set up my own GitHub repository under 
> my own name, not using your excellent infrastructure, no Note Well, no 
> nothing, and invite the working group to contribute.  Then all kinds 
> of random people (including potentially malicious ones) could 
> theoretically make Contributions in the BCP79 sense arguably without 
> being bound by BCP79.  So I guess there should be a word of warning in 
> this draft--using the Martin Thomson-style infrastructure and the IETF 
> tree (or whatever that thing is called), or otherwise be very careful 
> to implement your own mechanisms to ensure that all Contributions are 
> made in accordance with BCP79 and the Note Well.
>
>     Section 3.1 of the draft we're discussing here (of the long name) 
> includes provisions designed to accomplish the goal you describe.  And 
> yes, the template code I maintain emplaces a default notice.  I 
> understand that reading the code is difficult (I'll be the first to 
> acknowledge how arcane this stuff is), but it is described in language 
> I hope you can understand here: 
> https://github.com/martinthomson/i-d-template/blob/master/doc/FEATURES.md#setup-a-repository
>
> StW: yes, this is good, and so is your whole infrastructure.  As 
> pointed out above, we are not mandating its use, though...
>
>     Regarding the trust notice or the content of the contributing 
> notice, that's not something I'd care to comment on.  You can see what 
> I have, which is - in part - something recommended by the IETF Trust 
> and IESG, and in part just text that I believe to be helpful: 
> https://github.com/martinthomson/i-d-template/blob/master/template/CONTRIBUTING.md
>
> StW: Your "Contributing" file is just fine with me.  Personally, I 
> consider the code component part of it a rather minor aspect for IETF 
> work, and I think if you look at litigation statistics of IETF related 
> subject matter, you would likely agree.  That's why I asked why that 
> aspect is prominently mentioned, while no particular attention is 
> drawn to BCP79 (which is where the music plays).  I'll wait a bit more 
> for others to comment.
>
>     Cheers,
>     Martin
>
>     On Tue, Mar 5, 2019, at 04:16, Stephan Wenger wrote:
>     >
>     > Hi,
>     >
>     >
>     > One concern I have when I see people, in an IETF context, work 
> on docs
>     > in toolchains other than IETF mailing lists and posting of I-Ds 
> on the
>     > IETF infrastructure is that I think we should ensure that BCP79 
> sticks.
>     > BCP79 is the IETF’s patent policy. A scenario to avoid is that 
> people
>     > insert patented technologies without being bound by the patent 
> policy.
>     > To avoid that, there ought to be a mechanism that a) 
> unambiguously
>     > makes it clear that any written contribution using GitHib tools
>     > constitute Contributions in the BCP79 sense, and b) ensures that 
> a user
>     > that makes a written contribution using GitHub tools would have 
> seen
>     > the Note Well at least once.
>     >
>     >
>     > I believe that most GitHub-using working groups in the IETF have
>     > assured that by including something like a click-through of the 
> Note
>     > Well when accessing the GitHub repository (writing to it in 
> whatever
>     > form). That, I think is sufficient, but perhaps should be 
> documented in
>     > this draft. I don’t know enough about the mechanics to propose 
> text
>     > myself. Lots of that may already be present in Martin’s 
> template, but
>     > that template is hard to read/understand for someone like me, 
> who’s not
>     > writing software or webpages.
>     >
>     >
>     > One thing I don’t understand is why the Trust outbound license 
> needs to
>     > be present in the repository, as suggested in section 3.1. 
> Especially
>     > for a WG that uses GitHub only for maintaining documents and not
>     > software. Can someone explain or point me to an explanation?
>     >
>     >
>     > Thanks,
>     >
>     > Stephan
>     >
>     >
>     >
>     >
>     >
>     >
>     > _______________________________________________
>     > Ietf-and-github mailing list
>     > [e-mail]
>     > https://www.ietf.org/mailman/listinfo/ietf-and-github
>     >
>
>     _______________________________________________
>     Ietf-and-github mailing list
>     [e-mail]
>     https://www.ietf.org/mailman/listinfo/ietf-and-github
>
>
> _______________________________________________
> Ietf-and-github mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ietf-and-github