linux-kernel - Re: [patch V4 01/11] Documentation: Add license-rules.rst to describe how to properly identify file licenses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 8 Dec 2017 16:29:12 +0100
From:   Philippe Ombredanne <pombredanne@...b.com>
To:     Heiko Carstens <heiko.carstens@...ibm.com>,
        Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...uxfoundation.org>,
        Andrew Morton <akpm@...uxfoundation.org>,
        Jonathan Corbet <corbet@....net>,
        Kate Stewart <kstewart@...uxfoundation.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Christoph Hellwig <hch@....de>,
        Russell King <rmk+kernel@...linux.org.uk>,
        Rob Herring <rob.herring@...aro.org>,
        Jonas Oberg <jonas@...e.org>, Joe Perches <joe@...ches.com>,
        xfs <linux-xfs@...r.kernel.org>,
        Charlemagne Lasse <charlemagnelasse@...il.com>,
        Carmen Bianca Bakker <carmenbianca@...e.org>
Subject: Re: [patch V4 01/11] Documentation: Add license-rules.rst to describe
 how to properly identify file licenses

On Tue, Dec 5, 2017 at 7:50 AM, Heiko Carstens
<heiko.carstens@...ibm.com> wrote:
> On Mon, Dec 04, 2017 at 10:19:28PM +0100, Thomas Gleixner wrote:
>> +3. Syntax:
>> +
>> +   A <SPDX License Expression> is either an SPDX short form license
>> +   identifier found on the SPDX License List, or when multiple licenses
>> +   apply, an expression consisting of keywords "AND", "OR", and "WITH"
>> +   separating SPDX short form license identifiers surrounded by "(", ")".
>
> Here it is stated that SPDX identifiers using the keyword WITH must be
> surrounded by braces.

Heiko:
Darn! you have eagle eyes! Good catch. Thanks you++

Thomas:
The parens are not required in SPDX license identifiers and they only
(weakly) make sense when using expressions with OR and AND and not
for WITH expressions (which is a mouthful... don't we all love a bit
of boolean chat?).

Therefore I suggest to update the text above this way:

A <SPDX License Expression> is either an SPDX short form license
identifier found on the SPDX License List, or the combination of two
SPDX short form license identifiers separated by "WITH" when a license
exception applies. When multiple licenses apply, an expression
consists of keywords "AND", "OR" separating sub-expressions and
surrounded by "(", ")" .

>> +      // SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note)
>> +      // SPDX-License-Identifier: (GPL-2.0+ WITH Linux-syscall-note)
>
> Just like this example.

Thomas, this should become:

      // SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
      // SPDX-License-Identifier: GPL-2.0+ WITH Linux-syscall-note

>> +   File format examples::
>> +
>> +      SPDX-Exception-Identifier: Linux-syscall-note
>> +      SPDX-URL: https://spdx.org/licenses/Linux-syscall-note.html
>> +      SPDX-Licenses: GPL-2.0, GPL-2.0+, GPL-1.0+, LGPL-2.0, LGPL-2.0+, LGPL-2.1, LGPL-2.1+
>> +      Usage-Guidance:
>> +        This exception is used together with one of the above SPDX-Licenses
>> +     to mark user-space API (uapi) header files so they can be included
>> +     into non GPL compliant user-space application code.
>> +        To use this exception add it with the keyword WITH to one of the
>> +     identifiers in the SPDX-Licenses tag:
>> +       SPDX-License-Identifier: <SPDX-License> WITH Linux-syscall-note
>
> But here it comes without braces.

It is correct and therefore no changes are needed here with the
proposed updates from above

>> +      Exception-Text:
>> +        Full exception text
>> +
>> +   ::
>> +
>> +      SPDX-Exception-Identifier: GCC-exception-2.0
>> +      SPDX-URL: https://spdx.org/licenses/GCC-exception-2.0.html
>> +      SPDX-Licenses: GPL-2.0, GPL-2.0+
>> +      Usage-Guidance:
>> +        The "GCC Runtime Library exception 2.0" is used together with one
>> +     of the above SPDX-Licenses for code imported from the GCC runtime
>> +     library.
>> +        To use this exception add it with the keyword WITH to one of the
>> +     identifiers in the SPDX-Licenses tag:
>> +       SPDX-License-Identifier: <SPDX-License> WITH GCC-exception-2.0
>
> Here as well.
>
> The whole kernel now got SPDX-License-Identifiers that look like this:
>
> SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
>
> So this looks inconsistent to me, or did I miss something?

You did not miss anything, and you spotted this right on.
The SPDX-License-Identifier are correct, only the docs needs minor fixing.

Thanks again!

-- 
Cordially
Philippe Ombredanne