linux-kernel - Re: Adding LICENSES folder for REUSE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 11 Nov 2017 23:29:40 +0100
From:   Charlemagne Lasse <charlemagnelasse@...il.com>
To:     Jonas Oberg <jonas@...e.org>
Cc:     linux-kernel@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        carmenbianca@...e.org,
        Masahiro Yamada <yamada.masahiro@...ionext.com>
Subject: Re: Adding LICENSES folder for REUSE

Hi,

2017-11-11 22:21 GMT+01:00 Jonas Oberg <jonas@...e.org>:
> I wouldn't do that now. Adding SPDX license identifiers is in most cases
> quite sufficient and something which I would encourage first.
>
> What you mention about the LICENSES/ folder and the License-Filename
> tag (which can be repeated) is an addition which is a bit more specific,
> especially for BSD licenses where the SPDX license identifier alone does
> not convey information about the specific "attribution requirement" of
> each licensor.
>
> Most often though, as you find the BSD licenses in the source code headers,
> we wouldn't want the license text separated from them, and it would be
> contrary to the REUSE principles to do so.

Thank you for the fast reply. Just as summary:

1. SPDX license identifier first
2. Full BSD/MIT/ISC license in source files is sufficient and don't
   require License-Filename
3. verbatim licenses which are not in source files (GPL, LGPL, MPL, ...)
   should be in LICENSES/
4. License-Filename tag can be added later and multiple are allowed per
   file

If this understanding is correct then I would still propose that the
LICENSES folder is prepared with the previously identified long licenses
(which are currently not stored completely in the source files):

mkdir LICENSES
curl -o LICENSES/GPL-1.0.txt https://www.gnu.org/licenses/gpl-1.0.txt
curl -o LICENSES/GPL-2.0.txt https://www.gnu.org/licenses/gpl-2.0.txt
curl -o LICENSES/MPL-1.1.txt
https://www.mozilla.org/media/MPL/1.1/index.0c5913925d40.txt
curl -o LICENSES/LGPL-2.0.txt https://www.gnu.org/licenses/lgpl-2.0.txt
curl -o LICENSES/LGPL-2.1.txt https://www.gnu.org/licenses/lgpl-2.1.txt

$EDITOR COPYING
# change file to reference LICENSES/GPL-2.0.txt ?

git add LICENSES COPYING
git commit

Thanks,
Charlemagne Lasse