linux-kernel - Re: [PATCH 3/7] builddeb: Switch to a machine readable copyright file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK7LNAQqHR5T0D+ThsDJ-QpBTzxt9PDWn1M8G8uurv5LC_SKSg@mail.gmail.com>
Date:   Tue, 29 Sep 2020 00:11:34 +0900
From:   Masahiro Yamada <masahiroy@...nel.org>
To:     Guillem Jover <guillem@...rons.org>
Cc:     Linux Kbuild mailing list <linux-kbuild@...r.kernel.org>,
        Michal Marek <michal.lkml@...kovi.net>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Ben Hutchings <ben@...adent.org.uk>
Subject: Re: [PATCH 3/7] builddeb: Switch to a machine readable copyright file

(+CC ben)

On Mon, Sep 21, 2020 at 7:48 AM Guillem Jover <guillem@...rons.org> wrote:
>
> This format makes it possible to automatically process the licenses
> within a system for compatibility or compliance checks, for example.
> Update the copyright years.


Not all kernel developers are familiar with the
background info.
I think the commit description can describe a little more about
the rationale.


For example,

This was accepted as DEP-5
(https://dep-team.pages.debian.net/deps/dep5/)

and the debian kernel package switched to
the machine-readable debian/copyright by [1].

[1]: https://salsa.debian.org/kernel-team/linux/-/commit/d4f730e3ba9c76aff4c522b1a87aeb617f2f655e







> Signed-off-by: Guillem Jover <guillem@...rons.org>
> ---
>  scripts/package/mkdebian | 36 +++++++++++++++++++++++-------------
>  1 file changed, 23 insertions(+), 13 deletions(-)
>
> diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
> index cd2c8c39aa54..69f2a6d7f009 100755
> --- a/scripts/package/mkdebian
> +++ b/scripts/package/mkdebian
> @@ -157,19 +157,29 @@ EOF
>
>  # Generate copyright file
>  cat <<EOF > debian/copyright
> -This is a packacked upstream version of the Linux kernel.
> -
> -The sources may be found at most Linux archive sites, including:
> -https://www.kernel.org/pub/linux/kernel
> -
> -Copyright: 1991 - 2018 Linus Torvalds and others.
> -
> -    This program is free software; you can redistribute it and/or modify
> -    it under the terms of the GNU General Public License as published by
> -    the Free Software Foundation; version 2 dated June, 1991.
> -
> -On Debian GNU/Linux systems, the complete text of the GNU General Public
> -License version 2 can be found in \`/usr/share/common-licenses/GPL-2'.
> +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
> +Source: https://www.kernel.org/pub/linux/kernel
> +
> +Files: *
> +Copyright:
> + 1991-2020 Linus Torvalds and others.
> +License: GPL-2

This specifies GPL-2 for 'Files: *'.

This is wrong because not all files in the kernel are GPL-2.



The debian-kernel maintains the large list of
exceptional files:

https://salsa.debian.org/kernel-team/linux/-/blob/debian/5.8.7-1/debian/copyright

But, I doubt it is maintainable.


I wonder if it is a good thing to convert it
to machine-interpretable, but apparently wrong information.


I am reluctant to maintain the huge debian/copyright...


Ben,
Do you have any idea how to handle this?




> +License: GPL-2
> + This program is free software; you can redistribute it and/or modify
> + it under the terms of the GNU General Public License as published by
> + the Free Software Foundation; version 2 dated June, 1991.
> + .
> + This program is distributed in the hope that it will be useful,
> + but WITHOUT ANY WARRANTY; without even the implied warranty of
> + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + GNU General Public License for more details.
> + .
> + You should have received a copy of the GNU General Public License
> + along with this program.  If not, see <https://www.gnu.org/licenses/>.
> +Comment:
> + On Debian systems, the complete text of the GNU General Public License
> + version 2 can be found in '/usr/share/common-licenses/GPL-2'.
>  EOF
>
>  # Generate a control file
> --
> 2.28.0.297.g1956fa8f8d
>


--
Best Regards
Masahiro Yamada