linux-kernel - Re: [PATCH 8/8] crypto: cts: Convert MIT boilerplate to corresponding SPDX license identifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2023060839-limpness-vessel-ccc7@gregkh>
Date:   Thu, 8 Jun 2023 07:40:41 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Bagas Sanjaya <bagasdotme@...il.com>
Cc:     Richard Fontana <rfontana@...hat.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        "David S. Miller" <davem@...emloft.net>,
        Franziska Naepelt <franziska.naepelt@...glemail.com>,
        Linux SPDX Licenses <linux-spdx@...r.kernel.org>,
        Linux Kernel Janitors <kernel-janitors@...r.kernel.org>,
        Linux Crypto <linux-crypto@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        David Howells <dhowells@...hat.com>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        Dan Carpenter <dan.carpenter@...aro.org>
Subject: Re: [PATCH 8/8] crypto: cts: Convert MIT boilerplate to
 corresponding SPDX license identifier

On Thu, Jun 08, 2023 at 12:32:34PM +0700, Bagas Sanjaya wrote:
> On Wed, Jun 07, 2023 at 09:47:33AM -0400, Richard Fontana wrote:
> > On Wed, Jun 7, 2023 at 1:41 AM Bagas Sanjaya <bagasdotme@...il.com> wrote:
> > >
> > > License boilerplate in CTS mode implementation (crypto/cts.c) looks like
> > > MIT license with advertising clause. Replace it with correspondig
> > > SPDX tag.
> > >
> > > Signed-off-by: Bagas Sanjaya <bagasdotme@...il.com>
> > > ---
> > >  crypto/cts.c | 24 +-----------------------
> > >  1 file changed, 1 insertion(+), 23 deletions(-)
> > >
> > > diff --git a/crypto/cts.c b/crypto/cts.c
> > > index 8f604f6554b1c3..9ec7e9787c0f6a 100644
> > > --- a/crypto/cts.c
> > > +++ b/crypto/cts.c
> > > @@ -1,3 +1,4 @@
> > > +// SPDX-License-Identifier: MIT
> > >  /*
> > >   * CTS: Cipher Text Stealing mode
> > >   *
> > > @@ -5,29 +6,6 @@
> > >   * The Regents of the University of Michigan
> > >   * ALL RIGHTS RESERVED
> > >   *
> > > - * Permission is granted to use, copy, create derivative works
> > > - * and redistribute this software and such derivative works
> > > - * for any purpose, so long as the name of The University of
> > > - * Michigan is not used in any advertising or publicity
> > > - * pertaining to the use of distribution of this software
> > > - * without specific, written prior authorization.  If the
> > > - * above copyright notice or any other identification of the
> > > - * University of Michigan is included in any copy of any
> > > - * portion of this software, then the disclaimer below must
> > > - * also be included.
> > > - *
> > > - * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION
> > > - * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY
> > > - * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF
> > > - * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING
> > > - * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF
> > > - * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
> > > - * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE
> > > - * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR
> > > - * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING
> > > - * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN
> > > - * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF
> > > - * SUCH DAMAGES.
> > >   */
> > 
> > This is not the MIT license (as defined by SPDX) - there may not be an
> > SPDX identifier covering this license text.
> > 
> > This is at least the second time in your recent patches where you have
> > assumed that a non-GPL license corresponds to a particular SPDX
> > identifier without (apparently) checking.
> > 
> 
> I was thought of interpolating license tags (heuristic matching) in
> cases like this. In this case, the UoMi license was adapted from
> (and roughly resembled) MIT (hence I thought of MIT variant).

Nope, licenses don't always work that way, sorry.

> Greg, is Richard's comment right? If so, I'll drop this patch.

Yes it is, please ask for all of these to not be applied.

There's a reason that we didn't do all of these in the first big sweep
of the kernel tree, as you are finding out :(

thanks,

greg k-h