bug#81520: Add pre-receive hook to Savannah to reject LLM-encumbered commits

On 7/29/2026 11:15 PM, Eli Zaretskii wrote:
>> Cc: [email protected]
>> Date: Wed, 29 Jul 2026 18:54:13 -0700
>> From: Jim Porter <[email protected]>
>>
>> # A list of LLM-associated email addresses to reject.
>> BAD_EMAILS="\
>> [email protected]
>> [email protected]
>> [email protected]"
> 
> IMNSHO, this is not the best way of doing this, far from it.  We don't
> want to start an "arms race" of having all the LLM-based agents in our
> hooks, definitely not based on their email addresses, which can change
> without notice.
I spent a little while researching options here, and the most common 
annotation is "Co-Authored-By: Some LLM <[email protected]>" followed 
by "Assisted-By: Some LLM". (The perhaps controversially named Kompromat 
site[1] links many examples and describes their detection criteria, 
which I've used as the basis of my implementation.)

Unfortunately, in the Co-Authored-By case, ordinary humans are often 
co-authors, and there are a few commits in GNU Emacs master that already 
use Co-Authored-By to indicate multiple people worked on the commit. I 
think this is generally a good practice, since it makes the copyright 
situation explicit when multiple people have done legally-significant 
amounts of work in a single commit.

If we want to permit using Co-Authored-By to list people, then I think 
the only option for detecting LLMs is using their email addresses. 
Luckily, the addresses themselves seem to be stable, though of course 
this list only covers the most popular options. That said, the vast 
majority of money spent on SaaSS LLMs goes to one of the listed providers.

> Using 'index' can easily cause false positives, as it only matches the
> prefix of a string.  If we are going to look for specific addresses
> (which I hope we won't), we will need as more accurate method of
> matching.

Sounds good to me. I can make the logic here more precise, assuming we 
agree that checking email addresses is the least-bad option.

>>            if (status == 0) {
>>              print("LLM-encumbered commits found in \'" ref "\'")
>>              print("Please remove the following commits and try again:")
> 
> This should be worded differently, something like
> 
>    Commits found in $REF seem to be LLM-assisted
> 
> It should also show the specific lines that caused this conclusion,
> since the user doesn't (and shouldn't) know what are the patterns we
> look for, and there seems to be no simple way to identify the parts of
> the commit that trigger the rejection.  Bonus points for having some
> way of asking for the phrases or strings which should not appear in
> the log message.

Will do. Thanks for taking a look at this.

[1] https://asta.boserup.eu/forest/kompromat