linux-kernel - Re: [PATCH 1/2] LICENSES: Add note to CDDL-1.0 license that it should not be used

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 10 Oct 2018 15:23:07 +0200 (CEST)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Hans de Goede <hdegoede@...hat.com>
cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jonathan Corbet <corbet@....net>,
        LKML <linux-kernel@...r.kernel.org>,
        Kate Stewart <kstewart@...uxfoundation.org>
Subject: Re: [PATCH 1/2] LICENSES: Add note to CDDL-1.0 license that it should
 not be used

On Wed, 10 Oct 2018, Hans de Goede wrote:

> The only reason we have the CDDL-1.0 license text around is for some
> dual-licensed files from virtualbox. New code should not use this license.
> 
> Add a note about this and change the example tag to be dual-licensed.
> 
> Signed-off-by: Hans de Goede <hdegoede@...hat.com>
> ---
>  LICENSES/other/CDDL-1.0 | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/LICENSES/other/CDDL-1.0 b/LICENSES/other/CDDL-1.0
> index 195a1687930a..164401ea9e62 100644
> --- a/LICENSES/other/CDDL-1.0
> +++ b/LICENSES/other/CDDL-1.0
> @@ -1,10 +1,12 @@
>  Valid-License-Identifier: CDDL-1.0
>  SPDX-URL: https://spdx.org/licenses/CDDL-1.0.html
>  Usage-Guide:
> +  Do NOT use. The CDDL-1.0 is not GPL compatible. It may only be used for
> +  dual-licensed files where the other license is GPL compatible.
>    To use the Common Development and Distribution License 1.0 put the
>    following SPDX tag/value pair into a comment according to the placement
>    guidelines in the licensing rules documentation:
> -    SPDX-License-Identifier: CDDL-1.0
> +    SPDX-License-Identifier: (GPL-2.0 OR CDDL-1.0)

I'd rather replace the 'GPL-2.0' with something like '$GPL-COMPATIBLE-ID'
and say explicitely in the prosa text that CCDL can only be used with OR
and not with AND.

Thanks,

	tglx