linux-kernel - Re: Problematic culture around Signed-off-by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20170731135840.GA9165@amd>
Date:   Mon, 31 Jul 2017 15:58:40 +0200
From:   Pavel Machek <pavel@....cz>
To:     "Kirill A. Shutemov" <kirill@...temov.name>
Cc:     Adam Borowski <kilobyte@...band.pl>, Ian Molton <spyro2@...il.com>,
        linux-kernel@...r.kernel.org
Subject: Re: Problematic culture around Signed-off-by

On Mon 2017-07-31 16:44:49, Kirill A. Shutemov wrote:
> On Mon, Jul 31, 2017 at 03:34:11PM +0200, Adam Borowski wrote:
> > On Sun, Jul 30, 2017 at 08:52:36PM +0200, Pavel Machek wrote:
> > > > I've been away from kernel development for a bit, but I've returned and
> > > > I'm troubled by what seems to be an entrenched and widespread (IMO)
> > > > misuse of the "Signed-off-by:" in commits.
> > > > 
> > > > I've now either been asked to sign off RFC quality patches "because its
> > > > quicker" on more than one occasion in the last week or so, and I've seen
> > > > others signing off code which clearly has no hope of going anywhere near
> > > > the kernel. (eg. // commented out lines)
> > > > 
> > > > I was of the impression that Signed-off-by: was intended to be used on
> > > > essentially *finished* commits, indicating both readiness for inclusion
> > > > upstream and ones ownership of the copyright.
> > > > 
> > > > Even if the intent is *purely* a copyright isue, Signing off
> > > > *everything* surely makes it far too easy for people to get junk into
> > > > the kernel.
> > > 
> > > I normally sign-off everything... because getting patch without
> > > sign-off is nasty. If maintainer gets unclean, but signed-off patch,
> > > he can just clean it up, add his sign-off and continue normally.
> > 
> > Yet there are cases with known but unobvious breakage (see below).

Yes, so you point up the breakage in the changelog...

> > > That may or may not be allowed if patch is not signed-off. (We are in
> > > lawyer teritory now.)
> > > 
> > > So I'd recommend signing everything, and if patch is considered "not
> > > ready", make it clear in some other way.
> > 
> > I think it'd be much better if you could suggest a new marker.  Something
> > like "Copyright-but-not-Readiness-Signed-off-by:", "RFC-Signed-off-by:",
> > "WIP-Signed-off-by:", etc.
> 
> I use (and saw other people used) "Not-Yet-Signed-off-by:" for this
> purpose.

As I tried to explain, that is problematic.

If I fix the patch, how do I submit it myself?

But you are free to use Subject: [Not ready], or just sprinkle code
with // comments...

Anyway, applying not-ready patch is not something I usually seen
happening. OTOH, not applying patches that were ready months ago is
quite common :-).

									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)