Git maintainers debate DCO validity for AI-generated patches

Git contributor Alexey Samsonov submitted patches to stop using the legacy utime() call for setting file timestamps, an interface POSIX.1-2024 has removed. The change moves Git to utimensat() by default, with a utimes() fallback and Windows support, so the project keeps working as older library shims fade and newer C libraries omit utime entirely. Samsonov wrote that Gemini Flash from Antigravity generated the series, after which he manually verified and adjusted it.

Brian m. carlson declined to read the patches. Citing Git's SubmittingPatches guidance, he argued the Developer's Certificate of Origin requires contributors to know the origin of their work and that it remains unclear this certification can cover a significant amount of AI-generated content. He said he avoided the code so as not to be influenced by material the project may not be allowed to include.

Maintainer Junio C Hamano backed that caution. A false DCO claim is not only the submitter's problem, he wrote: the project still bears the cost of ripping out tainted code, and the later the discovery the harder the cleanup. Carlson added that large language models sometimes regurgitate training inputs and that active litigation leaves the legal status of their output unsettled.

The exchange also touched earlier commits that already reached the mainline with Assisted-by trailers. Hamano said those were accepted because the project trusts the author to have checked that the result did not improperly copy incompatible sources. Oswald Buddenhagen replied that such an assumption is never reasonable once an AI tool is involved, because no one systematically searches generated output for near-verbatim fragments from other codebases.

The technical case for leaving utime() is straightforward. The open question is how Git will treat openly disclosed AI authorship under its existing DCO rules.