linux-kernel - Re: Problematic culture around Signed-off-by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 31 Jul 2017 16:44:49 +0300
From:   "Kirill A. Shutemov" <kirill@...temov.name>
To:     Adam Borowski <kilobyte@...band.pl>
Cc:     Pavel Machek <pavel@....cz>, Ian Molton <spyro2@...il.com>,
        linux-kernel@...r.kernel.org
Subject: Re: Problematic culture around Signed-off-by

On Mon, Jul 31, 2017 at 03:34:11PM +0200, Adam Borowski wrote:
> On Sun, Jul 30, 2017 at 08:52:36PM +0200, Pavel Machek wrote:
> > > I've been away from kernel development for a bit, but I've returned and
> > > I'm troubled by what seems to be an entrenched and widespread (IMO)
> > > misuse of the "Signed-off-by:" in commits.
> > > 
> > > I've now either been asked to sign off RFC quality patches "because its
> > > quicker" on more than one occasion in the last week or so, and I've seen
> > > others signing off code which clearly has no hope of going anywhere near
> > > the kernel. (eg. // commented out lines)
> > > 
> > > I was of the impression that Signed-off-by: was intended to be used on
> > > essentially *finished* commits, indicating both readiness for inclusion
> > > upstream and ones ownership of the copyright.
> > > 
> > > Even if the intent is *purely* a copyright isue, Signing off
> > > *everything* surely makes it far too easy for people to get junk into
> > > the kernel.
> > 
> > I normally sign-off everything... because getting patch without
> > sign-off is nasty. If maintainer gets unclean, but signed-off patch,
> > he can just clean it up, add his sign-off and continue normally.
> 
> Yet there are cases with known but unobvious breakage (see below).
> 
> > That may or may not be allowed if patch is not signed-off. (We are in
> > lawyer teritory now.)
> > 
> > So I'd recommend signing everything, and if patch is considered "not
> > ready", make it clear in some other way.
> 
> I think it'd be much better if you could suggest a new marker.  Something
> like "Copyright-but-not-Readiness-Signed-off-by:", "RFC-Signed-off-by:",
> "WIP-Signed-off-by:", etc.

I use (and saw other people used) "Not-Yet-Signed-off-by:" for this
purpose.

-- 
 Kirill A. Shutemov