Shall we adopt a CLA or DCO?

[swainn]

While researching for the contributor documentation I have learned about Contributor License Agreements and Developer Certificate of Origin. Both are agreements between the individual contributors and and a project that ensure the projects has the necessary rights to use and share the contributed code. It essentially protects the project from individuals or companies who try to claim some code they contributed was unintentional/not authorized.

Here are my questions:

1. Should we adopt a CLA/DCO?
2. If so, which one?

Here are some interesting articles on the topic that I discovered in my research:

• https://wikijs.opencode.de/en/Hilfestellungen_und_Richtlinien/CLA_DCO
• https://opensource.com/article/18/3/cla-vs-dco-whats-difference

One of the criticisms of using a CLA/DCO is that they require a lot of administrative overhead. However, I discovered this tool (contributor-assistant) that automates the process via GitHub action. It does so by adding a check to every pull requests to ensure all contributors have signed the CLA/DCO. Those who have not signed are able to do so through a PR comment. A list of contributors that have signed is maintained in the project repo or a separate repo. If we decide to move forward with this, I would recommend we use contributor-assistant.

[swainn]

@sdc50 and @shawncrawley take a look!