Linus on documenting patch provenance [LWN.net]

Linus on documenting patch provenance

Posted May 24, 2004 5:48 UTC (Mon) by tgape (guest, #21785)
In reply to: Linus on documenting patch provenance by oconnorcjo
Parent article: Linus on documenting patch provenance

This process is barely bureaucratic. Under a truly bureaucratic process, there would be
individuals who would need to be in the chain solely because the process says that they're in
the chain. That does not sound like what we're looking at here, with one occasional
exception. And last I heard, that one exception was working on getting himself as removed
as he could from that bit. Personally, this feels like a fairly slick implementation of what's
needed.

However, I think that it might need to have a bit of documentation about the occasional
contributors - If Joe "One Patch" Programmer[*] contributes one fairly major patch, and is
never heard from again, the only indication that it was a truly unencumbered patch was that
he said it was his original code. But if five years down the road, Incorporated Company,
Inc[**], claims that he was working for them at that time, and it's their code, things could still
be messy.

I'd think that people who wrote a device driver or two, but contribute less than once a month
will still probably be on the trust list of at least one individual. However, they will probably
not be on multiple people's trust list unless they are active elsewhere in open source.

Someone who contributes occasional patches, rarely to the same component, however, will
probably take quite a while to get on a trust list.

[*] any resemblance to any actual Joe Programmer is purely coincidental.

[**] Insert standard sample company name disclaimer here.

(Log in to post comments)

Linus on documenting patch provenance

Posted May 24, 2004 11:35 UTC (Mon) by jerven (guest, #21795) [Link]

All liability for damage in this case would be for the original patch submitter as he certified that he did not copy the code while he did.
Weird example if someone said he owned a house and he cerifies it and he then hires you to demolish the house so that he can build a garage or whatever. If he is in fact not the owner your liability for damages would be limited as you acted in good faith that you established by making him certify he owned the house. If you did not make him certify he owned the house you could be sued for carelessnes even though you still acted in good faith that he was the owner.

So when this hapens it is only messy for the employee who contribtuted illegally and he is fully responsible for all the damages he caused to his company. So this does not only depend on trust but on simply making sure that the top developers and capable of being held responsible for someones else failing. He certified he was allowed to submit this patch if he was not then the damage is his as he submitted in typing that he was the owner and the maintainer has shown due dilligence by having him certify that he owns it. Therefore I think this is a simple but effective idea.

The only problem is that antone can submit a fake id or tag and just insert someone elses name in suplying a patch. A digital signature should realy be included.