treewide: migrate from legacy utime.h to utimensat

[vonosmas]

utime() function for setting access/modification time for files
(and a corresponding <utime.h> header) have been officially removed
from POSIX starting from POSIX.1-2024. While existing system library
implementations still provide this function for compatibility reasons,
its implementation may be removed in the future, or otherwise degrade
over time. Some newer libc implementations (e.g. LLVM-libc, currently
under development) don't provide utime() function at all.

This PR switches the git codebase to recommended alternative:
utimensat() POSIX function (which supports nanosecond-level precision)
from <fcntl.h>, and, as a possible fallback for older systems
compatibility, utimes() function from <sys/stat.h>.
It also provides the corresponding MinGW wrapper.

The alternative is to unconditionally use utimes() where possible, but
given that utimensat is available in glibc starting from 2007, and on
BSD systems since 2012 or so, it makes sense to use the newer variant
by default.

No behavior changes is intended or expected (except for Git explicitly
passing nanosecond-precision timestamps to kernel, where
previously only second-level precision was used).

This change is generated by Gemini Flash from Antigravity, but all the
code has been manually verified by me, and, where applicable,
adjusted to match the existing behavior as closely as possible.

Signed-off-by: Alexey Samsonov vonosmas@gmail.com
cc: "brian m. carlson" sandals@crustytoothpaste.net
cc: Weijie Yuan wy@wyuan.org
cc: Oswald Buddenhagen oswald.buddenhagen@gmx.de

[gitgitgadget]

Welcome to GitGitGadget

Hi @vonosmas, and welcome to GitGitGadget, the GitHub App to send patch series to the Git mailing list from GitHub Pull Requests.

Please make sure that either:

• Your Pull Request has a good description, if it consists of multiple commits, as it will be used as cover letter.
• Your Pull Request description is empty, if it consists of a single commit, as the commit message should be descriptive enough by itself.

You can CC potential reviewers by adding a footer to the PR description with the following syntax:

CC: Revi Ewer <revi.ewer@example.com>, Ill Takalook <ill.takalook@example.net>

NOTE: DO NOT copy/paste your CC list from a previous GGG PR's description,
because it will result in a malformed CC list on the mailing list. See
example.

Also, it is a good idea to review the commit messages one last time, as the Git project expects them in a quite specific form:

• the lines should not exceed 76 columns,
• the first line should be like a header and typically start with a prefix like "tests:" or "revisions:" to state which subsystem the change is about, and
• the commit messages' body should be describing the "why?" of the change.
• Finally, the commit messages should end in a Signed-off-by: line matching the commits' author.

It is in general a good idea to await the automated test ("Checks") in this Pull Request before contributing the patches, e.g. to avoid trivial issues such as unportable code.

Contributing the patches

Before you can contribute the patches, your GitHub username needs to be added to the list of permitted users. Any already-permitted user can do that, by adding a comment to your PR of the form /allow. A good way to find other contributors is to locate recent pull requests where someone has been /allowed:

• Search: is:pr is:open "/allow"

Both the person who commented /allow and the PR author are able to /allow you.

An alternative is the channel #git-devel on the Libera Chat IRC network:

<newcontributor> I've just created my first PR, could someone please /allow me? https://github.com/gitgitgadget/git/pull/12345
<veteran> newcontributor: it is done
<newcontributor> thanks!

Once on the list of permitted usernames, you can contribute the patches to the Git mailing list by adding a PR comment /submit.

If you want to see what email(s) would be sent for a /submit request, add a PR comment /preview to have the email(s) sent to you. You must have a public GitHub email address for this. Note that any reviewers CC'd via the list in the PR description will not actually be sent emails.

After you submit, GitGitGadget will respond with another comment that contains the link to the cover letter mail in the Git mailing list archive. Please make sure to monitor the discussion in that thread and to address comments and suggestions (while the comments and suggestions will be mirrored into the PR by GitGitGadget, you will still want to reply via mail).

If you do not want to subscribe to the Git mailing list just to be able to respond to a mail, you can download the mbox from the Git mailing list archive (click the (raw) link), then import it into your mail program. If you use GMail, you can do this via:

curl -g --user "<EMailAddress>:<Password>" \
    --url "imaps://imap.gmail.com/INBOX" -T /path/to/raw.txt

To iterate on your change, i.e. send a revised patch or patch series, you will first want to (force-)push to the same branch. You probably also want to modify your Pull Request description (or title). It is a good idea to summarize the revision by adding something like this to the cover letter (read: by editing the first comment on the PR, i.e. the PR description):

Changes since v1:
- Fixed a typo in the commit message (found by ...)
- Added a code comment to ... as suggested by ...
...

To send a new iteration, just add another PR comment with the contents: /submit.

Need help?

New contributors who want advice are encouraged to join git-mentoring@googlegroups.com, where volunteers who regularly contribute to Git are willing to answer newbie questions, give advice, or otherwise provide mentoring to interested contributors. You must join in order to post or view messages, but anyone can join.

You may also be able to find help in real time in the developer IRC channel, #git-devel on Libera Chat. Remember that IRC does not support offline messaging, so if you send someone a private message and log out, they cannot respond to you. The scrollback of #git-devel is archived, though.

[Ikke]

/allow

[gitgitgadget]

User vonosmas is now allowed to use GitGitGadget.

[vonosmas]

/submit

[gitgitgadget]

Submitted as pull.2209.git.1787322203.gitgitgadget@gmail.com

To fetch this version into FETCH_HEAD:

git fetch https://github.com/gitgitgadget/git/ pr-2209/vonosmas/drop-utime-h-v1

To fetch this version to local tag pr-2209/vonosmas/drop-utime-h-v1:

git fetch --no-tags https://github.com/gitgitgadget/git/ tag pr-2209/vonosmas/drop-utime-h-v1

[gitgitgadget]

Junio C Hamano wrote on the Git mailing list (how to reply to this email):

"Alexey Samsonov via GitGitGadget" <gitgitgadget@gmail.com> writes:

> utime() function for setting access/modification time for files (and a
> corresponding <utime.h> header) have been officially removed from POSIX
> starting from POSIX.1-2024. While existing system library implementations
> still provide this function for compatibility reasons, its implementation
> may be removed in the future, or otherwise degrade over time. Some newer
> libc implementations (e.g. LLVM-libc, currently under development) don't
> provide utime() function at all.
>
> This PR switches the git codebase to recommended alternative: utimensat()
> POSIX function (which supports nanosecond-level precision) from <fcntl.h>,
> and, as a possible fallback for older systems compatibility, utimes()
> function from <sys/stat.h>. It also provides the corresponding MinGW
> wrapper.
>
> The alternative is to unconditionally use utimes() where possible, but given
> that utimensat is available in glibc starting from 2007, and on BSD systems
> since 2012 or so, it makes sense to use the newer variant by default.

I hear that Apple has supported it since macOS 10.13 High Sierra,
which came out in 2017 and reached EOL in 2020, so we should be safe
there as well.

[gitgitgadget]

"brian m. carlson" wrote on the Git mailing list (how to reply to this email):

On 2026-08-21 at 14:23:20, Alexey Samsonov via GitGitGadget wrote:
> utime() function for setting access/modification time for files (and a
> corresponding <utime.h> header) have been officially removed from POSIX
> starting from POSIX.1-2024. While existing system library implementations
> still provide this function for compatibility reasons, its implementation
> may be removed in the future, or otherwise degrade over time. Some newer
> libc implementations (e.g. LLVM-libc, currently under development) don't
> provide utime() function at all.
> 
> This PR switches the git codebase to recommended alternative: utimensat()
> POSIX function (which supports nanosecond-level precision) from <fcntl.h>,
> and, as a possible fallback for older systems compatibility, utimes()
> function from <sys/stat.h>. It also provides the corresponding MinGW
> wrapper.

I seem to remember that we cannot use the *at functions because of
Windows and the fact that it doesn't offer the proper semantics.  I'm
curious as to how you did this, but I didn't read the series because of
the below.

> The alternative is to unconditionally use utimes() where possible, but given
> that utimensat is available in glibc starting from 2007, and on BSD systems
> since 2012 or so, it makes sense to use the newer variant by default.
> 
> No behavior changes is intended or expected (except for Git explicitly
> passing nanosecond-precision timestamps to kernel, where previously only
> second-level precision was used).
> 
> This change is generated by Gemini Flash from Antigravity, but all the code
> has been manually verified by me, and, where applicable, adjusted to match
> the existing behavior as closely as possible.

Unfortunately, I don't think that's allowed.  From SubmittingPatches[0]:

    The Developer's Certificate of Origin requires contributors to certify
    that they know the origin of their contributions to the project and
    that they have the right to submit it under the project's license.
    It's not yet clear that this can be legally satisfied when submitting
    significant amount of content that has been generated by AI tools.

I therefore haven't read this series to avoid being influenced by code
we're not allowed to include.

[0] https://git-scm.com/docs/SubmittingPatches#ai
-- 
brian m. carlson (they/them)
Toronto, Ontario, CA

[gitgitgadget]

User "brian m. carlson" <sandals@crustytoothpaste.net> has been added to the cc: list.

[gitgitgadget]

Junio C Hamano wrote on the Git mailing list (how to reply to this email):

"brian m. carlson" <sandals@crustytoothpaste.net> writes:

> On 2026-08-21 at 14:23:20, Alexey Samsonov via GitGitGadget wrote:
>> This change is generated by Gemini Flash from Antigravity, but all the code
>> has been manually verified by me, and, where applicable, adjusted to match
>> the existing behavior as closely as possible.
>
> Unfortunately, I don't think that's allowed.  From SubmittingPatches[0]:
>
>     The Developer's Certificate of Origin requires contributors to certify
>     that they know the origin of their contributions to the project and
>     that they have the right to submit it under the project's license.
>     It's not yet clear that this can be legally satisfied when submitting
>     significant amount of content that has been generated by AI tools.
>
> I therefore haven't read this series to avoid being influenced by code
> we're not allowed to include.
>
> [0] https://git-scm.com/docs/SubmittingPatches#ai

Your stance, as I understand it, is that Alexey's DCO is not valid
because, acting as a copy editor of Antigravity/Gemini's work,
Alexey cannot possibly know where the code was copied from.  And we
cannot accept work that is not covered by a valid DCO.

I think that is a much more prudent attitude than being cavalier
about legal issues.  I used to think, "Hey, the person claims in the
DCO that the code is appropriately licensed, so if it turns out to
be a false claim later, that is his or her problem, not ours."

But that is not how things work.

If work submitted under a DCO later turns out to be based on
something we cannot legally use, the submitter may of course be in
trouble, but we would also need to bear the cost of ripping it out;
the later we discover the problem, the more substantial the effort
necessary to deal with the fallout will be.

Stepping back a bit, though, is the situation really all that
different between a relatively new author who discloses their use of
AI and another author similarly unknown to us who claims it is all
their own work?  Either way, if the code turns out to be unusable,
we would still be on the hook for participating in the infringement
and would bear the cost of ripping it out.

What worries me a bit is that there may not be much difference
between "you said that you relayed AI output, so we won't talk to
you" and "we do not know you well enough to trust you, so we won't
talk to you".

[gitgitgadget]

"brian m. carlson" wrote on the Git mailing list (how to reply to this email):

On 2026-08-22 at 17:59:09, Junio C Hamano wrote:
> "brian m. carlson" <sandals@crustytoothpaste.net> writes:
> 
> > On 2026-08-21 at 14:23:20, Alexey Samsonov via GitGitGadget wrote:
> >> This change is generated by Gemini Flash from Antigravity, but all the code
> >> has been manually verified by me, and, where applicable, adjusted to match
> >> the existing behavior as closely as possible.
> >
> > Unfortunately, I don't think that's allowed.  From SubmittingPatches[0]:
> >
> >     The Developer's Certificate of Origin requires contributors to certify
> >     that they know the origin of their contributions to the project and
> >     that they have the right to submit it under the project's license.
> >     It's not yet clear that this can be legally satisfied when submitting
> >     significant amount of content that has been generated by AI tools.
> >
> > I therefore haven't read this series to avoid being influenced by code
> > we're not allowed to include.
> >
> > [0] https://git-scm.com/docs/SubmittingPatches#ai
> 
> Your stance, as I understand it, is that Alexey's DCO is not valid
> because, acting as a copy editor of Antigravity/Gemini's work,
> Alexey cannot possibly know where the code was copied from.  And we
> cannot accept work that is not covered by a valid DCO.

Yes.  We know that in some cases LLMs regurgitate code that is
substantially similar to training inputs and we don't know what the
legal status of the output of an LLM is, especially since there is
active litigation around the world.

The DCO was invented to provide a legal assertion by an author that they
are only submitting code they legally have the right to submit and I
don't think there's enough legal clarity for us to know that with an
LLM.

> I think that is a much more prudent attitude than being cavalier
> about legal issues.  I used to think, "Hey, the person claims in the
> DCO that the code is appropriately licensed, so if it turns out to
> be a false claim later, that is his or her problem, not ours."
> 
> But that is not how things work.

It's my understanding that in many places there's a difference between
knowingly doing something and doing something without knowledge.  For
example, Canada's Copyright Act uses the text, "that the person knows or
should have known infringes copyright".

So we do have more of a legal problem if we knowingly distribute code
that infringes copyright or which we suspect may do so.

> If work submitted under a DCO later turns out to be based on
> something we cannot legally use, the submitter may of course be in
> trouble, but we would also need to bear the cost of ripping it out;
> the later we discover the problem, the more substantial the effort
> necessary to deal with the fallout will be.

Yes, that's true.  We still have the fallout and issues in terms of
project management to deal with, but fewer legal problems.

> Stepping back a bit, though, is the situation really all that
> different between a relatively new author who discloses their use of
> AI and another author similarly unknown to us who claims it is all
> their own work?  Either way, if the code turns out to be unusable,
> we would still be on the hook for participating in the infringement
> and would bear the cost of ripping it out.
> 
> What worries me a bit is that there may not be much difference
> between "you said that you relayed AI output, so we won't talk to
> you" and "we do not know you well enough to trust you, so we won't
> talk to you".

If somebody comes to our project and lies to us about the provenance of
their work, that's very serious.  Saying, "I wrote this with AI," when
we don't allow AI is being honest and ethical and disclosing relevant
details to the project.  It may be that we can't accept their code for
that reason, but they have participated in the project in good faith.
We could certainly accept other patches from such a person written
without AI.

But if a contributor misleads us about the origin of their code, whether
it came from AI or was taken without credit from another project,
then they're not at all acting in good faith and we will likely not
allow them to continue to contribute to the project.  Moreover, they
will also be unwelcome in most other projects as well because they'll be
viewed as dishonest.

That doesn't affect whether we end up having negative consequences from
distributing that code, true.  But at some point, we have to trust that
most people are honest or our community and society break down.
-- 
brian m. carlson (they/them)
Toronto, Ontario, CA

[gitgitgadget]

Weijie Yuan wrote on the Git mailing list (how to reply to this email):

[+cc Johannes Schindelin]

On Sat, Aug 22, 2026 at 10:59:09AM -0700, Junio C Hamano wrote:
> "brian m. carlson" <sandals@crustytoothpaste.net> writes:
> 
> > On 2026-08-21 at 14:23:20, Alexey Samsonov via GitGitGadget wrote:
> >> This change is generated by Gemini Flash from Antigravity, but all the code
> >> has been manually verified by me, and, where applicable, adjusted to match
> >> the existing behavior as closely as possible.
> >
> > Unfortunately, I don't think that's allowed.  From SubmittingPatches[0]:
> >
> >     The Developer's Certificate of Origin requires contributors to certify
> >     that they know the origin of their contributions to the project and
> >     that they have the right to submit it under the project's license.
> >     It's not yet clear that this can be legally satisfied when submitting
> >     significant amount of content that has been generated by AI tools.
> >
> > I therefore haven't read this series to avoid being influenced by code
> > we're not allowed to include.
> >
> > [0] https://git-scm.com/docs/SubmittingPatches#ai
> 
> Your stance, as I understand it, is that Alexey's DCO is not valid
> because, acting as a copy editor of Antigravity/Gemini's work,
> Alexey cannot possibly know where the code was copied from.  And we
> cannot accept work that is not covered by a valid DCO.
> 
> I think that is a much more prudent attitude than being cavalier
> about legal issues.  I used to think, "Hey, the person claims in the
> DCO that the code is appropriately licensed, so if it turns out to
> be a false claim later, that is his or her problem, not ours."
> 
> But that is not how things work.
> 
> If work submitted under a DCO later turns out to be based on
> something we cannot legally use, the submitter may of course be in
> trouble, but we would also need to bear the cost of ripping it out;
> the later we discover the problem, the more substantial the effort
> necessary to deal with the fallout will be.

Sorry to interject here, but I seem to remember that dscho already has a
few commits with an Assisted-by trailer that have made it into master.
I�m not entirely sure what kind of assistance he received either, but as
you suggest, it seems better to mention this here sooner rather than
later.

(I also mentioned this part here [1], with full respect to Johannes)

> Stepping back a bit, though, is the situation really all that
> different between a relatively new author who discloses their use of
> AI and another author similarly unknown to us who claims it is all
> their own work?  Either way, if the code turns out to be unusable,
> we would still be on the hook for participating in the infringement
> and would bear the cost of ripping it out.

> What worries me a bit is that there may not be much difference
> between "you said that you relayed AI output, so we won't talk to
> you" and "we do not know you well enough to trust you, so we won't
> talk to you".

But I think that, from Linus's point of view, the chain of trust matters
more than whether AI was used in the first place:

| So AI giveth, and AI taketh away. But the basic issue shouldn't be AI
| per se, it should be that notion of "trust". [2]

Of course, I also understand that the Git community doesn't need to
completely follow the rules from kernel community.

Thanks.

[1] https://lore.kernel.org/git/aorxVo_6_U1ceaKm@wyuan.org/
[2] https://lore.kernel.org/all/CAHk-=wgbGarE7Ozw4VG6oUKDj9pk-8DRoDiX00bo1MwEMm9UWQ@mail.gmail.com/

[gitgitgadget]

User Weijie Yuan <wy@wyuan.org> has been added to the cc: list.

[gitgitgadget]

Junio C Hamano wrote on the Git mailing list (how to reply to this email):

"brian m. carlson" <sandals@crustytoothpaste.net> writes:

> On 2026-08-22 at 17:59:09, Junio C Hamano wrote:
>> "brian m. carlson" <sandals@crustytoothpaste.net> writes:
>> 
>> > I therefore haven't read this series to avoid being influenced by code
>> > we're not allowed to include.

More on this a bit later...

> So we do have more of a legal problem if we knowingly distribute code
> that infringes copyright or which we suspect may do so.

Projects like the Linux kernel ask you to disclose your use of AI
(and have other requirements on your use), but I haven't read
exactly why they want it.  I wish they instead said, "We do not want
to be blamed for knowingly infringing.  While we do not particularly
encourage you to use AI, if you use one, do not tell us" ;-).

> If somebody comes to our project and lies to us about the provenance of
> their work, that's very serious.  Saying, "I wrote this with AI," when
> we don't allow AI is being honest and ethical and disclosing relevant
> details to the project.  It may be that we can't accept their code for
> that reason, but they have participated in the project in good faith.
> We could certainly accept other patches from such a person written
> without AI.

But that contradicts what you yourself did, doesn't it?  An honest
developer who discloses their use of AI admits that their eyes are
already contaminated by AI output, because they did not avoid being
influenced as you did.  So are they unwelcome now?

Stepping back a bit, even before the AI era, a human developer may
have seen code elsewhere that they are not allowed to include in a
particular project.  Learning from what others did is the nature of
our work, and it is inevitable.  Is it reasonable for BSD-only
projects to declare that those who are familiar with constructs that
appear in Git code after working on it are unwelcome, because their
contributions may be contaminated by what they have seen in a GPLed
project?

I very much appreciate that you are treading very cautiously on the
safer side, but I hope that the actual balance lies on a somewhat
more practical side that trusts humans.

> That doesn't affect whether we end up having negative consequences from
> distributing that code, true.  But at some point, we have to trust that
> most people are honest or our community and society break down.

True. True.

Thanks.

[gitgitgadget]

Junio C Hamano wrote on the Git mailing list (how to reply to this email):

Weijie Yuan <wy@wyuan.org> writes:

> Sorry to interject here, but I seem to remember that dscho already has a
> few commits with an Assisted-by trailer that have made it into master.
> I´m not entirely sure what kind of assistance he received either, but as
> you suggest, it seems better to mention this here sooner rather than
> later.

We know Johannes well enough to trust that his patches were sent
with sufficient due diligence.  So...?

[gitgitgadget]

Weijie Yuan wrote on the Git mailing list (how to reply to this email):

On Sun, Aug 23, 2026 at 08:26:40AM -0700, Junio C Hamano wrote:
> Weijie Yuan <wy@wyuan.org> writes:
> 
> > Sorry to interject here, but I seem to remember that dscho already has a
> > few commits with an Assisted-by trailer that have made it into master.
> > I�m not entirely sure what kind of assistance he received either, but as
> > you suggest, it seems better to mention this here sooner rather than
> > later.
> 
> We know Johannes well enough to trust that his patches were sent
> with sufficient due diligence.  So...?

<xmqqzeyeujde.fsf@gitster.g>:
> If work submitted under a DCO later turns out to be based on
> something we cannot legally use, the submitter may of course be in
> trouble, but we would also need to bear the cost of ripping it out;
> the later we discover the problem, the more substantial the effort
> necessary to deal with the fallout will be.

What I meant is that you said we should be wary of content that might
carry legal risks, if I understand correctly. And as far as I remember,
Johannes is the only person recently who has proactively disclosed that
his patches were AI-assisted. I appreciate that disclosure, so I was
simply pointing it out. Of course, I have no doubt about the quality of
his patches.

So what I mean is that we have already had cases where people
voluntarily disclosed their use of AI, but there did not seem to be much
discussion about it at the time. This time, Brian brought the issue up
for discussion, and I really appreciate both of you doing so.

Thanks.

[gitgitgadget]

Junio C Hamano wrote on the Git mailing list (how to reply to this email):

Weijie Yuan <wy@wyuan.org> writes:

>> We know Johannes well enough to trust that his patches were sent
>> with sufficient due diligence.  So...?
>
> <xmqqzeyeujde.fsf@gitster.g>:
>> If work submitted under a DCO later turns out to be based on
>> something we cannot legally use, the submitter may of course be in
>> trouble, but we would also need to bear the cost of ripping it out;
>> the later we discover the problem, the more substantial the effort
>> necessary to deal with the fallout will be.
>
> What I meant is that you said we should be wary of content that might
> carry legal risks,...

I am not sure what your point is.  Is there any part in "we trust
Dscho well enough to trust that he sent them with sufficient due
diligence" that was hard for you to understand?

[gitgitgadget]

Weijie Yuan wrote on the Git mailing list (how to reply to this email):

On Sun, Aug 23, 2026 at 06:49:49PM -0700, Junio C Hamano wrote:
> Weijie Yuan <wy@wyuan.org> writes:
> 
> >> We know Johannes well enough to trust that his patches were sent
> >> with sufficient due diligence.  So...?
> >
> > <xmqqzeyeujde.fsf@gitster.g>:
> >> If work submitted under a DCO later turns out to be based on
> >> something we cannot legally use, the submitter may of course be in
> >> trouble, but we would also need to bear the cost of ripping it out;
> >> the later we discover the problem, the more substantial the effort
> >> necessary to deal with the fallout will be.
> >
> > What I meant is that you said we should be wary of content that might
> > carry legal risks,...
> 
> I am not sure what your point is.  Is there any part in "we trust
> Dscho well enough to trust that he sent them with sufficient due
> diligence" that was hard for you to understand?

Apologies, and please forget it. I must be feeling dizzy.

Thanks.

[gitgitgadget]

Weijie Yuan wrote on the Git mailing list (how to reply to this email):

On Sun, Aug 23, 2026 at 06:49:49PM -0700, Junio C Hamano wrote:
> Weijie Yuan <wy@wyuan.org> writes:
> 
> >> We know Johannes well enough to trust that his patches were sent
> >> with sufficient due diligence.  So...?
> >
> > <xmqqzeyeujde.fsf@gitster.g>:
> >> If work submitted under a DCO later turns out to be based on
> >> something we cannot legally use, the submitter may of course be in
> >> trouble, but we would also need to bear the cost of ripping it out;
> >> the later we discover the problem, the more substantial the effort
> >> necessary to deal with the fallout will be.
> >
> > What I meant is that you said we should be wary of content that might
> > carry legal risks,...
> 
> I am not sure what your point is.  Is there any part in "we trust
> Dscho well enough to trust that he sent them with sufficient due
> diligence" that was hard for you to understand?

Sorry, I think I failed to make my actual question clear in my previous
replies.

I do understand, and agree with, your point that you trust Johannes to
have submitted his patches with sufficient due diligence. I was not
trying to question Johannes or your trust in him.

What I was trying to understand is how that fits with the particular DCO
concern being discussed here.

You pointed out that if something submitted under the DCO later turns
out to be based on material we cannot legally use, the project also
bears the cost of removing it, and that the fallout becomes worse the
later such a problem is discovered.

As I understand brian's concern, if a significant amount of a
contribution is generated by an AI tool, there may be uncertainty over
whether the submitter can make the DCO certification with sufficient
confidence.

That is why Johannes's existing commits with an Assisted-by trailer
came to mind. I am not claiming that those commits necessarily contain
AI-generated content of the kind brian is concerned about; I do not know
what the assistance actually consisted of.

But if the disclosed assistance did involve generated content of that
kind, wouldn't the same DCO question arise? And if we do not know
whether it did, isn't that the sort of question that, following your
point above, would be better clarified sooner rather than later?

At the same time, I can also see the point behind your:

"if you use one, do not tell us" ;-)

Thinking about it from that angle also makes me wonder about
Assisted-by trailers themselves. If I understand the point behind
"if you use one, do not tell us" correctly, then perhaps we should
simply not encourage Assisted-by: LLM trailers, since such a trailer
explicitly records the very fact that we might prefer the project not
to be told about.

Of course, I am simply worried that an Assisted-by trailer might
create some legal risk. I am not a lawyer, though, so I do not know
whether that concern is actually well-founded.

On the other hand, I can also understand why the kernel community made
a different trade-off and prefers disclosure. Knowing that a tool was
involved gives the maintainer additional information, and the maintainer
can then decide according to their own judgment whether that information
should affect how the patch is handled. (possibly there are other reasons)

That was what I was trying, rather unsuccessfully, to get at before. I
am sorry that my earlier replies made it sound as though I was singling
out Johannes as a problematic case.

Sorry again for the confusion and the noise.

Thanks,
Weijie

[gitgitgadget]

Junio C Hamano wrote on the Git mailing list (how to reply to this email):

Weijie Yuan <wy@wyuan.org> writes:

> What I was trying to understand is how that fits with the particular DCO
> concern being discussed here.

You may never be able to tell where the AI output came from, but you
can see if the updated code has resemblance to fixes we applied in
the past to correct similar problems, for example.  After all, you
yourself without help by AI can copy our code to your patch to
enhance our code, and that is perfectly legit.

Take for example 5fe676f448 (t1300: remove global config settings
injected by test-lib.sh, 2026-04-26) that added

      test_might_fail git config --global --unset-all safe.bareRepository

that clearly mimicked the tests that prepared the stage by clearing
a relevant configuration variable done in an earier 313eec177a
(safe.directory: allow "lead/ing/path/*" match, 2024-05-29).

By "sufficient due diligence", what I meant was that I trust Dscho
well enough that he's done a similar analysis to make sure that he
is copying from ourselves.

[gitgitgadget]

Junio C Hamano wrote on the Git mailing list (how to reply to this email):

Junio C Hamano <gitster@pobox.com> writes:

> By "sufficient due diligence", what I meant was that I trust Dscho
> well enough that he's done a similar analysis to make sure that he
> is copying from ourselves.

... or wrote things using what he learned from other places that are
OK to copy from (like code of BSD licensed projects).

[gitgitgadget]

Weijie Yuan wrote on the Git mailing list (how to reply to this email):

> Weijie Yuan <wy@wyuan.org> writes:
> 
> > What I was trying to understand is how that fits with the particular DCO
> > concern being discussed here.
> 
> You may never be able to tell where the AI output came from, but you
> can see if the updated code has resemblance to fixes we applied in
> the past to correct similar problems, for example.  After all, you
> yourself without help by AI can copy our code to your patch to
> enhance our code, and that is perfectly legit.
> 
> Take for example 5fe676f448 (t1300: remove global config settings
> injected by test-lib.sh, 2026-04-26) that added
> 
>       test_might_fail git config --global --unset-all safe.bareRepository
> 
> that clearly mimicked the tests that prepared the stage by clearing
> a relevant configuration variable done in an earier 313eec177a
> (safe.directory: allow "lead/ing/path/*" match, 2024-05-29).
> 
> By "sufficient due diligence", what I meant was that I trust Dscho
> well enough that he's done a similar analysis to make sure that he
> is copying from ourselves.

> ... or wrote things using what he learned from other places that are
> OK to copy from (like code of BSD licensed projects).

Ah, I see it clearly now. This could make us able to keep the
provenance of the patch under control.

Thanks so much for taking the time to give me this example and
explanation.  And very sorry for bringing Dscho into the discussion,
sorry.

Apologize for my recklessness.  Thank you very much.

[gitgitgadget]

This patch series was integrated into seen via git@2d4d0ad.

[gitgitgadget]

Oswald Buddenhagen wrote on the Git mailing list (how to reply to this email):

On Mon, Aug 24, 2026 at 09:06:21AM -0700, Junio C Hamano wrote:
>By "sufficient due diligence", what I meant was that I trust Dscho
>well enough that he's done a similar analysis to make sure that he
>is copying from ourselves.
>
i think the salient point is that it is never reasonable to make that assumption when an AI tool is used. some of the tools now reportedly detect themselves when they are outright plagiarizing (and identifying the tool in a trailer would actually give some assurance in that regard), but if the tool fails or doesn't have the feature in the first place, then all bets are off. Literally No-one (TM) will use multiple code search engines to check whether the generated code doesn't contain sufficiently large fragments that are (near-)verbatim copies from incompatibly licensed code bases.

[gitgitgadget]

User Oswald Buddenhagen <oswald.buddenhagen@gmx.de> has been added to the cc: list.

[gitgitgadget]

This branch is now known as as/utimensat-utimes.