Re: Why are so many great packages not trying to get included in GNU Emacs?

[Clément Pit-Claudel]

On 11/05/2020 14.57, Eli Zaretskii wrote:>> From: Clément Pit-Claudel 
<address@hidden> Date: Mon, 11 May
>> 2020 14:51:26 -0400 Cc: address@hidden, address@hidden,
>> address@hidden, address@hidden,
>> address@hidden
>> 
>> On 06/05/2020 22.43, Richard Stallman wrote:
>>> It is not terrible lot of work for people to deal with those
>>> issues, but I wouldn't assume a simple program can.
>> 
>> These days assignments are signed with PGP keys.  Commits can also
>> be signed using PGP keys.  Wouldn't that provide an reliable way to
>> pair up contributors who have assigned copyright with their
>> contributions?
> 
> I think you are missing the main point.  The problem is not
> security, it is correct attribution.

Sorry, it seems my email was unclear.  The proposal doesn't have to do with 
security.  I'm trying to find a robust way to figure out if someone has 
copyright papers.  Right now Stefan & you can check the list, and the rest of 
us can't, which is a problem for package maintainers.  Apparently the list 
can't be made public, so I'm suggesting to make public a list of public keys 
public instead.  I was not thinking about security.

> The author of the committed changeset (not the person who does the
> commit, the author) must be the person who actually wrote the code,
> not someone else. If that someone else is a real benevolent person, it is 
> still a
> problem, because we will make a false presentation that a different
> person made the change.

That problem exists regardless of how we check whether someone has copyright 
papers, right?
What I'm trying to find is a way to check whether I can accept a patch into an 
ELPA package without having to email an Emacs maintainer every time.

Clément.