Sorry to spread FUD, I was under the impression that non-OSI compliant licenses sometimes made this requirement, but I can't find any actual examples so maybe it was an overly cautious question I was always answering 'no' to to get import approval.
> it's up to Goldman (and the terms of the license).
It is really up to the license, Goldman either selected licenses where they could legally avoid sending upstream changes or planned to violate the law in secrecy. If they did the latter on just one license, then he should qualify as a whistle blower.