linux-kernel - Re: [PATCH 0/6] Address issues with SPDX requirements and PEP-263

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.21.1909072308060.1902@nanos.tec.linutronix.de>
Date:   Sat, 7 Sep 2019 23:17:22 +0200 (CEST)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Markus Heiser <markus.heiser@...marit.de>
cc:     Mauro Carvalho Chehab <mchehab+samsung@...nel.org>,
        Jonathan Corbet <corbet@....net>,
        Linux Media Mailing List <linux-media@...r.kernel.org>,
        Mauro Carvalho Chehab <mchehab@...radead.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Joe Perches <joe@...ches.com>, linux-kernel@...r.kernel.org,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Sven Eckelmann <sven@...fation.org>,
        Ingo Molnar <mingo@...hat.com>,
        Doug Smythies <doug.smythies@...il.com>,
        Aurélien Cedeyn <aurelien.cedeyn@...il.com>,
        Vincenzo Frascino <vincenzo.frascino@....com>,
        linux-doc@...r.kernel.org,
        "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Thierry Reding <treding@...dia.com>,
        Armijn Hemel <armijn@...ldur.nl>, Jiri Olsa <jolsa@...hat.com>,
        Uwe Kleine-König 
        <u.kleine-koenig@...gutronix.de>,
        Namhyung Kim <namhyung@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Federico Vaga <federico.vaga@...a.pv.it>,
        Allison Randal <allison@...utok.net>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Shuah Khan <skhan@...uxfoundation.org>
Subject: Re: [PATCH 0/6] Address issues with SPDX requirements and PEP-263

On Sat, 7 Sep 2019, Markus Heiser wrote:
> Am 07.09.19 um 20:04 schrieb Mauro Carvalho Chehab:
> > No idea. I would actually prefer to just remove the restriction, and let
> > the SPDX header to be anywhere inside the first comment block inside a
> > file [2].
> 
> > That's basically how this thread started: other developers think
> > that it is a good idea to be pedantic. So, be it, but let's then fix
> > the documentation, as the way it is, it is implicitly forbidding the
> > addition of encoding lines for Python scripts.
> > 
> > [2] I *suspect* that the restriction was added in order to make
> >      ./scripts/spdxcheck.py to run faster and to avoid false positives.
> >      Right now, if the maximum limit is removed (or set to a very high
> >      value), there will be one false positive:

Nope. The intention was to have a well define place and format instead of
everyone and his dog deciding to put it somewhere. SPDX is not intended to
replace the existing licensing mess with some other randomly placed and
formatted licensing mess.

> > > - write a shebang line if this file is called directly from the
> > >     command line .. but we do not need shebangs on py modules which
> > >     are imported from other modules or scripts
> > > 
> > > - write a encoding line if it is need or helpful / mostly it is helpful
> > >     to know the encoding of a text/code file.
> > > 
> > > - add a SPDX tag
> > 
> > Yes, but this violates the current documentation, as it doesn't allow the
> > SPDX tag after line #2.
> 
> Thats what I mean: The documentation was written with only a small use-cases
> in mind .. there is no real need for SPDX to be in line one or two ... lets
> fix the documentation as I described before.

If there is a requirement from the language to have 2 lines right at the
top for conveying information then there is of course no reason to insist
on the SPDX identifier being on line 2.

So the documentation should say:

   The SPDX identifier must be at the first possible line at the top of the
   file which is not occupied by information which is required to be
   immediately at the top of the file by system constraints, e.g. shebang,
   or by the language, e.g. the encoding information for python.

or something to that effect.

Thanks,

	tglx