linux-kernel - Problematic culture around Signed-off-by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <d97fdda3-5856-531d-0ee5-ac8f2cc844e6@gmail.com>
Date:   Fri, 21 Jul 2017 12:40:02 +0100
From:   Ian Molton <spyro2@...il.com>
To:     linux-kernel@...r.kernel.org, torvalds@...ux-foundation.org
Subject: Problematic culture around Signed-off-by

Hi folks,

I've been away from kernel development for a bit, but I've returned and
I'm troubled by what seems to be an entrenched and widespread (IMO)
misuse of the "Signed-off-by:" in commits.

I've now either been asked to sign off RFC quality patches "because its
quicker" on more than one occasion in the last week or so, and I've seen
others signing off code which clearly has no hope of going anywhere near
the kernel. (eg. // commented out lines)

I was of the impression that Signed-off-by: was intended to be used on
essentially *finished* commits, indicating both readiness for inclusion
upstream and ones ownership of the copyright.

Even if the intent is *purely* a copyright isue, Signing off
*everything* surely makes it far too easy for people to get junk into
the kernel.

I've actually been deliberately NOT signing off my code because I *DONT*
want it surreptitiously applied with my name on it unless its 100% spot on.

WTH is going on? How can we fix this?

Is Signed-off-by: a lost cause for code quality?

Do we need to add a

Ready-for-mainline: {yes,no} field as well?

Have I just missed something? Maybe I'm just in a minority here? Whats
going on?

-Ian