There's finally some clarity around the "compliance requirements" for the Linux kernel and comes down to sanctioned individuals/organizations. Serge Semin was one of the impacted Russian Linux developers who has maintained kernel code Russia's Baikal hardware, the libata Synopsys DWC controller driver, various media drivers, and more. Serge wrote a lengthy goodbye message to the Linux kernel community . He was surprised by his removal as a maintainer, especially after he's provided 518 sign-offs for kernel patches, 253 reviewed/ack'ed patches, and another 80 tested-by patches over the years. He concluded his mailing list remarks with:
"Hope we'll meet someday in more pleasant circumstances and drink a couple or more beers together. But now it's time to say good bye. Sorry for a long-read text. I wish good luck on your Linux-way."
Serge Semin he hadn't been able to get a response over the new "compliance requirements" for the kernel or much insight into the matter. Veteran Linux kernel developer James Bottomley has now chimed in on that mailing list thread with some clarity into the new requirements . James wrote:
"Please accept all of our apologies for the way this was handled. A summary of the legal advice the kernel is operating under is
###
If your company is on the U.S. OFAC SDN lists, subject to an OFAC sanctions program, or owned/controlled by a company on the list, our ability to collaborate with you will be subject to restrictions, and you cannot be in the MAINTAINERS file.
###
Anyone who wishes to can query the list here:
https://sanctionssearch.ofac.treas.gov/
In your specific case, the problem is your employer is on that list. If there's been a mistake and your employer isn't on the list, that's the documentation Greg is looking for.
I would also like to thank you for all your past contributions and if you (or anyone else) would like an entry in the credit file, I'm happy to shepherd it for you if you send me what you'd like.
Again, we're really sorry it's come to this, but all of the Linux infrastructure and a lot of its maintainers are in the US and we can't ignore the requirements of US law. We are hoping that this action alone will be sufficient to satisfy the US Treasury department in charge of sanctions and we won't also have to remove any existing patches."
That legal advice relayed in the message is just around MAINTAINERS entries and still not clear, for example, if patches from Russian Linux developers are okay as long as they remain not within the MAINTAINERS file. But the details do at least make clear that they are checking against the US OFAC sanctions program for individuals/organizations.
As for the delay in recognizing these sanctions in the scope of the Linux kernel, Bottomley wrote in a follow-up message:
"A big chunk of the reason it's taken so long just to get the above is that the Lawyers (of which I'm not one) are still discussing the specifics and will produce a much longer policy document later, so they don't want to be drawn into questions like this. However, my non-legal-advice rule of thumb that I'm applying until I hear otherwise is not on the SDN list, not a problem."
It's too bad all of this context was missing from the start when the original patch was posted and merged.