Move from CLA based contributions to DCO

[knolleary]

I would like to propose we move from our current CLA based contribution process over to DCO.

We use a CLA for historic reasons; that was the mechanism we were required to have at the very start of the project when we first open-sourced. We kept the CLA in place when we moved to the JS Foundation - and likewise the OpenJS Foundation.

However, in that time, DCOs have become a more generally preferred means of accepting contributions.

CLAs can be lengthy legal documents and are an impediment to developers contributing. Individuals may be wary over the legal terms - corporations will certainly be wary and require additional approvals before any CLA is signed.

The DCO is a much more straightforward way for individual developers to contribute. Rather than sign a legal form, they are required to 'sign' their commits that signify the contribution has been made under the terms of the DCO and that they have the rights to do so.

For more reasoning for shifting to DCO, these two blog posts from other OSS projects are worth a read:

• Helm
• GitLab

With the DCO process, developers will be providing code to the project under the Apache 2.0 license. Crucially they do not transfer ownership of the code to the project.

One effect of this is that the project cannot change the license of the overall project without the consent of all contributors under DCO. Whilst this may feel like an impediment, the reality is this helps to provide the broader community an ongoing commitment to the project under the Apache 2.0 license.

If we go ahead with this change, there are a number of mechanics to be figured out.

1. The CLA bot will need replacing with a DCO checker - the OpenJS Foundation has the tooling available for this.
2. All existing open PRs under CLA will remain under CLA - we won't ask for them to be redone under DCO
3. From a well defined point in time, we'll only accept new commits that have been signed off. In practical terms, that means all commits must be made using the -s command-line argument:

   git commit -s -m 'An example commit message'
   

DCOs are so common I'm sure all git UI tools must provide a way to set the -s flag on commits... (we should add an option for that to the Node-RED Projects feature....)
4. We need to clarify the license of the website. Apache 2 isn't really suitable for documentation/websites - would be more appropriate to use a suitable Creative Commons license. We should make that explicit and change before moving it (or the cookbook site) over to DCO.

[dceejay]

for those contributors who do work for companies that have had to go through the CLA process - presumably they will need to re-check with their company that DCO is now OK and re-do whatever internal process that is in order to continue contributing ?

[knolleary]

They will do, but the bar is far lower for the DCO.

For the CLA, they need:

• approval to contribute code
• approval to assign ownership of the code to the project

For the DCO, they need:

• approval to contribute code

As DCO is becoming a far more preferred means of contribution, if a company has already gone to the lengths to approve signing the CLA, then shifting to DCO should be a simple task.

@HiroyasuNishiyama - I would appreciate your input on this.

[HiroyasuNishiyama]

Hi. As for our company, difference between the CLA and the DCO do not matter. But, if the contract changes, we will require an internal redeliberation process.
It will take some time, so I think that the transition can be smoothed if either the old agreement is continued as it is or the old and new overlap periods are provided.