This Open Source Software Was Used in Ukraine's Drone Attack on Russia
Is this a turning point for open source software in warfare?
A new Linux kernel drama? Yes, but it's been handled.
By now, you already know that Linux kernel development is a massive undertaking that's carried out by thousands of contributors, and more often than not, tensions rise, leading to some mean things being said.
I like to think of such happenings as just part of the process when dealing with a huge and complex project like Linux.
A recent event serves as a reminder of just how intense things can be.
Linus to patches that mess with the Linux kernel.
Expressing concern over a kernel contributor’s tree (a set of patches), Linus Torvalds reprimanded Kees Cook for submitting 330 pull requests that copied Torvalds’ own patches and re-listed him as the author.
He called the move "actively malicious", pointing to fake merge commits that included incorrect SHA-1 signatures. For instance, a legitimate patch by Torvalds had a SHA1 beginning with 9d230d500b0e
, while the duplicate/fake version submitted by Kees used f8b59a0f90a2
.
Linus' original pull request on the left, the fake one on the right.
Soon after, Kees clarified what might have gone wrong, attributing the issue to a faulty SSD that had thrown errors during data transfer, resulting in corrupt trees and broken merges. He apologized and agreed to get rid of the affected tree and committed to rebuilding the patch set cleanly before resubmitting.
Still, Linus remained skeptical of Kees’ explanation, doubting that such a massive rewrite of commits could have happened unintentionally. He noted that, under normal circumstances, Git would correctly update the committer information during merge rebasing, suggesting that some form of scripting (read automation) was likely involved.
Kees, again, clarified that he didn't do it deliberately, mentioning that a combination of a failing SSD, a tricky manual rebase, and some overridden checks caused this.
After some back and forth in between Kees, Linus and Konstantin Ryabitsev, it was clear that the root cause was an unintended rewrite of committer information by the B4 tool, which erroneously altered commit metadata during history rewriting.
Thanks to the 'mostly civil' and very constructive communication among all the parties involved, the issue was dealt with, and in all this, one thing was made clear: Linus Torvalds is the vigilant guardian of the Linus kernel, someone who, while easily angered, is always watching.
You can check out the whole thread if you want to dig into the details.
Suggested Read 📖
Stay updated with relevant Linux news, discover new open source apps, follow distro releases and read opinions