linux-kernel - RE: [GIT PULL] SPDX update for 5.2-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 29 May 2019 14:16:58 +0000
From:   "Zavras, Alexios" <alexios.zavras@...el.com>
To:     Alexandre Belloni <alexandre.belloni@...tlin.com>,
        Greg KH <gregkh@...uxfoundation.org>
CC:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-spdx@...r.kernel.org" <linux-spdx@...r.kernel.org>
Subject: RE: [GIT PULL] SPDX update for 5.2-rc1 - round 1


> -----Original Message-----
> From: linux-spdx-owner@...r.kernel.org <linux-spdx-owner@...r.kernel.org>
> On Behalf Of Alexandre Belloni
> Sent: Wednesday, 29 May, 2019 15:13
> Subject: Re: [GIT PULL] SPDX update for 5.2-rc1 - round 1
> 
> Hello,
> 
> On 21/05/2019 15:32:57+0200, Greg KH wrote:
> >   - Add GPL-2.0-only or GPL-2.0-or-later tags to files where our scan
> 
> I'm very confused by those two tags because they are not mentioned in the
> SPDX 2.1 specification or the kernel documentation and seem to just be from
> https://spdx.org/ids-howi which doesn't seem to be versionned anywhere.
> While I understand the rationale behind those, I believe the correct way of
> introducing them would be first to add them in the spec and documentation
> and then make use of them.

The "GPL-2.0-only" and "GPL-2.0-or-later" are license short identifiers.
They do not belong to the SPDX spec, but rather on the license list.
They were introduced in the SPDX License List v3.0 (current version is 3.5):
https://spdx.org/licenses/ 

It seems the examples in the kernel documentation use identifiers
from earlier versions of the license list.


> Now, what should we do with all the GPL-2.0 and GPL-2.0+ tags that we have?

These are still valid identifiers (albeit deprecated), 
so there is no urgent need to have them replaced.

-- zvr -
Intel Deutschland GmbH
Registered Address: Am Campeon 10-12, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Christin Eisenschmid, Gary Kershaw
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928