linux-kernel - Re: [PATCH] samples: replace outdated permission statement with SPDX identifiers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171118101756.GA8368@kroah.com>
Date:   Sat, 18 Nov 2017 11:17:56 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Jonathan Corbet <corbet@....net>
Cc:     Martin Kepplinger <martink@...teo.de>, akpm@...ux-foundation.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] samples: replace outdated permission statement with SPDX
 identifiers

On Fri, Nov 17, 2017 at 03:53:53PM -0700, Jonathan Corbet wrote:
> On Thu, 16 Nov 2017 12:41:10 +0100
> Greg KH <gregkh@...uxfoundation.org> wrote:
> 
> > > I'll fold this in, in the thread here. I guess this change is what Greg
> > > had in mind? Or would you prefer having including SPDX and removing
> > > permission statement seperately?  
> > 
> > I have been doing them in 2 steps, but only because the files I modified
> > were in different "chunks" (i.e. add missing SPDX identifiers to a bunch
> > of files in a directory, and then the second patch would remove the
> > license identifiers for all files in that directory).  As that type of
> > patch flow doesn't make sense here, I think what you did was just fine.
> 
> So I'll confess to being a little worried about removing the boilerplate:
> 
> 	And it's important to notice that while adding a SPDX line should
> 	not really be controversial (as long as you get the license right,
> 	of course - Greg&co have the CSV files for everything, in case you
> 	want to check things you maintain), before removing the
> 	boiler-plate you really need to feel like you "own" the file.
> 	— Linus (https://lkml.org/lkml/2017/11/2/715)
> 
> Are we sure that we're not going to get in trouble with the people who do
> "own" those files if we rip out the boilerplate?  It would be good to have
> some clarity on when that can be done.

I have discussed this with many lawyers, and as SPDX is acknowledged as
a valid way to specify the license that a file is released under,
removing the "boilerplate" text is just fine according to all of them.

As a backup to this, I have verification from at the legal department of
at least one very large corporate copyright holder in the kernel that
this is fine with them, and they are glad to see this happen, as now we
will not have 700+ different ways to say "released under the GPL v2" in
the tree.  You can see one of the patch series on lkml where I say I got
their approval as proof.

So yes, this should be fine, but of course, ask the copyright holder of
the file when doing this.  I have been cc:ing the owners of the files
when I do this work, and have gotten no objections so far when doing
this work.

If anyone does object to this change, that's ok too.  I'll be glad not
to merge the patch that does this.  Which is why I have been splitting
the add-spdx and remove-boilerplate patches apart as they are two
different actions.

And if anyone wants me to talk to their lawyers about this, I'm more
than willing to do so, as for some reason I end up being the one doing
this a lot these days...

Hope this helps explain things better,

greg k-h