linux-kernel - Re: [patch V5 01/11] Documentation: Add license-rules.rst to describe how to properly identify file licenses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 12 Jun 2018 14:03:31 -0500
From:   Yang Li <pku.leo@...il.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...uxfoundation.org>,
        Andrew Morton <akpm@...uxfoundation.org>,
        Jonathan Corbet <corbet@....net>,
        Kate Stewart <kstewart@...uxfoundation.org>,
        Philippe Ombredanne <pombredanne@...b.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Christoph Hellwig <hch@....de>,
        Russell King <rmk+kernel@...linux.org.uk>,
        Rob Herring <rob.herring@...aro.org>,
        Jonas Oberg <jonas@...e.org>, Joe Perches <joe@...ches.com>,
        linux-xfs@...r.kernel.org,
        Charlemagne Lasse <charlemagnelasse@...il.com>,
        Carmen Bianca Bakker <carmenbianca@...e.org>,
        "Darrick J. Wong" <darrick.wong@...cle.com>,
        Heiko Carstens <heiko.carstens@...ibm.com>
Subject: Re: [patch V5 01/11] Documentation: Add license-rules.rst to describe
 how to properly identify file licenses

On Thu, Dec 28, 2017 at 4:17 PM, Thomas Gleixner <tglx@...utronix.de> wrote:
> On Thu, 28 Dec 2017, Thomas Gleixner wrote:
>
> Sorry for the spam. I somehow missed to refresh the patch before generating
> the mbox. Find below the correct version of that one which has ALL braces
> removed which we don't need.

Hi Thomas,

I'm not sure how we reached the conclusion that we should remove ALL
braces?  I cannot find related discussion in the archive except for
the "WITH" case.

This is conflicting with the current SPDX spec at
https://spdx.org/spdx-specification-21-web-version quoted below and
also the explenation in your own file.

Quote from SPDX spec 2.1: More expressive composite license
expressions can be constructed using "OR", "AND", and "WITH" operators
similar to constructing mathematical expressions using arithmetic
operators. For the Tag:value format, any license expression that
consists of more than one license identifier and/or LicenseRef, should
be encapsulated by parentheses: "( )".


> +
> +   A <SPDX License Expression> is either an SPDX short form license
> +   identifier found on the SPDX License List, or the combination of two
> +   SPDX short form license identifiers separated by "WITH" when a license
> +   exception applies. When multiple licenses apply, an expression consists
> +   of keywords "AND", "OR" separating sub-expressions and surrounded by
> +   "(", ")" .

Conflicting with the example

> +
> +   License identifiers for licenses like [L]GPL with the 'or later' option
> +   are constructed by using a "+" for indicating the 'or later' option.::
> +
> +      // SPDX-License-Identifier: GPL-2.0+
> +      // SPDX-License-Identifier: LGPL-2.1+
> +
> +   WITH should be used when there is a modifier to a license needed.
> +   For example, the linux kernel UAPI files use the expression::
> +
> +      // SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
> +      // SPDX-License-Identifier: GPL-2.0+ WITH Linux-syscall-note
> +
> +   Other examples using WITH exceptions found in the kernel are::
> +
> +      // SPDX-License-Identifier: GPL-2.0 WITH mif-exception
> +      // SPDX-License-Identifier: GPL-2.0+ WITH GCC-exception-2.0
> +
> +   Exceptions can only be used with particular License identifiers. The
> +   valid License identifiers are listed in the tags of the exception text
> +   file. For details see the point `Exceptions`_ in the chapter `License
> +   identifiers`_.
> +
> +   OR should be used if the file is dual licensed and only one license is
> +   to be selected.  For example, some dtsi files are available under dual
> +   licenses::
> +
> +      // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
> +
> +   Examples from the kernel for license expressions in dual licensed files::
> +
> +      // SPDX-License-Identifier: GPL-2.0 OR MIT
> +      // SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
> +      // SPDX-License-Identifier: GPL-2.0 OR Apache-2.0
> +      // SPDX-License-Identifier: GPL-2.0 OR MPL-1.1
> +      // SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) OR MIT
> +      // SPDX-License-Identifier: GPL-1.0+ OR BSD-3-Clause OR OpenSSL
> +
> +   AND should be used if the file has multiple licenses whose terms all
> +   apply to use the file. For example, if code is inherited from another
> +   project and permission has been given to put it in the kernel, but the
> +   original license terms need to remain in effect::
> +
> +      // SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) AND MIT
> +
> +   Another other example where both sets of license terms need to be
> +   adhered to is::
> +
> +      // SPDX-License-Identifier: GPL-1.0+ AND LGPL-2.1+
> +