linux-kernel - Re: [PATCH v3 DONOTMERGE] docs: clarify rules wrt tagging other people

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241202154528.7949e7cb@foz.lan>
Date: Mon, 2 Dec 2024 15:45:28 +0100
From: Mauro Carvalho Chehab <mchehab+huawei@...nel.org>
To: Thorsten Leemhuis <linux@...mhuis.info>
Cc: Jonathan Corbet <corbet@....net>, workflows@...r.kernel.org,
 linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org, Laurent Pinchart
 <laurent.pinchart@...asonboard.com>, Simona Vetter
 <simona.vetter@...ll.ch>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [PATCH v3 DONOTMERGE] docs: clarify rules wrt tagging other
 people

Em Mon, 2 Dec 2024 14:54:56 +0100
Thorsten Leemhuis <linux@...mhuis.info> escreveu:

> On 02.12.24 11:02, Mauro Carvalho Chehab wrote:
> > Em Mon, 2 Dec 2024 09:28:57 +0100
> > Mauro Carvalho Chehab <mchehab+huawei@...nel.org> escreveu:
> >   
> >>> +Tagging people requires permission
> >>> +----------------------------------
> >>> +
> >>> +Be careful in the addition of tags to your patches, as all except for Cc:,
> >>> +Reported-by:, and Suggested-by: need explicit permission of the person named.
> >>> +For the three aforementioned ones implicit permission is sufficient if the
> >>> +person contributed to the Linux kernel using that name and email address
> >>> +according to the lore archives or the commit history -- and in case of
> >>> +Reported-by: and Suggested-by: did the reporting or suggestion in public.
> >>> +Note, bugzilla.kernel.org is a public place in this sense, but email addresses
> >>> +used there are private; so do not expose them in tags, unless the person used
> >>> +them in earlier contributions.  
> 
> First: thx for your Review-by given earlier!
> 
> > Hmm... There is another tag that we use without requiring explicit permissions:
> > 
> > 	Requested-by:
> > 
> > There are currently 376 occurrences on 6.13-rc1.
> > 
> > This is used when a maintainer or reviewer publicly requests some changes to
> > be added on a patch series.  
> 
> Hmmm, that is one of those "grey area" tags[1], as it's not documented
> yet afaics ('grep -ir Requested-by Documentation/
> scripts/get_maintainer.pl' gave nothing). 

> Documenting it would make it
> official; I'm not sure if that is wanted and say that is something that
> should be done independently if somebody wants to make it official.

No, my intention is not to make requested-by (or its variant suggested-by)
official.

The issue is that, when it is said there that
"all except CC/Reported-by/reviewed-by", plus considering other
other hunks of this patch like:

	"is one of only three tags you might be able to use without
	 explicit permission"

You're basically requesting explicit permission for any "non-official"
tags as well, including reviewed-by. This is not what it is wanted here.

See, if we run:

	$ git log --pretty="%b" 1da177e4c3f4..v6.13-rc1 |grep -Ei "^[a-z\-]+: .*@.*"|cut -d: -f 1|tr A-Z a-z |sort|uniq -c|wc -l
	764

There are 764 tags (and 764 ones, for the last 2 years) that are e-mails 
r e-mail related tags. Among them, there are several ones that comes
from the message-id (which may disclose the hostname that was used
during patch development).

The top 20 being:

    185 debugged-by
    240 co-authored-by
    367 requested-by			# doesn't need explicit ack
    563 reviewed-and-tested-by
   1505 to				# doesn't need explicit ack
   1757 author				# doesn't need explicit ack
   2857 closes				# with message IDs?
   3204 reported-and-tested-by
   3451 from				# doesn't need explicit ack
   5106 lkml-reference			# with message IDs?
   6616 message-id			# message IDs
   6858 co-developed-by
  18996 suggested-by			# doesn't need explicit ack
  64529 reported-by
  72321 tested-by
 213673 acked-by
 310825 link				# with message IDs?
 367140 reviewed-by
 739926 cc
2446984 signed-off-by

From that, besides the 3 you mentioned, at least 5 don't seem to require
an explicit ack: author, from, to, requested-by, suggested-by.

Thanks,
Mauro