It's on us as committers to ensure Apache policies on code contribution are followed. I think that is the bottom line. Our identities are known to Apache infrastructure and recorded in commit history. By committing we are asserting we believe the provenance of the contribution is known and conforms to Apache policy. If you have concerns then don't commit. Otherwise, it is the same as it always was. Both of Apache's JIRA instance and Github offer self service account signups without any sort of identity verification, only verification that the email account provided is valid and under the control of the contributor.
I think opening placeholder JIRAs as committers because we need it for tracking is fine. With my PMC hat on I'd like to wonder aloud what is the problem with signing up to Apache's JIRA instance. Any reason to be concerned? I take it you don't think so. I also take it you believe you know the identity of the contributor. Assuming you answer in the affirmative I don't see that we have any issues. > On Sep 2, 2018, at 9:00 AM, Sean Busbey <bus...@apache.org> wrote: > >> On Mon, Aug 20, 2018, 22:09 Stack <st...@duboce.net> wrote: >> >> This came up at the recent devs meeting: could we move to github flow >> committing to Apache HBase? Do folks want this? If so, what would it take? >> What would it look like? >> >> The new gitbox repos at apache allow contribution back into apache via >> github tooling: PRs can be merged into apache repos with a click of a >> button, github-based comments can show as comments in apache JIRA. The new >> hbase-operator-tools and hbase-connector repos are gitbox based. We can run >> experiments there with fear of damage to the core. >> >> The justification is that if our project supported PRs and contribution via >> github, we could glean more contributors. >> >> Below I repeat two follow-on comments taken from the "Rough notes from dev >> meetup, day after hbaseconasia 2018, saturday morning" thread by way of a >> kickstart: >> >> From our Josh Elser: >> >>> This [supporting PRs] is something the PMC should take to heart. If we >> are excluding >>> contributions because of how we choose accept them, we're limiting our >> own >>> growth. Do we have technical reasons (e.g. PreCommit) which we cannot >> accept >>> PR's or is it just because "we do patches because we do patches"? >>> >> >> By our Sean: >> >> "I don't want to bog down this thread, but there are a ton of >> unanswered questions for allowing github PRs. >> >> "The biggest one for me is that JIRA is currently our best hope for an >> authoritative place for authorship information. If we're taking PRs >> from folks who have GitHub accounts but find ASF JIRA accounts too >> burdensome, what are we putting for the author in JIRA? Am I going to >> have to look in JIRA before a certain date and in Git after? Or in Git >> only if JIRA is set to some "HBase Contributor from GitHub" account?" >> >> Thanks, >> St.Ack >> > > > Hey folks, > > This authorship bit might be coming up now. There's a PR for an existing > JIRA issue that I'd like to accept, but AFAICT the PR author doesn't have a > JIRA account. > > I've asked them about it. If they don't have an account and don't want to > make one, I suppose I'll make a placeholder JIRA account and send the > details to the PMC, unless someone objects. > > I'm not happy about the bifrucation of authorship information but I don't > see how forcing JIRA account creation could possibly be sustainable. > >>
