Re: [PATCH 0/3] treewide: migrate from legacy utime.h to utimensat

["brian m. carlson" <sandals@crustytoothpaste.net>]

[-- Attachment #1: Type: text/plain, Size: 4660 bytes --]

On 2026-08-22 at 17:59:09, Junio C Hamano wrote:
> "brian m. carlson" <sandals@crustytoothpaste.net> writes:
> 
> > On 2026-08-21 at 14:23:20, Alexey Samsonov via GitGitGadget wrote:
> >> This change is generated by Gemini Flash from Antigravity, but all the code
> >> has been manually verified by me, and, where applicable, adjusted to match
> >> the existing behavior as closely as possible.
> >
> > Unfortunately, I don't think that's allowed.  From SubmittingPatches[0]:
> >
> >     The Developer's Certificate of Origin requires contributors to certify
> >     that they know the origin of their contributions to the project and
> >     that they have the right to submit it under the project's license.
> >     It's not yet clear that this can be legally satisfied when submitting
> >     significant amount of content that has been generated by AI tools.
> >
> > I therefore haven't read this series to avoid being influenced by code
> > we're not allowed to include.
> >
> > [0] https://git-scm.com/docs/SubmittingPatches#ai
> 
> Your stance, as I understand it, is that Alexey's DCO is not valid
> because, acting as a copy editor of Antigravity/Gemini's work,
> Alexey cannot possibly know where the code was copied from.  And we
> cannot accept work that is not covered by a valid DCO.

Yes.  We know that in some cases LLMs regurgitate code that is
substantially similar to training inputs and we don't know what the
legal status of the output of an LLM is, especially since there is
active litigation around the world.

The DCO was invented to provide a legal assertion by an author that they
are only submitting code they legally have the right to submit and I
don't think there's enough legal clarity for us to know that with an
LLM.

> I think that is a much more prudent attitude than being cavalier
> about legal issues.  I used to think, "Hey, the person claims in the
> DCO that the code is appropriately licensed, so if it turns out to
> be a false claim later, that is his or her problem, not ours."
> 
> But that is not how things work.

It's my understanding that in many places there's a difference between
knowingly doing something and doing something without knowledge.  For
example, Canada's Copyright Act uses the text, "that the person knows or
should have known infringes copyright".

So we do have more of a legal problem if we knowingly distribute code
that infringes copyright or which we suspect may do so.

> If work submitted under a DCO later turns out to be based on
> something we cannot legally use, the submitter may of course be in
> trouble, but we would also need to bear the cost of ripping it out;
> the later we discover the problem, the more substantial the effort
> necessary to deal with the fallout will be.

Yes, that's true.  We still have the fallout and issues in terms of
project management to deal with, but fewer legal problems.

> Stepping back a bit, though, is the situation really all that
> different between a relatively new author who discloses their use of
> AI and another author similarly unknown to us who claims it is all
> their own work?  Either way, if the code turns out to be unusable,
> we would still be on the hook for participating in the infringement
> and would bear the cost of ripping it out.
> 
> What worries me a bit is that there may not be much difference
> between "you said that you relayed AI output, so we won't talk to
> you" and "we do not know you well enough to trust you, so we won't
> talk to you".

If somebody comes to our project and lies to us about the provenance of
their work, that's very serious.  Saying, "I wrote this with AI," when
we don't allow AI is being honest and ethical and disclosing relevant
details to the project.  It may be that we can't accept their code for
that reason, but they have participated in the project in good faith.
We could certainly accept other patches from such a person written
without AI.

But if a contributor misleads us about the origin of their code, whether
it came from AI or was taken without credit from another project,
then they're not at all acting in good faith and we will likely not
allow them to continue to contribute to the project.  Moreover, they
will also be unwelcome in most other projects as well because they'll be
viewed as dishonest.

That doesn't affect whether we end up having negative consequences from
distributing that code, true.  But at some point, we have to trust that
most people are honest or our community and society break down.
-- 
brian m. carlson (they/them)
Toronto, Ontario, CA

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 325 bytes --]