linux-kernel - Re: [PATCH v6] checkpatch.pl: Add SPDX license tag check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 02 Feb 2018 13:10:02 -0800
From:   Joe Perches <joe@...ches.com>
To:     Rob Herring <robh@...nel.org>
Cc:     Igor Stoppa <igor.stoppa@...wei.com>,
        Kate Stewart <kstewart@...uxfoundation.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Andy Whitcroft <apw@...onical.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Philippe Ombredanne <pombredanne@...b.com>,
        Jonathan Corbet <corbet@....net>
Subject: Re: [PATCH v6] checkpatch.pl: Add SPDX license tag check

On Fri, 2018-02-02 at 14:57 -0600, Rob Herring wrote:
> On Fri, Feb 2, 2018 at 1:06 PM, Joe Perches <joe@...ches.com> wrote:
[]
> > Right now, there are many missing licenses
> > that are already used by various existing
> > SPDX-License-Identifier: entries.
> > 
> > APACHE-2.0
> 
> Given that Apache 2.0 is not compatible with GPL 2, that would pretty
> much mean anything with Apache license is dual licensed and it would
> be the other license that applies. Do we really want/need license
> texts for all the other possible licenses that don't apply to kernel
> files?

There are 2 uses of SPDX.*Apache in staging.

drivers/staging/android/ashmem.h:// SPDX-License-Identifier: (GPL-2.0 OR Apache-2.0)
drivers/staging/android/uapi/ashmem.h:// SPDX-License-Identifier: (GPL-2.0 OR Apache-2.0)

I believe each specific license text should be
available in either the actual source file with
the Apache license or in a specific LICENSES/
file in the kernel tree.

> If so, 
> this should all just be scripted to sync LICENSES/ with
> found SPDX tags in the kernel.

Right.  That's probably best.

> ISC and OpenSSL are only in license-rules.rst as examples. We should
> just fix those examples to something else.

Sounds good to me.

I should have excluded Documentation/process/license-rules.rst
from the SPDX matches.

Are significant portions of that document generic across
multiple projects or is it entirely specific to linux?

cheers, Joe