linux-kernel - Re: [GIT PULL] SPDX update for 5.2-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK7LNASZWLwYC2E3vBkXhp7wt9zBWkFrR+NTnxTyLn1zO66a0w@mail.gmail.com>
Date:   Wed, 22 May 2019 13:32:17 +0900
From:   Masahiro Yamada <yamada.masahiro@...ionext.com>
To:     Greg KH <gregkh@...uxfoundation.org>,
        Thomas Gleixner <tglx@...utronix.de>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-spdx@...r.kernel.org, Joe Perches <joe@...ches.com>
Subject: Re: [GIT PULL] SPDX update for 5.2-rc1 - round 1

On Tue, May 21, 2019 at 10:34 PM Greg KH <gregkh@...uxfoundation.org> wrote:
>
> The following changes since commit a188339ca5a396acc588e5851ed7e19f66b0ebd9:
>
>   Linux 5.2-rc1 (2019-05-19 15:47:09 -0700)
>
> are available in the Git repository at:
>
>   git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git tags/spdx-5.2-rc2
>
> for you to fetch changes up to 7170066ecd289cd8560695b6f86ba8dc723b6505:
>
>   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 25 (2019-05-21 11:52:39 +0200)
>
> ----------------------------------------------------------------
> SPDX update for 5.2-rc2, round 1
>
> Here are series of patches that add SPDX tags to different kernel files,
> based on two different things:
>   - SPDX entries are added to a bunch of files that we missed a year ago
>     that do not have any license information at all.
>
>     These were either missed because the tool saw the MODULE_LICENSE()
>     tag, or some EXPORT_SYMBOL tags, and got confused and thought the
>     file had a real license, or the files have been added since the last
>     big sweep, or they were Makefile/Kconfig files, which we didn't
>     touch last time.
>
>   - Add GPL-2.0-only or GPL-2.0-or-later tags to files where our scan
>     tools can determine the license text in the file itself.  Where this
>     happens, the license text is removed, in order to cut down on the
>     700+ different ways we have in the kernel today, in a quest to get
>     rid of all of these.



I have been wondering for a while
which version of spdx tags I should use in my work.


I know the 'GPL-2.0' tag is already deprecated.
(https://spdx.org/licenses/GPL-2.0.html)


But, I saw negative reaction to this:
https://lore.kernel.org/patchwork/patch/975394/

Nor "-only" / "-or-later" are documented in
Documentation/process/license-rules.rst


In this patch series, Thomas used 'GPL-2.0-only' and 'GPL-2.0-or-later'
instead of 'GPL-2.0' and 'GPL-2.0+'.

Now, we have a great number of users of spdx v3 tags.
$ git grep -P 'SPDX-License-Identifier.*(?:-or-later|-only)'| wc -l
4135



So, what I understood is:

  For newly added tags, '*-only' and '*-or-later' are preferred.

(But, we do not convert existing spdx v2 tags globally.)



Joe's patch was not merged, but at least
Documentation/process/license-rules.rst
should be updated in my opinion.

(Perhaps, checkpatch.pl can suggest newer tags in case
patch submitters do not even know that deprecation.)


Thanks.



> These patches have been out for review on the linux-spdx@...r mailing
> list, and while they were created by automatic tools, they were
> hand-verified by a bunch of different people, all whom names are on the
> patches are reviewers.
>
> The reason for these "large" patches is if we were to continue to
> progress at the current rate of change in the kernel, adding license
> tags to individual files in different subsystems, we would be finished
> in about 10 years at the earliest.
>
> There will be more series of these types of patches coming over the next
> few weeks as the tools and reviewers crunch through the more "odd"
> variants of how to say "GPLv2" that developers have come up with over
> the years, combined with other fun oddities (GPL + a BSD disclaimer?)
> that are being unearthed, with the goal for the whole kernel to be
> cleaned up.
>
> These diffstats are not small, 3840 files are touched, over 10k lines
> removed in just 24 patches.
>
> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>


-- 
Best Regards
Masahiro Yamada