Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 6 Jul 2021 20:41:54 +0200
From:   Kroah-Hartman <greg@kroah.com>
To:     Norbert Manthey <nmanthey@amazon.de>
Cc:     LKML <linux-kernel@vger.kernel.org>,
        "Woodhouse, David" <dwmw@amazon.co.uk>,
        "foersleo@amazon.de" <foersleo@amazon.de>,
        Gustavo Pimentel <gustavo.pimentel@synopsys.com>,
        "Gustavo A. R. Silva" <garsilva@embeddedor.com>,
        Kees Cook <keescook@chromium.org>,
        Thomas Gleixner <tglx@linutronix.de>
Subject: Re: Coverity Scan model file, license, public access
Message-ID: <YOSj8kjDtjmUtcVP@kroah.com>
References: <d7f096ee-7a9b-684e-433a-f8f3f0e6288d@amazon.de>
 <YOSKuEcPoy/dw0st@kroah.com>
 <6f1cb856-fc72-cfd1-9bdd-b4dbf58c558c@amazon.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <6f1cb856-fc72-cfd1-9bdd-b4dbf58c558c@amazon.de>
Precedence: bulk

On Tue, Jul 06, 2021 at 08:34:16PM +0200, Norbert Manthey wrote:
> With respect to sharing the results: we are allowed to upstream fixes
> that we find with the tool. We contributed in that way already, e.g. [2].

Yes, that is how many companies do this and have for a long time
(Canonical does this a lot).  But that puts all the work on you, and you
can not share the results of the tool with anyone, so you are forced to
do the work to fix problems the tool reports, which feels really wrong
when you are dealing with a scan of a public source tree...

thanks,

greg k-h