sdbusplus commits missing CLA

[Andrew Jeffery]

On Sat, 22 Feb 2020, at 06:40, krtaylor wrote:
> On 2/20/20 2:35 PM, Patrick Williams wrote:
> > Kurt,
> 
> (Not a lawyer)
> 
> > We have a few commits for the openbmc/sdbusplus repository that have
> > been floating around in Gerrit since early 2018 and seem to be stuck in
> > "missing CLA limbo".  It appears that there was some discussion on the
> > CLA at one point but I don't know what happened to it.  I don't see a
> > CLA from the Bosch company in the Google Doc folder.
> 
> I have not received a CLA from Bosch, or an ICLA from the developer(s) 
> referenced.
> 
> > https://gerrit.openbmc-project.xyz/q/owner:mark.jonas%2540de.bosch.com
> > 
> > There was recently a request to revive this work because someone else is
> > finding it useful (and we've had a feature request open for a long time
> > on one of them as well).  What options do we, the maintainers, have in
> > this situation?
> 
> We cannot accept/merge the code until resolved. If they cannot complete 
> a ICLA/CCLA for this submission, it should be abandoned.

So "contributors" can DoS the project by authoring patches and not signing
a CLA?

What happens if someone forks the repo in question and applies the
unaccepted patch, and we end up changing the bitbake recipe to point at the
fork? And if that's bad, how is that different to consuming projects that don't
have a CLA (e.g. Linux, u-boot, qemu etc)?

I feel like this needs a bit more thought...

Andrew