From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.3 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS,T_DKIMWL_WL_HIGH,USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71EDAC4321A for ; Tue, 11 Jun 2019 15:45:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 38ADA2089E for ; Tue, 11 Jun 2019 15:45:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1560267940; bh=JVgmv1ckzi33lC868QMvSUMypX3KHWJAH+y8s2wBBNk=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=TAi6Z8funMFYZMsW/CoeApIz65qJIXj6+dic/j+cVjx/v4DQolj8/3o99slfv7ZRt AIGiilN6EHRwJXE+WgW0rPTqWuxmLRhOwT4ZfqYE8RNCXyOYnhw6AsLTG0vxgngvwG N0i0SThKEeJZely2YeG+JUpbKdkfIHaoLzdyOeMI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2391638AbfFKPpk (ORCPT ); Tue, 11 Jun 2019 11:45:40 -0400 Received: from mail.kernel.org ([198.145.29.99]:34076 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2391628AbfFKPpj (ORCPT ); Tue, 11 Jun 2019 11:45:39 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 02C1A2080A; Tue, 11 Jun 2019 15:45:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1560267938; bh=JVgmv1ckzi33lC868QMvSUMypX3KHWJAH+y8s2wBBNk=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=DncZZfhxmhe5Jo2vZybHzb/HbnJAw6ukcwARaghyCswPGUnNiLYpEF4JhoOfwq+GD VP3DUdDotO/B3XV/v0rUk0fl+QKYvogPRwI6D6JTdka4NVrsWyFfcnujvC5NtFQkfi Sg0/wJMrhca7tEN9Is/X61e3ycyUrVo34/hIwnSs= Date: Tue, 11 Jun 2019 17:45:36 +0200 From: Greg KH To: Richard Fontana Cc: Philippe Ombredanne , Thomas Gleixner , "Enrico Weigelt, metux IT consult" , linux-spdx@vger.kernel.org Subject: Re: [Batch 17 patch 43/57] treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 494 Message-ID: <20190611154536.GD5706@kroah.com> References: <20190604081044.651381636@linutronix.de> <20190604081206.123876666@linutronix.de> <1199b8ef-01e5-aa72-9673-f38b05434d14@metux.net> <20190610154555.GA28774@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.0 (2019-05-25) Sender: linux-spdx-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-spdx@vger.kernel.org On Mon, Jun 10, 2019 at 12:49:16PM -0400, Richard Fontana wrote: > On Mon, Jun 10, 2019 at 11:46 AM Greg KH wrote: > > > > On Mon, Jun 10, 2019 at 11:30:27AM -0400, Richard Fontana wrote: > > > On Mon, Jun 10, 2019 at 4:36 AM Philippe Ombredanne > > > wrote: > > > > > > > > Hi Thomas: > > > > > > > > On Tue, Jun 4, 2019 at 3:50 PM Thomas Gleixner wrote: > > > > > > > > > > On Tue, 4 Jun 2019, Enrico Weigelt, metux IT consult wrote: > > > > > > > > > > > On 04.06.19 11:20, Thomas Gleixner wrote: > > > > > > > On Tue, 4 Jun 2019, Thomas Gleixner wrote: > > > > > > > > > > > > > > > From: Thomas Gleixner tglx@linutronix.de > > > > > > > > > > > > > > > > Based on 1 normalized pattern(s): > > > > > > > > > > > > > > > > copyright this file is distributed under the terms of the gnu > > > > > > > > general public license gpl copies of the gpl can be obtained from > > > > > > > > ftp prep ai mit edu pub gnu gpl each contributing author retains all > > > > > > > > rights to their own work > > > > > > > > > > > > > > That's definitely a bold claim to deduce v2 only. The ftp link does not > > > > > > > exist and the wayback machine does not have it either. > > > > > > > > We usually avoid making any bold claims in scancode license rules ;) > > > > > > > > ftp://prep.ai.mit.edu/pub/gnu/GPL linked to a GPL-2.0 based on the > > > > wayback machine which is why that scancode-toolkit rule was tagged as > > > > a GPL-2.0. > > > > > > > > You can see the notes I added back then in the license rule data file [1]: > > > > > > > > notes: The GPL version is not specified in this notice BUT at > > > > https://web-beta.archive.org/web/20020809115410/http://prep.ai.mit.edu:80/pub/gnu/GPL > > > > text is a GPL 2.0 license text > > > > > > > > Since then, the web-beta site when offline, and the correct URL should > > > > use FTP and not HTTP so you can check [2] which is exactly a GPL > > > > > > > > I just pushed updated notes with the latest wayback URL [3] > > > > > > > > [1] https://github.com/nexB/scancode-toolkit/blob/09d4b009d4377eb1fc6f8439fe564e0a2c28e641/src/licensedcode/data/rules/gpl-2.0_617.yml > > > > [2] https://web.archive.org/web/20020809115410/ftp://prep.ai.mit.edu/pub/gnu/GPL > > > > [3] https://github.com/nexB/scancode-toolkit/commit/4f5d5f3ddddafd9e7eba639f5718a976ca7fdefe > > > > > > This seems a bit similar to another case I commented on a while ago. > > > Despite the fact that the URL pointed to GPLv2, I don't see the > > > GPL-2.0-only conclusion as being justified (beyond the accepted > > > understanding that you can distribute GPL-2.0-or-later code under > > > GPL-2.0-only). The license notice does not express any view about GPL > > > versions. It is not really interesting that it references a copy of > > > the version of the GPL in wide use at the time. > > > > > > In other words, it's like saying: > > > "This code is licensed under the GPL. You can find a copy of the GPL > > > here ". Nothing in that set of two > > > sentences necessarily suggests an intention to limit the licensee to > > > the specific version of the GPL that is referenced. It could be read > > > as: "This code is licensed under the GPL, a maintained license that > > > has a past and likely future versions. You can find a copy of one > > > version of the GPL, the version that happens to be most widely used > > > today, here". > > > > If the URL pointed to a GPLv2, how can you say that "any version of the > > GPL applies"? At the point in time, it specifically said "this > > version", and "this version == GPLv2". > > The notice in this case doesn't explicitly refer to a version apart > from pointing to a copy of GPLv2, which obviously embodies one > version. Exactly. As you say, it "obviously embodies one version". How can anyone make the leap to say that the reference meant anything else? > If the notice had said: > "copyright this file is distributed under the terms of the version of the gnu > general public license gpl obtained from ftp prep ai mit edu pub gnu > gpl", for example, there'd be no question it would only be appropriate > to treat it as GPL-2.0-only. Huh? The FSF moved links around over time, so that if you pointed at the "latest" version of the gpl at one point in time, it would change later on, right? But that is not what happened here, the text explicitly says "the license right here" is what to use. That file did not ever change it's text, it just moved locations, so the content there is not different. > > Also remember Linus, and other kernel developer's public statements > > (myself included) about the follies of people saying "any later > > version", and how the kernel itself is only released under v2 of the > > GPL. > > Sure, but that's a different justification for treating it as > GPL-2.0-only, certainly reasonable but I don't know how much weight to > give that given all the explicit "or later" notices in the kernel > we've seen. Of course the kernel developers ought to be free to treat > arguably-GPL-2.0-or-later code as GPL-2.0-only anyway. Explicit "or later" notices should be treated just like that, "explicit or later notices" :) But to say that somehow the fact that if I wrote: The license of this file is to be found in LICENSES in the root of this project. and that file was "GPLv2", I would strongly say that the license of that file is "GPLv2-only". To say "or later" is crazy, why not just say it also means "dual BSD"? :) > > So I really do not think that the fact that the link pointed to a v2 > > license, somehow saying that means that _any_ version of the license > > applies here at all. > > It's not that the link points to a v2 license but rather (for me) it's > the absence of anything even hinting at a desire to limit versions to > v2 in the license notice, beyond the mere fact that the version of the > GPL referenced is GPLv2. None of us thought you had to explicitly "limit" license changes to be "or later" if you did not actually say "or later". To not have that text in the file, means "this and only this", right? thanks, greg k-h