linux-kernel - Re: [patch V4 01/11] Documentation: Add license-rules.rst to describe how to properly identify file licenses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20171205065003.GB7782@osiris>
Date:   Tue, 5 Dec 2017 07:50:03 +0100
From:   Heiko Carstens <heiko.carstens@...ibm.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...uxfoundation.org>,
        Andrew Morton <akpm@...uxfoundation.org>,
        Jonathan Corbet <corbet@....net>,
        Kate Stewart <kstewart@...uxfoundation.org>,
        Philippe Ombredanne <pombredanne@...b.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Christoph Hellwig <hch@....de>,
        Russell King <rmk+kernel@...linux.org.uk>,
        Rob Herring <rob.herring@...aro.org>,
        Jonas Oberg <jonas@...e.org>, Joe Perches <joe@...ches.com>,
        linux-xfs@...r.kernel.org,
        Charlemagne Lasse <charlemagnelasse@...il.com>,
        Carmen Bianca Bakker <carmenbianca@...e.org>
Subject: Re: [patch V4 01/11] Documentation: Add license-rules.rst to
 describe how to properly identify file licenses

On Mon, Dec 04, 2017 at 10:19:28PM +0100, Thomas Gleixner wrote:
> +3. Syntax:
> +
> +   A <SPDX License Expression> is either an SPDX short form license
> +   identifier found on the SPDX License List, or when multiple licenses
> +   apply, an expression consisting of keywords "AND", "OR", and "WITH"
> +   separating SPDX short form license identifiers surrounded by "(", ")".

Here it is stated that SPDX identifiers using the keyword WITH must be
surrounded by braces.

> +      // SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note)
> +      // SPDX-License-Identifier: (GPL-2.0+ WITH Linux-syscall-note)

Just like this example.

> +   File format examples::
> +
> +      SPDX-Exception-Identifier: Linux-syscall-note
> +      SPDX-URL: https://spdx.org/licenses/Linux-syscall-note.html
> +      SPDX-Licenses: GPL-2.0, GPL-2.0+, GPL-1.0+, LGPL-2.0, LGPL-2.0+, LGPL-2.1, LGPL-2.1+
> +      Usage-Guidance:
> +        This exception is used together with one of the above SPDX-Licenses
> +	to mark user-space API (uapi) header files so they can be included
> +	into non GPL compliant user-space application code.
> +        To use this exception add it with the keyword WITH to one of the
> +	identifiers in the SPDX-Licenses tag:
> +	  SPDX-License-Identifier: <SPDX-License> WITH Linux-syscall-note

But here it comes without braces.

> +      Exception-Text:
> +        Full exception text
> +
> +   ::
> +
> +      SPDX-Exception-Identifier: GCC-exception-2.0
> +      SPDX-URL: https://spdx.org/licenses/GCC-exception-2.0.html
> +      SPDX-Licenses: GPL-2.0, GPL-2.0+
> +      Usage-Guidance:
> +        The "GCC Runtime Library exception 2.0" is used together with one
> +	of the above SPDX-Licenses for code imported from the GCC runtime
> +	library.
> +        To use this exception add it with the keyword WITH to one of the
> +	identifiers in the SPDX-Licenses tag:
> +	  SPDX-License-Identifier: <SPDX-License> WITH GCC-exception-2.0

Here as well.

The whole kernel now got SPDX-License-Identifiers that look like this:

SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note

So this looks inconsistent to me, or did I miss something?