linux-kernel - Re: [PATCH 2/4] agents: add core development references

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aIpkfxjMJ9IGEo_K@lappy>
Date: Wed, 30 Jul 2025 14:29:19 -0400
From: Sasha Levin <sashal@...nel.org>
To: Al Viro <viro@...iv.linux.org.uk>
Cc: Kees Cook <kees@...nel.org>, corbet@....net, linux-doc@...r.kernel.org,
	workflows@...r.kernel.org, josh@...htriplett.org,
	konstantin@...uxfoundation.org, linux-kernel@...r.kernel.org,
	rostedt@...dmis.org
Subject: Re: [PATCH 2/4] agents: add core development references

On Wed, Jul 30, 2025 at 06:35:28PM +0100, Al Viro wrote:
>On Wed, Jul 30, 2025 at 12:25:41PM -0400, Sasha Levin wrote:
>
>> Critical Requirements:
>>
>> * License: ALL code MUST be GPL-2.0 only (see COPYING)
>> * Signed-off-by: Agents MUST NOT add Signed-off-by tags
>>   (Only humans can legally certify code submission rights)
>> * Attribution: Agents MUST add Co-developed-by tag:
>>   Co-developed-by: $AGENT_NAME $AGENT_MODEL $AGENT_VERSION
>>   Examples:
>>   - Co-developed-by: Claude claude-3-opus-20240229
>>   - Co-developed-by: GitHub-Copilot GPT-4 v1.0.0
>
>  * for any patch there must be some entity capable of usefully
>    answering questions about that patch.  Legal certification
>    be damned, there must be somebody able to handle active
>    questioning.
>
>And no, it's not the same as with human submitters.  If entity
>A sends a patch to maintainer B, who passes it along and gets
>questions/feedback regarding that patch, B might have to resort
>to passing the questions to A, to confirm their understanding
>of the situation.  And from what I've seen, LLM tend to do
>very badly in such cases.
>
>IOW, defending any agent-originated patch falls entirely upon
>the human "co-developer".  IMO that is a critical requirement.

I agree. Elsewhere in the thread I suggested that a maintainer should be
able to require having tool generated patches come with a Reviewed-by
tag from a "trusted reviewer" (similar to the guidelines we have for
academic researches).

This way you could at least have a human you trust be part of the loop
until you trust the author of those tool generated patches.

-- 
Thanks,
Sasha