linux-kernel - Re: [PATCH] checkpatch.pl: Add SPDX license tag check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 01 Feb 2018 13:49:04 -0800
From:   Joe Perches <joe@...ches.com>
To:     Rob Herring <robh@...nel.org>, linux-kernel@...r.kernel.org,
        Andrew Morton <akpm@...ux-foundation.org>
Cc:     Andy Whitcroft <apw@...onical.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Philippe Ombredanne <pombredanne@...b.com>
Subject: Re: [PATCH] checkpatch.pl: Add SPDX license tag check

On Thu, 2018-02-01 at 15:14 -0600, Rob Herring wrote:
> Add SPDX license tag check based on the rules defined in
> Documentation/process/license-rules.rst. To summarize, SPDX license tags
> should be on the 1st line (or 2nd line in scripts) using the appropriate
> comment style for the file type.
> 
> Cc: Andy Whitcroft <apw@...onical.com>
> Cc: Joe Perches <joe@...ches.com>
> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: Philippe Ombredanne <pombredanne@...b.com>
> Cc: Andrew Morton <akpm@...ux-foundation.org>
> Signed-off-by: Rob Herring <robh@...nel.org>
> ---
> I didn't get around to resending once license-rules.rst landed in -next. 
> Hopefully, this can be picked up for 4.16 so folks can start using it. 
> SPDX tags have already become a frequent review comment.

Seems sensible enough now.
Here are some other suggestions.

> diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
[]
> @@ -2866,6 +2869,30 @@ sub process {
>  			}
>  		}
>  
> +# check for using SPDX license tag at beginning of files
> +		if ($realline == $checklicenseline) {
> +			if ($realfile =~ /\.(?:sh|pl|py)/ && $rawline =~ /\[ \+]\s*\!\#/) {

There are many files with a #! shebang that do
not use these filename types.

$ git grep -P --name-only '^\s*\#\!\s*/(?:bin|usr)' | \
  grep -vP
"(?:txt|rst|py|sh|pl)$" | wc -l
158

i.e.: .tc and .awk files and ~100 files without extensions

So I would add awk and tc to the $realfile test and
perhaps extend this check to test if the file is not
binary and executable.

> +				$checklicenseline = 2;
> +			} elsif ($rawline =~ /^\+/) {
> +				my $comment = "";
> +				if ($realfile =~ /\.(h|s|S)$/) {
> +					$comment = '/*';
> +				} elsif ($realfile =~ /\.(c|dts|dtsi)$/) {
> +					$comment = '//';
> +				} elsif ($realfile =~ /\.(sh|pl|py)$/) {
> +					$comment = '#';
> +				} elsif ($realfile =~ /\.rst$/) {
> +					$comment = '..';
> +				}
> +
> +				if ($comment !~ /^$/ &&
> +				    $rawline !~ /^\+\Q$comment\E SPDX-License-Identifier: /) {
> +					WARN("SPDX_LICENSE_TAG",
> +					     "Missing or malformed SPDX-License-Identifier tag in 1st (or 2nd for scripts) line\n" . $herecurr);

Perhaps 'Missing ... in line $checklicense\n"