linux-kernel - Re: [PATCH] xfs: Use the correct style for SPDX License Identifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <16b209d0b0c8034db62f8d4d0a260a00f0aa5d5e.camel@perches.com>
Date:   Mon, 27 Apr 2020 11:59:16 -0700
From:   Joe Perches <joe@...ches.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     "Darrick J. Wong" <darrick.wong@...cle.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Kate Stewart <kstewart@...uxfoundation.org>,
        Nishad Kamdar <nishadkamdar@...il.com>,
        Uwe Kleine-König 
        <u.kleine-koenig@...gutronix.de>,
        Pengutronix Kernel Team <kernel@...gutronix.de>,
        linux-xfs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] xfs: Use the correct style for SPDX License Identifier

On Mon, 2020-04-27 at 20:36 +0200, Greg Kroah-Hartman wrote:
> On Mon, Apr 27, 2020 at 11:01:38AM -0700, Joe Perches wrote:
> > On Mon, 2020-04-27 at 19:46 +0200, Greg Kroah-Hartman wrote:
> > > On Mon, Apr 27, 2020 at 10:41:58AM -0700, Joe Perches wrote:
> > > > On Mon, 2020-04-27 at 19:29 +0200, Greg Kroah-Hartman wrote:
[]
> > > > > I thought we were supposed to use 'GPL-2.0-or-newer' because 'GPL-2.0+'
> > > > > > is deprecated in some newer version of the SPDX standard?
> > > > > > 
> > > > > > <shrug>
> > > > > 
> > > > > The kernel follows the "older" SPDX standard, but will accept either,
> > > > > it's up to the author.  It is all documented in LICENSES/ if people
> > > > > really want to make sure.
> > > > 
> > > > I think the kernel should prefer the "newer" SPDX standard
> > > > for any/all changes to these lines.
> > > > ---
> > > >  LICENSES/preferred/GPL-2.0 | 8 ++++----
> > > >  1 file changed, 4 insertions(+), 4 deletions(-)
> > > > 
> > > > diff --git a/LICENSES/preferred/GPL-2.0 b/LICENSES/preferred/GPL-2.0
> > > > index ff0812..c50f93 100644
> > > > --- a/LICENSES/preferred/GPL-2.0
> > > > +++ b/LICENSES/preferred/GPL-2.0
> > > > @@ -8,13 +8,13 @@ Usage-Guide:
> > > >    tag/value pairs into a comment according to the placement
> > > >    guidelines in the licensing rules documentation.
> > > >    For 'GNU General Public License (GPL) version 2 only' use:
> > > > -    SPDX-License-Identifier: GPL-2.0
> > > > -  or
> > > >      SPDX-License-Identifier: GPL-2.0-only
> > > > +  or the deprecated alternative
> > > > +    SPDX-License-Identifier: GPL-2.0
> > > >    For 'GNU General Public License (GPL) version 2 or any later version' use:
> > > > -    SPDX-License-Identifier: GPL-2.0+
> > > > -  or
> > > >      SPDX-License-Identifier: GPL-2.0-or-later
> > > > +  or the deprecated alternative
> > > > +    SPDX-License-Identifier: GPL-2.0+
> > > >  License-Text:
> > > 
> > > At the moment, I do not, as the current ones are not "depreciated" at
> > > all.
> > 
> > https://spdx.org/licenses/
> > 
> > shows the GPL-2.0 and GPL-2.0+ as deprecated.
> > 
> > https://spdx.org/licenses/GPL-2.0.html
> > https://spdx.org/licenses/GPL-2.0+.html
> > 
> 
> Again, we are not using the "new" version of the SPDX specification just
> yet.  We started out using one specific version, let's get the whole
> kernel converted first before worrying about trying to keep up with
> their newer releases please.  We still have a ways to go...

It seems you refer to yourself using the majestic plural.

There's already ~80% use of SPDX-License-Identifier and the
-only versions are already about 25% of the existing uses.

There's no real reason not to prefer the latest versions
over the deprecated ones.