Proposal to remove OSPS-LE-01.01

[hyandell]

Removal Suggestion

OSPS-LE-01.01: While active, the version control system MUST require all code contributors to assert that they are legally authorized to make the associated contributions on every commit.

This is going to be true for nearly every project. For example, any contribution on GitHub requires this per https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#6-contributions-under-repository-license and I expect other platforms to have similar language. I would stay out of this as I don't think contribution litigation is of sufficient (if any) volume to represent an availability threat to projects.

[funnelfiasco]

This is going to be true for nearly every project. For example, any contribution on GitHub requires this per https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#6-contributions-under-repository-license and I expect other platforms to have similar language. I would stay out of this as I don't think contribution litigation is of sufficient (if any) volume to represent an availability threat to projects.

No, it is not. It's not about the license of the contribution, it's about the assertion that the contributor is able to make it. The recommendation for that control says:

Include a DCO or CLA in the project's repository, requiring code contributors to assert that they are legally authorized to commit the associated contributions on every commit. Use a status check to ensure the assertion is made.

GitHub does not require a DCO, but there are ways for projects to optionally enforce that.

[hyandell]

GitHub's Terms & Conditions state "and you agree that you have the right to license that Content under those terms". They're all implicitly IN/OUT akin to DCO.

Though as I dig for it, GitLab's licensing is not as easy to navigate and I've not yet found clear terms relating to a user's submission to their website.

---

Digging into this control. There's a wide range of possibilities here and the a wide range of opinions. General practices are (many times more than one at once - "belt and suspenders"):

1. You are covered by GitHub's T&C
2. You are covered by Apache's clause 5
3. You are covered by the copyleft nature of your project's license
4. You have an explicit statement in your PR text
5. You have instructed contributors to add -s to their git commits (i.e. DCO)
6. You have required the individual contributing to sign an ICLA with you
7. You have required the individual's employer to sign a CCLA with you
8. You have required the individual's employer to sign a CCLA with you AND you have confirmed the employee is listed on the CCLA

Where many of the above may be automatically checked to ensure they have happened.

I think the real control here is: "If legal counsel requires an explicit acknowledgement of legal right to contribute, use a status check to ensure the assertion is made".