linux-kernel - Re: [PATCH 3/8] crypto: drbg: Convert dual BSD 3-Clause/GPL-1.0 license boilerplate to SPDX identifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 7 Jun 2023 09:56:03 -0400
From:   Richard Fontana <rfontana@...hat.com>
To:     Bagas Sanjaya <bagasdotme@...il.com>
Cc:     Herbert Xu <herbert@...dor.apana.org.au>,
        "David S. Miller" <davem@...emloft.net>,
        Franziska Naepelt <franziska.naepelt@...glemail.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Linux SPDX Licenses <linux-spdx@...r.kernel.org>,
        Linux Kernel Janitors <kernel-janitors@...r.kernel.org>,
        Linux Crypto <linux-crypto@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        David Howells <dhowells@...hat.com>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        Dan Carpenter <dan.carpenter@...aro.org>,
        Stephan Mueller <smueller@...onox.de>
Subject: Re: [PATCH 3/8] crypto: drbg: Convert dual BSD 3-Clause/GPL-1.0
 license boilerplate to SPDX identifier

On Wed, Jun 7, 2023 at 1:41 AM Bagas Sanjaya <bagasdotme@...il.com> wrote:
>
> Replace the boilerplate with corresponding SPDX tag. Since there is no
> explicit GPL version, assume GPL 1.0+.
>
> Cc: Stephan Mueller <smueller@...onox.de>
> Signed-off-by: Bagas Sanjaya <bagasdotme@...il.com>
> ---
>  crypto/drbg.c | 33 +--------------------------------
>  1 file changed, 1 insertion(+), 32 deletions(-)
>
> diff --git a/crypto/drbg.c b/crypto/drbg.c
> index ff4ebbc68efab1..f797deaf3952ef 100644
> --- a/crypto/drbg.c
> +++ b/crypto/drbg.c
> @@ -1,3 +1,4 @@
> +// SPDX-License-Identifier: BSD-3-Clause OR GPL-1.0+
>  /*
>   * DRBG: Deterministic Random Bits Generator
>   *       Based on NIST Recommended DRBG from NIST SP800-90A with the following
> @@ -9,38 +10,6 @@
>   *
>   * Copyright Stephan Mueller <smueller@...onox.de>, 2014
>   *
> - * Redistribution and use in source and binary forms, with or without
> - * modification, are permitted provided that the following conditions
> - * are met:
> - * 1. Redistributions of source code must retain the above copyright
> - *    notice, and the entire permission notice in its entirety,
> - *    including the disclaimer of warranties.
> - * 2. Redistributions in binary form must reproduce the above copyright
> - *    notice, this list of conditions and the following disclaimer in the
> - *    documentation and/or other materials provided with the distribution.
> - * 3. The name of the author may not be used to endorse or promote
> - *    products derived from this software without specific prior
> - *    written permission.
> - *
> - * ALTERNATIVELY, this product may be distributed under the terms of
> - * the GNU General Public License, in which case the provisions of the GPL are
> - * required INSTEAD OF the above restrictions.  (This clause is
> - * necessary due to a potential bad interaction between the GPL and
> - * the restrictions contained in a BSD-style copyright.)
> - *
> - * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
> - * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
> - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
> - * WHICH ARE HEREBY DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE
> - * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
> - * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
> - * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
> - * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
> - * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
> - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
> - * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
> - * DAMAGE.

The non-GPL portion of this notice does not match BSD-3-Clause as
currently defined by SPDX (see:
https://github.com/spdx/license-list-XML/blob/main/src/BSD-3-Clause.xml).
This is at least the third time in your recent patches that you have
assumed that a non-GPL license matches a particular SPDX identifier
without (apparently) checking.

That's assuming it's appropriate to represent this as a dual license
and omit the 'ALTERNATIVELY' parenthetical. I'm not sure how I feel
about that.

Richard