Re: Why are so many great packages not trying to get included in GNU Emacs?

[Eli Zaretskii]

> Date: Thu, 07 May 2020 14:17:07 -0400
> From: Luke Shumaker <address@hidden>
> Cc: address@hidden
> 
> > How could that be possible?  How would we know who wrote those
> > changes?  We can't assume it is the person whose account checked them
> > in.  Often that is so, but not always.
> 
> Git tracks separate "committer" and "author" information (both of
> which are name/email/timestamp).  Unfortunately, it only allows
> exactly one author; limiting the case where a change has 2
> collaborators.
> 
> > There may be other issues, such as, if the name on that account is
> > John Doe, does that mean the user of that account is the same John Doe
> > that signed an assignment?
> 
> Git tracks both name and email.  Surely assuming address@hidden is
> the same address@hidden that signed the assignment is a safer
> assumption?
> 
> Of course, that can be intentionally spoofed.  I'm not sure whether
> the concern is about accidentally mixing up two people, or about
> someone maliciously misrepresenting the authorship.  If the concern is
> malicious misrepresentation, then this could be solved with
> GPG-signing of either the emails with the patches, or the Git commits
> (which is something that Git supports).

It doesn't have to be malicious.  Mistakes happen much more
frequently.  I caught myself several times forgetting to say --author
when committing (fortunately before pushing, so I could fix that in
time).  Or the committer may not be aware how important it is to state
the author accurately, because many people are unaware of the legal
implications.  Or the code could be by more than one author.  Or the
author could have more than one email address, and use them
interchangeably, unaware of the identification problem this creates.
Or any number of other similar issues, which are minor for most of us,
but can be crucial if the code will need to be defended in court.