Provide a feedback in pull requests if code signature is missing

[marmarek]

Ease enforcing a policy of requiring all the contributions to be signed.
This should be automatically mark not signed pull request as failed (but do not close them automatically, as the author may push missing tag later, or even force-push signed commits).

[jpouellet]

What is the story with this policy: https://www.qubes-os.org/doc/license/#note-on-rights-to-double-licensing-of-the-qubes-code ? (requiring signed-off-by, or in some way formally delegating a superset of GPL rights).

It is clearly not enforced in practice, and AFAICT it does not appear to ever have been, but it may become more relevant in light of Qubes' commercialization plans. Perhaps some sort of CLA should be formalized?

Personally I don't care what ITL (or whoever) does with my contributions, I usually release all my things under a BSD license anyway. I'm certainly deriving more benefit from your work than you are from mine regardless :)

[jpouellet]

What is the story with this policy: https://www.qubes-os.org/doc/license/#note-on-rights-to-double-licensing-of-the-qubes-code ? (requiring signed-off-by, or in some way formally delegating a superset of GPL rights).

It is clearly not enforced in practice, and AFAICT it does not appear to ever have been, but it may become more relevant in light of Qubes' commercialization plans. Perhaps some sort of CLA should be formalized?

Personally I don't care what ITL (or whoever) does with my contributions, I usually release all my things under a BSD license anyway. I'm certainly deriving more benefit from your work than you are from mine regardless :)

[marmarek]

It is clearly not enforced in practice, and AFAICT it does not appear to ever have been, but it may become more relevant in light of Qubes' [commercialization plans](https://www.qubes-os.org/news/2016/11/30/qubes-commercialization/). Perhaps some sort of CLA should be formalized?

Yeah, we've never enforced it. And in fact we'll drop it. We're planning to change license of qubes-core-admin for Qubes to LGPL instead (so extensions importing qubes python modules will not be forced to be GPL).

…

-- Best Regards, Marek Marczykowski-Górecki Invisible Things Lab A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

[marmarek]

It is clearly not enforced in practice, and AFAICT it does not appear to ever have been, but it may become more relevant in light of Qubes' [commercialization plans](https://www.qubes-os.org/news/2016/11/30/qubes-commercialization/). Perhaps some sort of CLA should be formalized?

Yeah, we've never enforced it. And in fact we'll drop it. We're planning to change license of qubes-core-admin for Qubes to LGPL instead (so extensions importing qubes python modules will not be forced to be GPL).

…

-- Best Regards, Marek Marczykowski-Górecki Invisible Things Lab A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

[marmarek]

@jpouellet could you upload your key to a keyserver? The script currently reject your signatures because of this. QubesOS/qubes-manager#17

[marmarek]

@jpouellet could you upload your key to a keyserver? The script currently reject your signatures because of this. QubesOS/qubes-manager#17

[jpouellet]

@jpouellet could you upload your key to a keyserver?

Done, although I'd been meaning to replace it with a longer-term higher-security key first.

The script currently reject your signatures because of this.

To which script are you referring? qubes-builder/scripts/verify-git-tag? I do not see anywhere it imports from keyservers automatically...

FWIW, my key was previously here: QubesOS/qubes-installer-qubes-os#8 (comment) (one of my first PRs to Qubes) and I intended have already replaced it by now.

[jpouellet]

@jpouellet could you upload your key to a keyserver?

Done, although I'd been meaning to replace it with a longer-term higher-security key first.

The script currently reject your signatures because of this.

To which script are you referring? qubes-builder/scripts/verify-git-tag? I do not see anywhere it imports from keyservers automatically...

FWIW, my key was previously here: QubesOS/qubes-installer-qubes-os#8 (comment) (one of my first PRs to Qubes) and I intended have already replaced it by now.

[marmarek]

To which script are you referring? qubes-builder/scripts/verify-git-tag? I do not see anywhere it imports from keyservers automatically...

No, the one in commit closing this issue.

[marmarek]

To which script are you referring? qubes-builder/scripts/verify-git-tag? I do not see anywhere it imports from keyservers automatically...

No, the one in commit closing this issue.