On 8 Oct 2026, at 05:49, Scott Chacon [off-list ref] wrote:
On Wed, Oct 7, 2026 at 11:42 PM brian m. carlson
[off-list ref] wrote:
quoted
On 2026-10-07 at 14:29:54, Scott Chacon wrote:
I don't think I'm in favour of this policy. All the major models have
been trained on a large variety of code from a large variety of sources,
including sources such as news reports or personal websites that do not
allow copying, modification, or distribution. Given that LLMs are known
to reproduce portions of their training set or craft code or text which
is very similar to items in the training set, how can anyone honestly
assert the DCO without knowing all of the sources that were used to
create it?
I agree that generated output can reproduce material we don't have
permission to distribute (though I think this is incredibly rare for
anything complex). What I question is whether that possibility means
knowing every source in the training set is necessary to make any DCO
certification.
Human contributors have also read code under many different licenses
(and news articles and blogs) . We don't ask them to account for
everything they've ever read before signing off on a patch.
There is a difference between “learning from existing code” which builds up
experience and professional capability and “copy & pasting” code from different
sources and putting it together.
The first (learning from existing code) is a product of whoever writes the
code, based on its mental model and experience developed, the second is a simple
violation of the contribution guidelines.
Where AI stays? LLMs are a simple processing of a large amount of code
for statistically detecting which part of the copy need to be copy&pasted
and blended together. Even though they had a “learning” path in terms of
developing an understanding and building a mental model (they don’t, at
least at the moment), *THEY* would be the author of the code, not the
person that just “pressed the button” on the AI model.
Should we use fully-generated AI contributions? When “fully-generated”
means code that has been totally written and reviewed by agents autonomously,
then I believe the answer should be a sound no, even just for the
lack of a legal framework around it on who is taking the responsibility
of what has been contributed.
We do
expect them to have the right to submit the actual contribution and to
respect the licenses of material they incorporate. Again, Red Hat, the
Linux Foundation and the SFC all now state that LLM generated code is
acceptable and compatible with DCO requirements.
Do you have a link to their exact statement?
Do they really allow *fully AI generated* code contributions where the
human has no understanding of the lines of code generated?
If that was the case, how can you manage a review of code that wasn’t
fully guided and understood by the author? Are you foreseeing an agent
answering the mailing list to the comments of the reviewers?
Even though we would allow *fully* AI-generated code, who is really
the contribution from? The “assumed human author”? The LLM?
The data that LLM is trained on? The company that developed the LLM?
Nobody?
Also, imagine that the code generated *did contain* malicious
backdoors, who is liable for it?
There are currently lawsuit in progress against companies that have
trained LLMs on allegedly copyrighted material, we don’t know yet
where they’ll end up to.
quoted
I'm a distributor of Git and I don't want to be sued or arrested because
I end up distributing code that I don't have the right to distribute.
Large companies may have lawyers and lots of money to fight those
claims, but I do not (nor does the Git project) and I don't want to
spend my resources fighting allegations of copyright infringement or
have my reputation besmirched for that reason. Just because other
projects think it's okay to do legally and ethically questionable things
doesn't mean we should as well.
Again, a lot of my argumentation here was directly taken from the
SFC's recommendations [1], which Git is a member project of.
https://sfconservancy.org/llm-gen-ai/llm-backed-generative-ai-recommendations.html
I am fully aligned and in agreement with SFC’s recommendations, which is
very much aligned with my thinking.
If you are the author of the code, even if was created with the assistance of
of LLMs, then you are fully responsible for each and every line of it and you
must understand it and approve it yourself.
I personally use LLMs *a lot* for giving me ideas and reviewing my code
or learning about something new that I never explored before. The end goal
of LLMs for me is to improve my capabilities as a developer, not to generate
contributions on my behalf.
My success criteria after having used LLMs is: I am a better developer now?
Am I more capable of writing better software and having a deeper understanding of
existing code?
P.S. My comment was 100% human-generated, including spelling mistakes
and awkward expressions (I’m not mother tongue).
Luca.
quoted
I'll add that if Git were to include a portion of my MIT- or
BSD-licensed code without including a copyright or permission notice
because it was laundered through an LLM, I would absolutely file a
copyright complaint, and rightfully so.
I refer you to policies from other major open source projects that cover
this exact provenance issue:
* Gentoo: https://wiki.gentoo.org/wiki/Project:Council/AI_policy
* NetBSD: https://www.netbsd.org/developers/commit-guidelines.html
I'm not saying that other projects haven't taken positions as
conservative as Git's current policy. I'm saying that much larger
projects with much larger legal surface area such as Linux have
adopted more progressive ones. Linus is fine with it on a project with
the same DCO, the same license, and honestly, a lot more legal
scrutiny.
quoted
I also will point out the notes from the Contributor Summit where we
discussed this issue in some depth and proposed an approach for further
discussion.
It was unclear from the notes what a "vote" meant exactly. It looked
like Taylor was roughly tasked with providing a Linux-style position,
so I thought I would help out by providing a first version of that
position.
This was written to follow the current SFC guidelines. I would
encourage Junio to have them read it, but I tried my best to follow
it's guidelines and advice.
Scott