linux-kernel - Re: Problematic culture around Signed-off-by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170730185236.GA28293@amd>
Date:   Sun, 30 Jul 2017 20:52:36 +0200
From:   Pavel Machek <pavel@....cz>
To:     Ian Molton <spyro2@...il.com>
Cc:     linux-kernel@...r.kernel.org, torvalds@...ux-foundation.org
Subject: Re: Problematic culture around Signed-off-by

Hi!

> I've been away from kernel development for a bit, but I've returned and
> I'm troubled by what seems to be an entrenched and widespread (IMO)
> misuse of the "Signed-off-by:" in commits.
> 
> I've now either been asked to sign off RFC quality patches "because its
> quicker" on more than one occasion in the last week or so, and I've seen
> others signing off code which clearly has no hope of going anywhere near
> the kernel. (eg. // commented out lines)
> 
> I was of the impression that Signed-off-by: was intended to be used on
> essentially *finished* commits, indicating both readiness for inclusion
> upstream and ones ownership of the copyright.
> 
> Even if the intent is *purely* a copyright isue, Signing off
> *everything* surely makes it far too easy for people to get junk into
> the kernel.

Well, maintainers should not apply obvious junk to their trees,
signed-off or not.

I normally sign-off everything... because getting patch without
sign-off is nasty. If maintainer gets unclean, but signed-off patch,
he can just clean it up, add his sign-off and continue normally.

That may or may not be allowed if patch is not signed-off. (We are in
lawyer teritory now.)

So I'd recommend signing everything, and if patch is considered "not
ready", make it clear in some other way.

									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)