Explicitly E-mail signers and repository maintainers when a CLA is signed

[ahicks92]

Hi,
I've been evaluating various CLA handling options for my project. This comes closest to what I need, but shares the same problem with all the others thus far. Specifically, lack of a good paper trail.

It is my understanding that it is important that I be able to reproduce the paper trail no matter what. Would it be possible to get CLA Assistant explicitly e-mailing both parties? I consider GitHub comments to be less than ideal because they aren't part of the repository. I can't take them with me if I ever migrate from GitHub, and I can't be sure that the other party at least got an e-mail (because they may not be subscribed to comments).

If e-mail is impossible, we need to at least post dedicated comments for every person who signs the CLA. While this is spammy, it does at least make sure that they receive a receipt of it as long as they're subscribed to the thread.

[thojansen]

Right now I would really like to avoid to send mails. We would need to hook CLA assistant to another third party provider (for sending mails) and likely also need to update our legal terms etc. And I also would not like to send a contributor a mail and disregarding the GitHub notifications settings.

@KharitonOff @JNKielmann what do you think about splitting the comments up into separate actions and not updating it as we do it right now?

[KharitonOff]

I don't think that splitting the comments would solve the raised issue. This would produce more spam for those who is subscribed for GitHub notifications and still not achieve those, who's not subscribed.
But I would like to avoid sending mails either.
I think in sense of a "paper trail" we have a download feature for the repository owner and maybe we can put more focus on the issue #35 for signers

[thojansen]

I think the paper trail part is important for the project admin and not the contributor. If you are intersted in the complete chain of events, you can subscribe and get emails. We cannot and should not force this behaviour. Right now I think we could only offer split comments optionally and even that might not solve everything.

[ahicks92]

Yes. But. Suppose it does reach some sort of legal action. The contributor may not care about the e-mail, but now there is no proof that the project admin didn't fake the records. The contributor's e-mail doesn't show it, so this is a reasonable stance to take. Given that this doesn't actually increase the burden on contributors very much and does in fact make the paper trail stronger, I'm not seeing the negative.

I am not a lawyer. If there is a good reason I shouldn't be concerned about this legally, then I'll go away. But everything I've ever signed both in person and via the web has given me a copy for my records, one way or another.

[thojansen]

After giving this some thoughts, we think the best way is to introduce an audit logging as described in #138, similar to how other applications approach this problem.