Skip to content

Commit 6a4e1b0

Browse files
jasonkatonicajasonkatonica
authored
Update AI contribution guidelines (#1388)
Clarifies that Bob is the only approved AI tool for contributions. Updates both README.md and AI_CONTRIBUTIONS.md to reflect: - Bob is the only permitted AI tool - Simplified validation and review requirements - Added comprehensive warnings and limitations. Back-ported from: #1372 Signed-off-by: Jason Katonica <katonica@us.ibm.com>
1 parent 6bdf141 commit 6a4e1b0

2 files changed

Lines changed: 182 additions & 17 deletions

File tree

‎README.md‎

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -568,20 +568,9 @@ The following contribution guidelines should be followed:
568568

569569
1. A pull request should be sent for review only after the github action associated with this repository is automatically executed when a pull request is created.
570570

571-
1. AI generated code is NOT allowed in the main line cryptographic code (i.e. All code in OpenJCEPlus/src/main directory). However, it maybe used for test code. If GenAI code is used it must be tagged. The begin tag needs to indicate the GenAI tool used to create the code.
572-
573-
Here are more guidelines:
574-
575-
- All code that incorporates any output from GenAI tool must be tagged regardless of whether the tag automatically appears in the output or you are manually re-typing GenAI output
576-
577-
- This applies to all GenAI outputs regardless of the use case.
578-
579-
- You MUST validate that the use of the GenAI tool does not produce protected code (i.e. code that is copyrighted or licensed outside of our project's current licenses).
580-
581-
An example of a tagging would be:
582-
583-
```console
584-
/* Start code generated by <GenAI tool> */
585-
586-
/* End code generated by <GenAI tool> */
587-
```
571+
1. **AI-Assisted Contributions**: We welcome the use of **[Bob](https://bob.ibm.com/)** (the only approved AI tool at this time) throughout the codebase. All Bob-assisted contributions must be properly validated. See our comprehensive [AI Contributions Guide](docs/AI_CONTRIBUTIONS.md) for detailed requirements including:
572+
- **APPROVED TOOL**: Only **[Bob](https://bob.ibm.com/)** is permitted - other AI tools are not allowed
573+
- Legal compliance and validation procedures
574+
- Security considerations for cryptographic code
575+
- Best practices for AI-assisted development
576+
- Code review process for Bob-assisted contributions

‎docs/AI_CONTRIBUTIONS.md‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
# AI-Assisted Contributions Guide
2+
3+
## Overview
4+
5+
This document outlines the guidelines and requirements for contributions that involve AI-generated code in the OpenJCEPlus project. We welcome the use of AI tools to enhance productivity and code quality, while maintaining strict standards for validation and legal compliance.
6+
7+
## General Policy
8+
9+
**AI-generated code is permitted throughout the codebase** with proper validation. All AI-assisted contributions must follow the guidelines outlined in this document to ensure code quality, security, and legal compliance.
10+
11+
**APPROVED AI TOOL**: At this time, only **[Bob](https://bob.ibm.com/)** is approved for use in this project. Use of other AI tools is not permitted.
12+
13+
## Core Principles
14+
15+
While we embrace AI assistance, contributors must ensure:
16+
17+
- **Security**: All code, especially cryptographic implementations, must be thoroughly reviewed and tested
18+
- **Compliance**: Code must be compatible with our project licenses and standards
19+
- **Legal Protection**: AI-generated code must not reproduce copyrighted or improperly licensed code
20+
- **Maintainability**: Code must be clear, well-documented, and understandable by human maintainers
21+
- **Accountability**: Contributors remain fully responsible for all submitted code, regardless of how it was generated
22+
23+
## Where AI Assistance May Be Used
24+
25+
[Bob](https://bob.ibm.com/) may be used for:
26+
27+
- **Cryptographic implementations** (with rigorous validation and testing)
28+
- **Test code and test utilities**
29+
- **Build scripts and automation**
30+
- **Documentation generation and improvement**
31+
- **Code refactoring and optimization**
32+
- **Bug fixes and enhancements**
33+
- **Native interface code (JNI implementations)**
34+
- **Any code in the project**
35+
36+
## Validation Requirements
37+
38+
Before submitting any AI-generated code, you MUST:
39+
40+
### 1. Verify Legal Compliance
41+
42+
- Ensure the code is not copyrighted or licensed outside our [project's license](../LICENSE)
43+
- Check that the code doesn't reproduce proprietary implementations
44+
- Confirm Bob's terms of service allow commercial use and redistribution
45+
- Verify no patent or trademark violations
46+
47+
### 2. Review for Correctness
48+
49+
- **Thoroughly understand** all AI-generated code before submitting
50+
- Test extensively across all supported platforms
51+
- Verify it follows project coding standards ([../style.xml](../style.xml) for Java, [.clang-format](../.clang-format) for C)
52+
- Ensure it doesn't introduce security vulnerabilities
53+
- For cryptographic code: verify against known test vectors and standards
54+
55+
### 3. Security Validation
56+
57+
- Review for common vulnerabilities (buffer overflows, injection attacks, etc.)
58+
- Ensure proper error handling and input validation
59+
60+
### 4. Run All Tests
61+
62+
- Ensure all existing tests pass
63+
- Add appropriate test coverage for new functionality
64+
- Verify the code works across all supported platforms:
65+
- Linux (aarch64, amd64, s390x, ppc64le)
66+
- Windows (amd64)
67+
- AIX (ppc64)
68+
- Mac OS X (aarch64, amd64)
69+
- z/OS
70+
- Run performance benchmarks if applicable
71+
72+
## Code Review Process
73+
74+
Pull requests containing AI-generated code will undergo thorough review:
75+
76+
### 1. Automated Checks
77+
78+
- CI/CD pipeline must pass all tests
79+
- Code style checks must pass ([../checkstyle.xml](../checkstyle.xml) for Java, [.clang-format](../.clang-format) for C)
80+
- All platforms must build successfully
81+
82+
### 2. Manual Review
83+
84+
- Verify that only Bob was used (no other AI tools)
85+
- Legal compliance will be assessed
86+
- Code quality and correctness will be evaluated
87+
- Security implications will be carefully reviewed
88+
- For cryptographic code: additional scrutiny for correctness and standards compliance
89+
90+
### 3. Documentation Review
91+
92+
- Ensure all code is properly documented
93+
- Verify code follows project documentation standards
94+
95+
## Best Practices
96+
97+
### DO:
98+
99+
- ✅ Use Bob to enhance productivity and code quality
100+
- ✅ Thoroughly understand and review all Bob-generated code
101+
- ✅ Test extensively on all supported platforms
102+
- ✅ Verify cryptographic implementations against standards and test vectors
103+
- ✅ Follow project coding standards and conventions
104+
- ✅ Add comprehensive test coverage
105+
- ✅ Document your code clearly
106+
107+
### DON'T:
108+
109+
- ❌ Copy-paste Bob code without understanding it
110+
- ❌ **Use any AI tool other than Bob**
111+
- ❌ Assume Bob-generated code is correct without verification
112+
- ❌ Skip testing on any supported platform
113+
- ❌ Submit code that violates licenses or copyrights
114+
- ❌ Ignore security warnings or vulnerabilities
115+
- ❌ Forget to validate cryptographic implementations
116+
117+
## Special Considerations for Cryptographic Code
118+
119+
When using Bob for cryptographic implementations:
120+
121+
2. **Test Vectors**: Validate using known test vectors from standards documents
122+
3. **Side-Channel Resistance**: Review for timing attacks and other side-channel vulnerabilities
123+
4. **Error Handling**: Ensure proper error handling that doesn't leak sensitive information
124+
5. **Memory Management**: Verify proper cleanup of sensitive data
125+
6. **Peer Review**: Cryptographic code should receive additional review from security experts
126+
127+
## Consequences of Non-Compliance
128+
129+
Failure to follow these guidelines may result in:
130+
131+
- Pull request rejection
132+
- Request to remove code generated by unauthorized AI tools
133+
- Delays in code review and acceptance
134+
- In severe cases, contributor access restrictions
135+
136+
## Reporting Issues
137+
138+
If you discover:
139+
140+
- Use of unauthorized AI tools (anything other than Bob)
141+
- Potential license violations
142+
- Security vulnerabilities in AI-generated code
143+
- Code that doesn't meet project standards
144+
145+
Please report it immediately by:
146+
147+
1. Opening an issue in the project repository
148+
2. Contacting project maintainers directly
149+
3. Following our [security policy](../SECURITY.md) for security issues
150+
151+
## Questions?
152+
153+
If you're unsure whether your use of Bob complies with these guidelines:
154+
155+
1. Ask in the pull request comments before submitting
156+
2. Remember: only Bob is approved - do not use other AI tools
157+
3. Consult with project maintainers
158+
4. Review this document and related project policies
159+
160+
## Updates to This Policy
161+
162+
This policy may be updated as AI tools and best practices evolve. Contributors are responsible for staying current with the latest version of this document. Check the git history of this file for recent changes.
163+
164+
## Additional Resources
165+
166+
- [Bob - IBM's AI Assistant](https://bob.ibm.com/)
167+
- [Project License](../LICENSE)
168+
- [Notices and Attributions](../NOTICES.md)
169+
- [Security Policy](../SECURITY.md)
170+
- [Java Style Guide](../style.xml)
171+
- [C Style Guide](../.clang-format)
172+
- [Contributing Guidelines](../README.md#contributions)
173+
174+
---
175+
176+
**Remember**: AI is a tool to enhance your work, not replace your responsibility. You remain fully accountable for all code you submit, regardless of how it was generated. When in doubt, ask!

0 commit comments

Comments
 (0)