linux-kernel - Re: [PATCH v2] random: add proper SPDX header

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YgVEsotBkXVPknAK@kroah.com>
Date:   Thu, 10 Feb 2022 18:00:34 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     "Jason A. Donenfeld" <Jason@...c4.com>
Cc:     LKML <linux-kernel@...r.kernel.org>, linux-spdx@...r.kernel.org,
        Thomas Gleixner <tglx@...utronix.de>,
        Theodore Ts'o <tytso@....edu>,
        Dominik Brodowski <linux@...inikbrodowski.net>
Subject: Re: [PATCH v2] random: add proper SPDX header

On Thu, Feb 10, 2022 at 05:53:33PM +0100, Jason A. Donenfeld wrote:
> Hi Greg,
> 
> Thanks for the review. Comments are inline below.
> 
> On Thu, Feb 10, 2022 at 5:49 PM Greg Kroah-Hartman
> <gregkh@...uxfoundation.org> wrote:
> > Where did the "or later" come from?  I don't see that in the original
> > text.
> 
> Yea, this part seems a little bit ambiguous:
> 
> > > - * ALTERNATIVELY, this product may be distributed under the terms of
> > > - * the GNU General Public License, in which case the provisions of the GPL are
> > > - * required INSTEAD OF the above restrictions.  (This clause is
> > > - * necessary due to a potential bad interaction between the GPL and
> > > - * the restrictions contained in a BSD-style copyright.)
> >
> > I do not see a "or later" here.
> 
> I don't see a "2.0" either. I think we can infer from context that it
> couldn't have been < 2.0. So in the absence of a number, maybe this
> means >= 2.0, and hence "or later"? Or since at the time it probably
> meant 2.0, do we infer this to mean == 2.0? I really have no idea,
> which is why I'm glad this list exists.
> 
> It sounds like your perspective is that this is == 2.0?

Without a "or later" it has to be "2.0" as that is what the overall
kernel license is.  That's what we did for the big SPDX sweep, so that
keeps things being decided in the same manner.

thanks,

greg k-h