linux-kernel - Re: [patch 4/9] LICENSES/GPL2.0: Add GPL-2.0-only/or-later as valid identifiers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 Apr 2018 10:01:22 +0200 (CEST)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Mauro Carvalho Chehab <mchehab@...pensource.com>
cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Philippe Ombredanne <pombredanne@...b.com>,
        Kate Stewart <kstewart@...uxfoundation.org>,
        Jonathan Corbet <corbet@....net>,
        Hans Verkuil <hans.verkuil@...co.com>
Subject: Re: [patch 4/9] LICENSES/GPL2.0: Add GPL-2.0-only/or-later as valid
 identifiers

On Mon, 23 Apr 2018, Mauro Carvalho Chehab wrote:
> Em Mon, 23 Apr 2018 08:52:29 +0200
> Greg Kroah-Hartman <gregkh@...uxfoundation.org> escreveu:
> 
> > On Mon, Apr 23, 2018 at 12:02:12AM +0200, Thomas Gleixner wrote:
> > > Quite some files have been flagged with the new GPL-2.0-only and
> > > GPL-2.0-or-later identifiers which replace the original GPL-2.0 and
> > > GPL-2.0+ identifiers in the SPDX license identifier specification, but the
> > > identifiers are not mentioned as valid in the GPL-2.0 license file.
> > > 
> > > Add them to make everything consistent again.
> > > 
> > > Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> > > Cc: Hans Verkuil <hans.verkuil@...co.com>
> > > Cc: Mauro Carvalho Chehab <mchehab@...pensource.com>  
> > 
> > As much as I dislike the "new" identifiers, I guess trying to hold them
> > back is a pointless exercise :(
> 
> Well, it is part of the SPDX spec, so it should be valid, no matter
> of personal tastes.
> 
> I'd say that we should clearly point what SPDX version is preferred at:
> 	Documentation/process/license-rules.rst
> 
> And, if we adopt version 3.0, change the described license tags
> accordingly, as the tags showed there are for some pre-version 3.0
> SPDX version (but the file doesn't mention if it follows SPDX version
> 1.0, 1.1, 1.2, 2.0 or 2.1).

We need to grab the new version anyway due to the new Linux-OpenIB
license ID.

And we can document that the new -only and -or-later versions are
preferred, but should we really patch thousands of files just to update the
IDs?

I don't think so, SPDX better get their act together and mark them as
equivalent.

Thanks,

	tglx