linux-kernel - Re: [PATCH] USB: add SPDX identifiers to all files in drivers/usb/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 Oct 2017 12:36:07 +0200
From:   Philippe Ombredanne <pombredanne@...b.com>
To:     Rob Herring <rob.herring@...aro.org>
Cc:     "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Kate Stewart <kstewart@...uxfoundation.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [PATCH] USB: add SPDX identifiers to all files in drivers/usb/

Rob:

On Sat, Oct 21, 2017 at 9:48 AM, Greg Kroah-Hartman
<gregkh@...uxfoundation.org> wrote:
> On Fri, Oct 20, 2017 at 10:26:22AM -0500, Rob Herring wrote:
>> On Thu, Oct 19, 2017 at 3:38 AM, Greg Kroah-Hartman
>> <gregkh@...uxfoundation.org> wrote:
>> > It's good to have SPDX identifiers in all files to make it easier to
>> > audit the kernel tree for correct licenses.  This patch adds these
>> > identifiers to all files in drivers/usb/ based on a script and data from
>> > Thomas Gleixner, Philippe Ombredanne, and Kate Stewart.
>> >
>> > Cc: Thomas Gleixner <tglx@...utronix.de>
>> > Cc: Kate Stewart <kstewart@...uxfoundation.org>
>> > Cc: Philippe Ombredanne <pombredanne@...b.com>
>> > Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
>> > ---
>> > Unless someone really complains, I'm going to add this to my tree for
>> > 4.15-rc1.
>>
>> Glad to see this. I've been suggesting folks use SPDX tags on dts
>> files as those are often dual licensed, so we have lots of license
>> boilerplate. But I've had some push back[1] but it's not something I
>> care to spend cycles on. It would be good to have some statement on
>> the use of tags. Anything new should use them (I can dust off my
>> checkpatch.pl check for this)? This is a good task for newbies? It's
>> each maintainer's decision? It's the copyright holder's (and their
>> lawyer's) decision?
>
> As for what type of a task this is, we have a script and a huge database
> that has been worked on by some people to make a lot of this pretty
> "automatic" to apply.

I am one of the people that worked on scanning kernels for licenses
using my scancode tool [1] to help there.

Regarding checkpatch.pl and tooling to help review patches I can think of
two things:

1. when there is SPDX identifier in a patch, it could be checked for validity
I have a library for this [2] (this is in Python not Perl) but the checks needed
should be fairly trivial since there is not an open number of license
variations in the kernel: this could be re-written in Perl alright.

2. scancode can detect the licenses fairly accurately to spit and suggest
an SPDX license identifier and/or provide input to remove boilerplate either
for new patches or existing code. Not sure how to best integrate this as a
patch check step. Docs? Server-side tool? Any idea?

What would be the best thing to do next?

[1] https://github.com/nexB/scancode-toolkit
[2] https://github.com/nexB/license-expression/
-- 
Cordially
Philippe Ombredanne