linux-kernel - Re: SPDX-License-Identifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 25 Feb 2015 16:00:47 -0600
From:	Felipe Balbi <balbi@...com>
To:	Pavel Machek <pavel@...x.de>
CC:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Stefan Roese <sr@...x.de>, <monstr@...str.eu>, <balbi@...com>,
	<linux-kernel@...r.kernel.org>, <devicetree@...r.kernel.org>,
	Wolfgang Denk <wd@...x.de>
Subject: Re: SPDX-License-Identifier

On Wed, Feb 25, 2015 at 10:49:51PM +0100, Pavel Machek wrote:
> Hi!
> 
> > > >Is one tag per directory sufficient?  Is one tag per file sufficient?
> > > >How about one tag per package?  If package, then isn't a single tag for
> > > >the whole kernel source tree sufficient, as we all know the overall
> > > >license for the kernel source tree.
> > > 
> > > We really need one tag per file.
> > 
> > I fail to see the justification for this, why?  Why not per directory?
> > Why not per function?  Why not per driver?  Why not per line?  Why not
> > per project?  Who has dictated this seemingly arbitrary rule?
> 
> That's how licenses are done today.
> 
> Why would I like to see SPDX?
> 
> So that GPL header at begining of each file becomes one line... and so
> that if it is BSD/GPL dual licensed is plain to see, and I don't have
> to read the notices saying "oh this is gpl.. but if you want to,
> delete gpl above and use license below".

why isn't git grep -e 'MODULE_LICENSE' enough ? It's also a single line
and gives you the license for that driver.

> > Our DCO process ensures that.
> > 
> > > - Some parts of the Linux source code are also used by other projects.
> > >   Or are derived from other projects. Because of this they are
> > >   explicitly licensed under different licenses than the GPLv2
> > >   (compatible to it though of course). Or are dual-licensed. So that
> > >   they can be used by these other projects.
> > 
> > That's fine, we encourage that and want to see that happen.  How will
> > SPDX change that at all?  It's obvious as to the license of the files
> > that this happens with, why do anything extra?
> 
> Well, sometimes parsing license agreements at the top of file is
> interesting, that's where SPDX would help, and that's why having
> single SPDX per linux kernel would not work.

if you can parse SPDX, why can't you parse MODULE_LICENSE() ?

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)