Guidelines for Submitters
Contributing code to COVESA can be done in two ways. Most commonly, code is contributed to a project hosted on GitHub. However, some organizations prefer to manage all contributions by means of an Entity Contribution License Agreement (CLA). This page discusses both options. If a prospective contributor has questions, please contact the COVESA Community Director (pboyes at covesa.global) for details.
In either contribution option, prospective contributors must understand the sign-off and Developers Certificate of Origin as well as understand the guidelines for handling third-party IP in contributions apply (described below).
Sign-Off and DCO (Developers Certificate of Origin) Acceptance
Every contribution must carry the following sign-off line with your real name and email address like the following example:
Signed-off-by: Firstname Lastname <you@example.com>
By supplying this sign-off line, you indicate your acceptance of the following COVESA Certificate of Origin (DCO):
- "By making a contribution to this project, I certify that:
a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or
b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or
c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it.
d) I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved."
If you contribute on behalf of an organization (e.g. your employer), you acknowledge, by supplying the above sign-off line that, "I am authorized to submit this contribution on behalf of the organization holding the copyright".
When you submit code for the first time, the project maintainer will contact you and make sure that you are familiar with the DCO and answer all the questions you might have regarding contributions.
Code Contribution Options
If you or your organization has signed a Contributor License Agreement (CLA) with COVESA and you are an authorized submitter, then Option 2 applies. Otherwise, Option 1 applies. If unsure about the option to use, please contact the COVESA Community Director (pboyes at covesa.global) before submitting any code.
Code Contribution Option 1: Using the Project License
Code contributions can be submitted to COVESA, if they are licensed under the project's open source license. Most projects have a standard license and expect all contributions to be made according to that licensing model. The Project Maintainer may consider alternatives, but generally, COVESA requires consistency of licensing within a COVESA project. If a prospective contributor wishes to contribute by starting a new project, then the contributor should contact the COVESA Community Director to discuss this process. COVESA has published a Policy for Open Source Licensing to inform contributors which open source licenses are acceptable.
Code Contribution Option 2: Using the CLA
The COVESA Entity Contributors License Agreement (CLA) is a contractual framework between COVESA and an organization, which allows certain authorized submitters to contribute code to COVESA. If you are an authorized submitter, please clearly mark your contribution as “Provided under the terms of the COVESA Entity Contributor License Agreement” and indicate which OSS license you recommend COVESA to apply to your contribution. If you are not an authorized submitter, do not use this option, or your contribution will be rejected.
Guideline for Handling Third-Party IP in Contributions
As a general rule, only original code should be contributed to COVESA. Third-party open source components which are available elsewhere (e.g. the Linux kernel or the C libraries) will be obtained by COVESA directly from the upstream open source project(s). Modifications/extensions to such components should be first provided to the upstream project in the form of patches. Only in case the upstream project has not yet reviewed or rejected a patch, it can be provided to COVESA.
You must include the exact location and version numbers for all upstream open source components that are required for the contribution to build and run.
If the contribution "reuses" code snippets from other open source projects which were directly incorporated in the contributed source code files, a disclosure document must be provided with the contribution, providing details about the incorporated code (e.g. project name, version) and the applicable open source license(s). The COVESA Third-Party Disclosure Document template can be found here.
COVESA will reject a contribution containing non-original code, if:
- no disclosure document is provided
- the license(s) governing the non-original code are not compatible with the COVESA project license or licensing policy
- an automated code scan performed by COVESA during the acceptance process, produces results that differ from the information provided in the disclosure document
If you have questions about the handling of third-party IP, please contact the COVESA helpdesk (help@covesa.global).