[PATCH 1/6] iw: Fix license field to BSD-2-Clause

[PATCH 1/6] iw: Fix license field to BSD-2-Clause

[Wes Lindauer]

Using just "BSD" license implies BSD-3-Clause and this recipe appears to
be closer to a BSD-2-Clause.
---
 meta/recipes-connectivity/iw/iw_5.0.1.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-connectivity/iw/iw_5.0.1.bb b/meta/recipes-connectivity/iw/iw_5.0.1.bb
index e127963513..87b21e668d 100644
--- a/meta/recipes-connectivity/iw/iw_5.0.1.bb
+++ b/meta/recipes-connectivity/iw/iw_5.0.1.bb
@@ -4,7 +4,7 @@ wireless devices. It supports almost all new drivers that have been added \
 to the kernel recently. "
 HOMEPAGE = "http://wireless.kernel.org/en/users/Documentation/iw"
 SECTION = "base"
-LICENSE = "BSD"
+LICENSE = "BSD-2-Clause"
 LIC_FILES_CHKSUM = "file://COPYING;md5=878618a5c4af25e9b93ef0be1a93f774"
 
 DEPENDS = "libnl"
-- 
2.14.5

[PATCH 2/6] openssh: Update LICENSE field with missing values

[Wes Lindauer]

The LICENSE file states that some code is licensed under BSD, some under
ISC, and some under MIT. The LICENSE field should reflect all of these.
---
 meta/recipes-connectivity/openssh/openssh_8.0p1.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-connectivity/openssh/openssh_8.0p1.bb b/meta/recipes-connectivity/openssh/openssh_8.0p1.bb
index 35cdf71eb3..01eaecd4ec 100644
--- a/meta/recipes-connectivity/openssh/openssh_8.0p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_8.0p1.bb
@@ -5,7 +5,7 @@ Ssh (Secure Shell) is a program for logging into a remote machine \
 and for executing commands on a remote machine."
 HOMEPAGE = "http://www.openssh.com/"
 SECTION = "console/network"
-LICENSE = "BSD"
+LICENSE = "BSD & ISC & MIT"
 LIC_FILES_CHKSUM = "file://LICENCE;md5=429658c6612f3a9b1293782366ab29d8"
 
 DEPENDS = "zlib openssl virtual/crypt"
-- 
2.14.5

[PATCH 3/6] shadow: Fix BSD license file checksum

[Wes Lindauer]

BSD license files must include the copyright notice.
---
 meta/recipes-extended/shadow/shadow.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/shadow/shadow.inc b/meta/recipes-extended/shadow/shadow.inc
index 7f82d20826..6d9e300739 100644
--- a/meta/recipes-extended/shadow/shadow.inc
+++ b/meta/recipes-extended/shadow/shadow.inc
@@ -4,7 +4,7 @@ BUGTRACKER = "https://alioth.debian.org/tracker/?group_id=30580"
 SECTION = "base/utils"
 LICENSE = "BSD | Artistic-1.0"
 LIC_FILES_CHKSUM = "file://COPYING;md5=ed80ff1c2b40843cf5768e5229cf16e5 \
-                    file://src/passwd.c;beginline=8;endline=30;md5=d83888ea14ae61951982d77125947661"
+                    file://src/passwd.c;beginline=2;endline=30;md5=5720ff729a6ff39ecc9f64555d75f4af"
 
 DEPENDS = "virtual/crypt"
 
-- 
2.14.5

[PATCH 4/6] sudo: Fix BSD license file checksum

[Wes Lindauer]

BSD license files must include the copyright notice.
---
 meta/recipes-extended/sudo/sudo.inc | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/meta/recipes-extended/sudo/sudo.inc b/meta/recipes-extended/sudo/sudo.inc
index 90f2039bb8..15075bcefd 100644
--- a/meta/recipes-extended/sudo/sudo.inc
+++ b/meta/recipes-extended/sudo/sudo.inc
@@ -6,12 +6,12 @@ SECTION = "admin"
 LICENSE = "ISC & BSD & Zlib"
 LIC_FILES_CHKSUM = "file://doc/LICENSE;md5=6c76b73603ac7763ab0516ebfbe67b42 \
                     file://plugins/sudoers/redblack.c;beginline=1;endline=46;md5=4a162fc04b86b03f5632180fe6076cda \
-                    file://lib/util/reallocarray.c;beginline=3;endline=16;md5=85b0905b795d4d58bf2e00635649eec6 \
+                    file://lib/util/reallocarray.c;beginline=3;endline=15;md5=b47f1f85a12f05a0744cd8b1b6f41a0d \
                     file://lib/util/fnmatch.c;beginline=3;endline=27;md5=67f83ee9bd456557397082f8f1be0efd \
-                    file://lib/util/getcwd.c;beginline=5;endline=27;md5=449af4cc57fc7d46f42090608ba3e681 \
-                    file://lib/util/glob.c;beginline=6;endline=31;md5=5872733146b9eb0deb79e1f664815b85 \
-                    file://lib/util/snprintf.c;beginline=6;endline=34;md5=c82c1b3a5c32e08545c9ec5d71e41e50 \
-                    file://include/sudo_queue.h;beginline=5;endline=27;md5=449af4cc57fc7d46f42090608ba3e681 \
+                    file://lib/util/getcwd.c;beginline=2;endline=27;md5=09068a19b4f6b6f0a0958655bfe98b63 \
+                    file://lib/util/glob.c;beginline=2;endline=31;md5=1f2f771c35fb0658d567a7824007e56d \
+                    file://lib/util/snprintf.c;beginline=3;endline=33;md5=63e48e1b992bce749a19dd9b2256e9a0 \
+                    file://include/sudo_queue.h;beginline=2;endline=27;md5=082b138b72ba3e568a13a25c3bf254dc \
                     file://lib/util/inet_pton.c;beginline=3;endline=17;md5=3970ab0518ab79cbd0bafb697f10b33a \
                     file://lib/util/arc4random.c;beginline=3;endline=20;md5=15bdc89c1b003fa4d7353e6296ebfd68 \
                     file://lib/util/arc4random_uniform.c;beginline=3;endline=17;md5=31e630ac814d692fd0ab7a942659b46f \
-- 
2.14.5

[PATCH 5/6] libunwind: Fix MIT license file checksum

[Wes Lindauer]

MIT license files must include the copyright notice.
---
 meta/recipes-support/libunwind/libunwind.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-support/libunwind/libunwind.inc b/meta/recipes-support/libunwind/libunwind.inc
index 36851d07ed..5726589661 100644
--- a/meta/recipes-support/libunwind/libunwind.inc
+++ b/meta/recipes-support/libunwind/libunwind.inc
@@ -2,7 +2,7 @@ SUMMARY = "Library for obtaining the call-chain of a program"
 DESCRIPTION = "a portable and efficient C programming interface (API) to determine the call-chain of a program"
 HOMEPAGE = "http://www.nongnu.org/libunwind"
 LICENSE = "MIT"
-LIC_FILES_CHKSUM = "file://COPYING;beginline=3;md5=3fced11d6df719b47505837a51c16ae5"
+LIC_FILES_CHKSUM = "file://COPYING;md5=2d80c8ed4062b8339b715f90fa68cc9f"
 DEPENDS += "libatomic-ops"
 
 inherit autotools multilib_header
-- 
2.14.5

[PATCH 6/6] xz: Remove GPLv3 license checksum

[Wes Lindauer]

Although xz has some files that are GPLv3 licensed, none of them get
packaged up, and therefore none of it ends up in the final rootfs. Since
there is no GPLv3 code in the final image, we don't want to include it
when we collect licenses, as that would give the incorrect impression
that the image contains GPLv3 code.

Also fixes the endline for getopt.c which had a couple of non-license
text lines at the bottom.
---
 meta/recipes-extended/xz/xz_5.2.4.bb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/meta/recipes-extended/xz/xz_5.2.4.bb b/meta/recipes-extended/xz/xz_5.2.4.bb
index 791746e1cf..e6725e5f12 100644
--- a/meta/recipes-extended/xz/xz_5.2.4.bb
+++ b/meta/recipes-extended/xz/xz_5.2.4.bb
@@ -17,9 +17,8 @@ LICENSE_liblzma = "PD"
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
                     file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
-                    file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
                     file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
-                    file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
+                    file://lib/getopt.c;endline=21;md5=32575ca1a42c5fa04aac6f08566ddf48 \
                     "
 
 SRC_URI = "http://tukaani.org/xz/xz-${PV}.tar.gz"
-- 
2.14.5

✗ patchtest: failure for "iw: Fix license field to BSD-2..." and 5 more

[Patchwork]

== Series Details ==

Series: "iw: Fix license field to BSD-2..." and 5 more
Revision: 1
URL   : https://patchwork.openembedded.org/series/19323/
State : failure

== Summary ==


Thank you for submitting this patch series to OpenEmbedded Core. This is
an automated response. Several tests have been executed on the proposed
series by patchtest resulting in the following failures:



* Patch            [1/6] iw: Fix license field to BSD-2-Clause
 Issue             Patch is missing Signed-off-by [test_signed_off_by_presence] 
  Suggested fix    Sign off the patch (either manually or with "git commit --amend -s")



If you believe any of these test results are incorrect, please reply to the
mailing list (openembedded-core@lists.openembedded.org) raising your concerns.
Otherwise we would appreciate you correcting the issues and submitting a new
version of the patchset if applicable. Please ensure you add/increment the
version number when sending the new version (i.e. [PATCH] -> [PATCH v2] ->
[PATCH v3] -> ...).

---
Guidelines:     https://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines
Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest
Test suite:     http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Khem Raj]

On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer <wesley.lindauer@gmail.com> wrote:
>
> Although xz has some files that are GPLv3 licensed, none of them get
> packaged up, and therefore none of it ends up in the final rootfs. Since
> there is no GPLv3 code in the final image, we don't want to include it
> when we collect licenses, as that would give the incorrect impression
> that the image contains GPLv3 code.

We will be distributing this in src packages though. Maybe these files
should be deleted before the build even starts.
>
> Also fixes the endline for getopt.c which had a couple of non-license
> text lines at the bottom.
> ---
>  meta/recipes-extended/xz/xz_5.2.4.bb | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/meta/recipes-extended/xz/xz_5.2.4.bb b/meta/recipes-extended/xz/xz_5.2.4.bb
> index 791746e1cf..e6725e5f12 100644
> --- a/meta/recipes-extended/xz/xz_5.2.4.bb
> +++ b/meta/recipes-extended/xz/xz_5.2.4.bb
> @@ -17,9 +17,8 @@ LICENSE_liblzma = "PD"
>
>  LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
>                      file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
> -                    file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
>                      file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
> -                    file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
> +                    file://lib/getopt.c;endline=21;md5=32575ca1a42c5fa04aac6f08566ddf48 \
>                      "
>
>  SRC_URI = "http://tukaani.org/xz/xz-${PV}.tar.gz"
> --
> 2.14.5
>
> --
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Wes Lindauer]

[-- Attachment #1: Type: text/plain, Size: 2574 bytes --]

Yes, I see that could be a valid concern. Is this a sign that poky needs
per-package LIC_FILES_CHKSUM variables the same way each package can set
different LICENSE values? I would like to continue to use Yocto to collect
licenses for compliance reasons, but in this case I am getting an incorrect
license file in my image. In my configuration, I am placing "GPLv3" in
INCOMPATIBLE_LICENSES. Is there any way to use this information at rootfs
time to exclude GPLv3 licenses from being collected? Do you have any
recommendations for how I should proceed with collecting accurate licenses
in my image?

Thanks for your help,
Wes L

On Fri, Aug 16, 2019 at 4:50 PM Khem Raj <raj.khem@gmail.com> wrote:

> On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer <wesley.lindauer@gmail.com>
> wrote:
> >
> > Although xz has some files that are GPLv3 licensed, none of them get
> > packaged up, and therefore none of it ends up in the final rootfs. Since
> > there is no GPLv3 code in the final image, we don't want to include it
> > when we collect licenses, as that would give the incorrect impression
> > that the image contains GPLv3 code.
>
> We will be distributing this in src packages though. Maybe these files
> should be deleted before the build even starts.
> >
> > Also fixes the endline for getopt.c which had a couple of non-license
> > text lines at the bottom.
> > ---
> >  meta/recipes-extended/xz/xz_5.2.4.bb | 3 +--
> >  1 file changed, 1 insertion(+), 2 deletions(-)
> >
> > diff --git a/meta/recipes-extended/xz/xz_5.2.4.bb
> b/meta/recipes-extended/xz/xz_5.2.4.bb
> > index 791746e1cf..e6725e5f12 100644
> > --- a/meta/recipes-extended/xz/xz_5.2.4.bb
> > +++ b/meta/recipes-extended/xz/xz_5.2.4.bb
> > @@ -17,9 +17,8 @@ LICENSE_liblzma = "PD"
> >
> >  LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a
> \
> >
> file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
> > -
> file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
> >
> file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
> > -
> file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
> > +
> file://lib/getopt.c;endline=21;md5=32575ca1a42c5fa04aac6f08566ddf48 \
> >                      "
> >
> >  SRC_URI = "http://tukaani.org/xz/xz-${PV}.tar.gz"
> > --
> > 2.14.5
> >
> > --
> > _______________________________________________
> > Openembedded-core mailing list
> > Openembedded-core@lists.openembedded.org
> > http://lists.openembedded.org/mailman/listinfo/openembedded-core
>

[-- Attachment #2: Type: text/html, Size: 3936 bytes --]

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Adrian Bunk]

On Fri, Aug 16, 2019 at 01:50:14PM -0700, Khem Raj wrote:
> On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer <wesley.lindauer@gmail.com> wrote:
> >
> > Although xz has some files that are GPLv3 licensed, none of them get
> > packaged up, and therefore none of it ends up in the final rootfs. Since
> > there is no GPLv3 code in the final image, we don't want to include it
> > when we collect licenses, as that would give the incorrect impression
> > that the image contains GPLv3 code.
> 
> We will be distributing this in src packages though. Maybe these files
> should be deleted before the build even starts.

OE does licence tracking on binary packages, not on source packages.

There are recipes that build binary packages with different licences 
from the same sources.

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Mark Hatle]

On 8/27/19 1:04 PM, Adrian Bunk wrote:
> On Fri, Aug 16, 2019 at 01:50:14PM -0700, Khem Raj wrote:
>> On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer <wesley.lindauer@gmail.com> wrote:
>>>
>>> Although xz has some files that are GPLv3 licensed, none of them get
>>> packaged up, and therefore none of it ends up in the final rootfs. Since
>>> there is no GPLv3 code in the final image, we don't want to include it
>>> when we collect licenses, as that would give the incorrect impression
>>> that the image contains GPLv3 code.
>>
>> We will be distributing this in src packages though. Maybe these files
>> should be deleted before the build even starts.
> 
> OE does licence tracking on binary packages, not on source packages.

It tracks -both-.  Since MOST recipes and binary packages agree, people don't
often know this.

LICENSE is the -recipe source license-.  Nothing more nothing less.  It
typically does NOT include the license of things used to build the software
(such as makefiles, autoconf fragments, etc), but must include the license of
any sources that are or may be used to construct binaries.

LICENSE_<package> is automatically defined as LICENSE.  If a binary package has
a difference license (which must ALWAYS be a subset of the recipe LICENSE), then
it can be specified independently.

See sysfsutils as an example:

LICENSE = "GPLv2 & LGPLv2.1"
LICENSE_${PN} = "GPLv2"
LICENSE_libsysfs = "LGPLv2.1"

recipe is made of of source code consisting of GPLv2 and LGPLv2.1.

The LICENSE_${PN} is expected to be GPLv2, while the LICENSE_libsysfs is
expected to be LGPLv2.1.


The LIC_FILES_CHKSUM is supposed to represent the -recipe- source license.  If
the component is used to build the binaries, then it needs to be listed (but
only has to be listed once).

If the component MIGHT be used, it needs to be listed.

If the component will NOT be used, then it should not be listed (and it's
advised to remove it from the source to avoid accidental usage...)

--Mark


> There are recipes that build binary packages with different licences 
> from the same sources.
> 
> cu
> Adrian
> 

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Wes Lindauer]

[-- Attachment #1: Type: text/plain, Size: 2906 bytes --]

Mark,

In reference to "It typically does NOT include the license of things used
to build the software (such as makefiles, autoconf fragments, etc)".
Since the only file that is licensed under GPLv3 is a M4 macro, does that
mean the current patch is still valid? Shouldn't the GPLv3 license be
removed from this recipe?

Wes L

On Tue, Aug 27, 2019 at 2:28 PM Mark Hatle <mark.hatle@windriver.com> wrote:

> On 8/27/19 1:04 PM, Adrian Bunk wrote:
> > On Fri, Aug 16, 2019 at 01:50:14PM -0700, Khem Raj wrote:
> >> On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer <
> wesley.lindauer@gmail.com> wrote:
> >>>
> >>> Although xz has some files that are GPLv3 licensed, none of them get
> >>> packaged up, and therefore none of it ends up in the final rootfs.
> Since
> >>> there is no GPLv3 code in the final image, we don't want to include it
> >>> when we collect licenses, as that would give the incorrect impression
> >>> that the image contains GPLv3 code.
> >>
> >> We will be distributing this in src packages though. Maybe these files
> >> should be deleted before the build even starts.
> >
> > OE does licence tracking on binary packages, not on source packages.
>
> It tracks -both-.  Since MOST recipes and binary packages agree, people
> don't
> often know this.
>
> LICENSE is the -recipe source license-.  Nothing more nothing less.  It
> typically does NOT include the license of things used to build the software
> (such as makefiles, autoconf fragments, etc), but must include the license
> of
> any sources that are or may be used to construct binaries.
>
> LICENSE_<package> is automatically defined as LICENSE.  If a binary
> package has
> a difference license (which must ALWAYS be a subset of the recipe
> LICENSE), then
> it can be specified independently.
>
> See sysfsutils as an example:
>
> LICENSE = "GPLv2 & LGPLv2.1"
> LICENSE_${PN} = "GPLv2"
> LICENSE_libsysfs = "LGPLv2.1"
>
> recipe is made of of source code consisting of GPLv2 and LGPLv2.1.
>
> The LICENSE_${PN} is expected to be GPLv2, while the LICENSE_libsysfs is
> expected to be LGPLv2.1.
>
>
> The LIC_FILES_CHKSUM is supposed to represent the -recipe- source
> license.  If
> the component is used to build the binaries, then it needs to be listed
> (but
> only has to be listed once).
>
> If the component MIGHT be used, it needs to be listed.
>
> If the component will NOT be used, then it should not be listed (and it's
> advised to remove it from the source to avoid accidental usage...)
>
> --Mark
>
>
> > There are recipes that build binary packages with different licences
> > from the same sources.
> >
> > cu
> > Adrian
> >
>
> --
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core
>

[-- Attachment #2: Type: text/html, Size: 3810 bytes --]

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Mark Hatle]

On 9/3/19 1:59 PM, Wes Lindauer wrote:
> Mark,
> 
> In reference to "It typically does NOT include the license of things used to
> build the software (such as makefiles, autoconf fragments, etc)".
> Since the only file that is licensed under GPLv3 is a M4 macro, does that mean
> the current patch is still valid? Shouldn't the GPLv3 license be removed from
> this recipe?

Unless the M4 file is generating/injecting code into the build(very few I've
seen do this), then I would say it's not under GPLv3 at all.  (And I wouldn't
have included GPLv3 in the LICENSE statement.)

But we need more consensus then just me saying so.

This may be a good question for the OE-TSC to ensure that we have clarification
on this issue, and it's not just me saying I think one way or another.

--Mark

> Wes L
> 
> On Tue, Aug 27, 2019 at 2:28 PM Mark Hatle <mark.hatle@windriver.com
> <mailto:mark.hatle@windriver.com>> wrote:
> 
>     On 8/27/19 1:04 PM, Adrian Bunk wrote:
>     > On Fri, Aug 16, 2019 at 01:50:14PM -0700, Khem Raj wrote:
>     >> On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer <wesley.lindauer@gmail.com
>     <mailto:wesley.lindauer@gmail.com>> wrote:
>     >>>
>     >>> Although xz has some files that are GPLv3 licensed, none of them get
>     >>> packaged up, and therefore none of it ends up in the final rootfs. Since
>     >>> there is no GPLv3 code in the final image, we don't want to include it
>     >>> when we collect licenses, as that would give the incorrect impression
>     >>> that the image contains GPLv3 code.
>     >>
>     >> We will be distributing this in src packages though. Maybe these files
>     >> should be deleted before the build even starts.
>     >
>     > OE does licence tracking on binary packages, not on source packages.
> 
>     It tracks -both-.  Since MOST recipes and binary packages agree, people don't
>     often know this.
> 
>     LICENSE is the -recipe source license-.  Nothing more nothing less.  It
>     typically does NOT include the license of things used to build the software
>     (such as makefiles, autoconf fragments, etc), but must include the license of
>     any sources that are or may be used to construct binaries.
> 
>     LICENSE_<package> is automatically defined as LICENSE.  If a binary package has
>     a difference license (which must ALWAYS be a subset of the recipe LICENSE), then
>     it can be specified independently.
> 
>     See sysfsutils as an example:
> 
>     LICENSE = "GPLv2 & LGPLv2.1"
>     LICENSE_${PN} = "GPLv2"
>     LICENSE_libsysfs = "LGPLv2.1"
> 
>     recipe is made of of source code consisting of GPLv2 and LGPLv2.1.
> 
>     The LICENSE_${PN} is expected to be GPLv2, while the LICENSE_libsysfs is
>     expected to be LGPLv2.1.
> 
> 
>     The LIC_FILES_CHKSUM is supposed to represent the -recipe- source license.  If
>     the component is used to build the binaries, then it needs to be listed (but
>     only has to be listed once).
> 
>     If the component MIGHT be used, it needs to be listed.
> 
>     If the component will NOT be used, then it should not be listed (and it's
>     advised to remove it from the source to avoid accidental usage...)
> 
>     --Mark
> 
> 
>     > There are recipes that build binary packages with different licences
>     > from the same sources.
>     >
>     > cu
>     > Adrian
>     >
> 
>     -- 
>     _______________________________________________
>     Openembedded-core mailing list
>     Openembedded-core@lists.openembedded.org
>     <mailto:Openembedded-core@lists.openembedded.org>
>     http://lists.openembedded.org/mailman/listinfo/openembedded-core
> 

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Richard Purdie]

On Wed, 2019-09-04 at 08:07 -0400, Mark Hatle wrote:
> On 9/3/19 1:59 PM, Wes Lindauer wrote:
> > Mark,
> > 
> > In reference to "It typically does NOT include the license of
> > things used to
> > build the software (such as makefiles, autoconf fragments, etc)".
> > Since the only file that is licensed under GPLv3 is a M4 macro,
> > does that mean
> > the current patch is still valid? Shouldn't the GPLv3 license be
> > removed from
> > this recipe?
> 
> Unless the M4 file is generating/injecting code into the build(very
> few I've
> seen do this), then I would say it's not under GPLv3 at all.  (And I
> wouldn't
> have included GPLv3 in the LICENSE statement.)
> 
> But we need more consensus then just me saying so.
> 
> This may be a good question for the OE-TSC to ensure that we have
> clarification
> on this issue, and it's not just me saying I think one way or
> another.

Not sure it needs to go to the TSC, we just need a patch which clearly
says why the LICENSE statement is incorrect. I don't think the original
patch in the series was clear about why GPLv3 didn't apply but if the
commit message is improved, its probably fine.

Cheers,

Richard

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Adrian Bunk]

On Wed, Sep 04, 2019 at 07:50:35PM +0100, Richard Purdie wrote:
> On Wed, 2019-09-04 at 08:07 -0400, Mark Hatle wrote:
> > On 9/3/19 1:59 PM, Wes Lindauer wrote:
> > > Mark,
> > > 
> > > In reference to "It typically does NOT include the license of
> > > things used to
> > > build the software (such as makefiles, autoconf fragments, etc)".
> > > Since the only file that is licensed under GPLv3 is a M4 macro,
> > > does that mean
> > > the current patch is still valid? Shouldn't the GPLv3 license be
> > > removed from
> > > this recipe?
> > 
> > Unless the M4 file is generating/injecting code into the build(very
> > few I've
> > seen do this), then I would say it's not under GPLv3 at all.  (And I
> > wouldn't
> > have included GPLv3 in the LICENSE statement.)
> > 
> > But we need more consensus then just me saying so.
> > 
> > This may be a good question for the OE-TSC to ensure that we have
> > clarification
> > on this issue, and it's not just me saying I think one way or
> > another.
> 
> Not sure it needs to go to the TSC, we just need a patch which clearly
> says why the LICENSE statement is incorrect. I don't think the original
> patch in the series was clear about why GPLv3 didn't apply but if the
> commit message is improved, its probably fine.

I am getting more and more confused about both the patch and the 
semantics of LICENSE.

The status quo in the recipe is:

<--  snip  ->

# The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the only file
# which is GPLv3 is an m4 macro which isn't shipped in any of our packages,
# and the LGPL bits are under lib/, which appears to be used for libgnu, which
# appears to be used for DOS builds. So we're left with GPLv2+ and PD.
LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ & PD"
LICENSE_${PN} = "GPLv2+"
LICENSE_${PN}-dev = "GPLv2+"
LICENSE_${PN}-staticdev = "GPLv2+"
LICENSE_${PN}-doc = "GPLv2+"
LICENSE_${PN}-dbg = "GPLv2+"
LICENSE_${PN}-locale = "GPLv2+"
LICENSE_liblzma = "PD"

LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
                    file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
                    file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
                    file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
                    file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
                    "

<--  snip  -->

My confusion about the patch is that it removes COPYING.GPLv3 from 
LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in LICENSE.

My confusion about the semantics of LICENSE is that I fail to find a 
clear statement in the documentation that the legal meaning of LICENSE 
in OE is what Mark claims it would be. Is this just Marks personal 
opinion on what should be done, or is this undocumented tribal 
knowledge, or is the exact semantics of LICENSE documented
somewhere in a language that lawyers understand?

My guess for the latter would be "undocumented tribal knowledge",
and clarification is required what is actually correct or incorrect
here. And I think this is also what Mark was asking for.

> Cheers,
> 
> Richard

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Mark Hatle]

On 9/4/19 3:53 PM, Adrian Bunk wrote:
> On Wed, Sep 04, 2019 at 07:50:35PM +0100, Richard Purdie wrote:
>> On Wed, 2019-09-04 at 08:07 -0400, Mark Hatle wrote:
>>> On 9/3/19 1:59 PM, Wes Lindauer wrote:
>>>> Mark,
>>>>
>>>> In reference to "It typically does NOT include the license of
>>>> things used to
>>>> build the software (such as makefiles, autoconf fragments, etc)".
>>>> Since the only file that is licensed under GPLv3 is a M4 macro,
>>>> does that mean
>>>> the current patch is still valid? Shouldn't the GPLv3 license be
>>>> removed from
>>>> this recipe?
>>>
>>> Unless the M4 file is generating/injecting code into the build(very
>>> few I've
>>> seen do this), then I would say it's not under GPLv3 at all.  (And I
>>> wouldn't
>>> have included GPLv3 in the LICENSE statement.)
>>>
>>> But we need more consensus then just me saying so.
>>>
>>> This may be a good question for the OE-TSC to ensure that we have
>>> clarification
>>> on this issue, and it's not just me saying I think one way or
>>> another.
>>
>> Not sure it needs to go to the TSC, we just need a patch which clearly
>> says why the LICENSE statement is incorrect. I don't think the original
>> patch in the series was clear about why GPLv3 didn't apply but if the
>> commit message is improved, its probably fine.
> 
> I am getting more and more confused about both the patch and the 
> semantics of LICENSE.
> 
> The status quo in the recipe is:
> 
> <--  snip  ->
> 
> # The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the only file
> # which is GPLv3 is an m4 macro which isn't shipped in any of our packages,
> # and the LGPL bits are under lib/, which appears to be used for libgnu, which
> # appears to be used for DOS builds. So we're left with GPLv2+ and PD.
> LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ & PD"
> LICENSE_${PN} = "GPLv2+"
> LICENSE_${PN}-dev = "GPLv2+"
> LICENSE_${PN}-staticdev = "GPLv2+"
> LICENSE_${PN}-doc = "GPLv2+"
> LICENSE_${PN}-dbg = "GPLv2+"
> LICENSE_${PN}-locale = "GPLv2+"
> LICENSE_liblzma = "PD"
> 
> LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
>                     file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
>                     file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
>                     file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
>                     file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
>                     "
> 
> <--  snip  -->
> 
> My confusion about the patch is that it removes COPYING.GPLv3 from 
> LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in LICENSE.
> 
> My confusion about the semantics of LICENSE is that I fail to find a 
> clear statement in the documentation that the legal meaning of LICENSE 
> in OE is what Mark claims it would be. Is this just Marks personal 
> opinion on what should be done, or is this undocumented tribal 
> knowledge, or is the exact semantics of LICENSE documented
> somewhere in a language that lawyers understand?
> 
> My guess for the latter would be "undocumented tribal knowledge",
> and clarification is required what is actually correct or incorrect
> here. And I think this is also what Mark was asking for.

It -was- documented at one time, but I suspect that documentation was revised
and the language was lost (or it never made it into a final version of the docs.)

This is why I was suggesting the TSC weigh in, and just clarify that:

LICENSE = is the _source code_ license, and only includes items that are or
could be included in the making of the binaries.  This does NOT include
autoconf, automake, makefiles, etc that are only used during the build process,
but not in the sources used to build the outputs.

LICENSE_<pkg> = is the binary license for a specific package.  It defaults to
the same as the LICENSE.

--Mark

>> Cheers,
>>
>> Richard
> 
> cu
> Adrian
> 

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Adrian Bunk]

On Wed, Sep 04, 2019 at 08:07:58AM -0400, Mark Hatle wrote:
> On 9/3/19 1:59 PM, Wes Lindauer wrote:
>...
> > In reference to "It typically does NOT include the license of things used to
> > build the software (such as makefiles, autoconf fragments, etc)".
> > Since the only file that is licensed under GPLv3 is a M4 macro, does that mean
> > the current patch is still valid? Shouldn't the GPLv3 license be removed from
> > this recipe?
> 
> Unless the M4 file is generating/injecting code into the build(very few I've
> seen do this),
>...

If the defines in config.h are "code" then many do.

> --Mark

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Mark Hatle]

On 9/4/19 4:18 PM, Mark Hatle wrote:
> On 9/4/19 3:53 PM, Adrian Bunk wrote:
>> On Wed, Sep 04, 2019 at 07:50:35PM +0100, Richard Purdie wrote:
>>> On Wed, 2019-09-04 at 08:07 -0400, Mark Hatle wrote:
>>>> On 9/3/19 1:59 PM, Wes Lindauer wrote:
>>>>> Mark,
>>>>>
>>>>> In reference to "It typically does NOT include the license of
>>>>> things used to
>>>>> build the software (such as makefiles, autoconf fragments, etc)".
>>>>> Since the only file that is licensed under GPLv3 is a M4 macro,
>>>>> does that mean
>>>>> the current patch is still valid? Shouldn't the GPLv3 license be
>>>>> removed from
>>>>> this recipe?
>>>>
>>>> Unless the M4 file is generating/injecting code into the build(very
>>>> few I've
>>>> seen do this), then I would say it's not under GPLv3 at all.  (And I
>>>> wouldn't
>>>> have included GPLv3 in the LICENSE statement.)
>>>>
>>>> But we need more consensus then just me saying so.
>>>>
>>>> This may be a good question for the OE-TSC to ensure that we have
>>>> clarification
>>>> on this issue, and it's not just me saying I think one way or
>>>> another.
>>>
>>> Not sure it needs to go to the TSC, we just need a patch which clearly
>>> says why the LICENSE statement is incorrect. I don't think the original
>>> patch in the series was clear about why GPLv3 didn't apply but if the
>>> commit message is improved, its probably fine.
>>
>> I am getting more and more confused about both the patch and the 
>> semantics of LICENSE.
>>
>> The status quo in the recipe is:
>>
>> <--  snip  ->
>>
>> # The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the only file
>> # which is GPLv3 is an m4 macro which isn't shipped in any of our packages,
>> # and the LGPL bits are under lib/, which appears to be used for libgnu, which
>> # appears to be used for DOS builds. So we're left with GPLv2+ and PD.
>> LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ & PD"
>> LICENSE_${PN} = "GPLv2+"
>> LICENSE_${PN}-dev = "GPLv2+"
>> LICENSE_${PN}-staticdev = "GPLv2+"
>> LICENSE_${PN}-doc = "GPLv2+"
>> LICENSE_${PN}-dbg = "GPLv2+"
>> LICENSE_${PN}-locale = "GPLv2+"
>> LICENSE_liblzma = "PD"
>>
>> LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
>>                     file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
>>                     file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
>>                     file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
>>                     file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
>>                     "
>>
>> <--  snip  -->
>>
>> My confusion about the patch is that it removes COPYING.GPLv3 from 
>> LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in LICENSE.
>>
>> My confusion about the semantics of LICENSE is that I fail to find a 
>> clear statement in the documentation that the legal meaning of LICENSE 
>> in OE is what Mark claims it would be. Is this just Marks personal 
>> opinion on what should be done, or is this undocumented tribal 
>> knowledge, or is the exact semantics of LICENSE documented
>> somewhere in a language that lawyers understand?
>>
>> My guess for the latter would be "undocumented tribal knowledge",
>> and clarification is required what is actually correct or incorrect
>> here. And I think this is also what Mark was asking for.
> 
> It -was- documented at one time, but I suspect that documentation was revised
> and the language was lost (or it never made it into a final version of the docs.)
> 
> This is why I was suggesting the TSC weigh in, and just clarify that:
> 
> LICENSE = is the _source code_ license, and only includes items that are or
> could be included in the making of the binaries.  This does NOT include
> autoconf, automake, makefiles, etc that are only used during the build process,
> but not in the sources used to build the outputs.
> 
> LICENSE_<pkg> = is the binary license for a specific package.  It defaults to
> the same as the LICENSE.

Replying to myself....  from meta/conf/documentation.conf:

LICENSE[doc] = "The list of source licenses for the recipe. Logical operators
'&' or '|' and parentheses can be used."


Not sure if this clarifies, but that is the internally documented version.

From the current mega-manual:

LICENSE: This variable specifies the license for the software. If you do not
know the license under which the software you are building is distributed, you
should go to the source code and look for that information. Typical files
containing this information include COPYING, LICENSE, and README files. You
could also find the information near the top of a source file.


So again, my reading is not compiled (output) items, like autoconf, makefiles,
etc would not be considered 'source code'.  But again, I think this really
requires clarification so there is no ambiguity as to what was intended.

--Mark

> --Mark
> 
>>> Cheers,
>>>
>>> Richard
>>
>> cu
>> Adrian
>>
> 

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[richard.purdie]

On Wed, 2019-09-04 at 16:18 -0400, Mark Hatle wrote:
> On 9/4/19 3:53 PM, Adrian Bunk wrote:
> > I am getting more and more confused about both the patch and the 
> > semantics of LICENSE.
> > 
> > The status quo in the recipe is:
> > 
> > <--  snip  ->
> > 
> > # The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the
> > only file
> > # which is GPLv3 is an m4 macro which isn't shipped in any of our
> > packages,
> > # and the LGPL bits are under lib/, which appears to be used for
> > libgnu, which
> > # appears to be used for DOS builds. So we're left with GPLv2+ and
> > PD.
> > LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ &
> > PD"
> > LICENSE_${PN} = "GPLv2+"
> > LICENSE_${PN}-dev = "GPLv2+"
> > LICENSE_${PN}-staticdev = "GPLv2+"
> > LICENSE_${PN}-doc = "GPLv2+"
> > LICENSE_${PN}-dbg = "GPLv2+"
> > LICENSE_${PN}-locale = "GPLv2+"
> > LICENSE_liblzma = "PD"
> > 
> > LIC_FILES_CHKSUM =
> > "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
> >                     file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80
> > fdaf4a4263 \
> >                     file://COPYING.GPLv3;md5=d32239bcb673463ab874e8
> > 0d47fae504 \
> >                     file://COPYING.LGPLv2.1;md5=4fbd65380cdd2559510
> > 79008b364516c \
> >                     file://lib/getopt.c;endline=23;md5=2069b0ee7105
> > 72c03bb3114e4532cd84 \
> >                     "
> > 
> > <--  snip  -->
> > 
> > My confusion about the patch is that it removes COPYING.GPLv3 from 
> > LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in
> > LICENSE.
> > 
> > My confusion about the semantics of LICENSE is that I fail to find
> > a 
> > clear statement in the documentation that the legal meaning of
> > LICENSE 
> > in OE is what Mark claims it would be. Is this just Marks personal 
> > opinion on what should be done, or is this undocumented tribal 
> > knowledge, or is the exact semantics of LICENSE documented
> > somewhere in a language that lawyers understand?
> > 
> > My guess for the latter would be "undocumented tribal knowledge",
> > and clarification is required what is actually correct or incorrect
> > here. And I think this is also what Mark was asking for.
> 
> It -was- documented at one time, but I suspect that documentation was
> revised
> and the language was lost (or it never made it into a final version
> of the docs.)
> 
> This is why I was suggesting the TSC weigh in, and just clarify that:
> 
> LICENSE = is the _source code_ license, and only includes items that
> are or
> could be included in the making of the binaries.  This does NOT
> include
> autoconf, automake, makefiles, etc that are only used during the
> build process,
> but not in the sources used to build the outputs.
> 
> LICENSE_<pkg> = is the binary license for a specific package.  It
> defaults to
> the same as the LICENSE.

Historically, most m4 files don't include their license. This meant
that we haven't accounted for them in LICENSE. Where they are present,
we've tended to turn a blind eye to them as they don't cover the
binaries produced which is the piece of key importance to most people,
this recipe was one of the ones which attempted to clarify the
situation.

I suspect we do need to include such things in LICENSE since for
example these licenses could have an impact on the license of output
from the source archiver for example which might include build scripts.

The result is rather ugly but licensing in general is :(

It also gets tricky as we delete many autoconf files and regenerate
them. You'd hope that was under the same license but...

Cheers,

Richard

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Mark Hatle]

On 9/4/19 4:27 PM, Adrian Bunk wrote:
> On Wed, Sep 04, 2019 at 08:07:58AM -0400, Mark Hatle wrote:
>> On 9/3/19 1:59 PM, Wes Lindauer wrote:
>> ...
>>> In reference to "It typically does NOT include the license of things used to
>>> build the software (such as makefiles, autoconf fragments, etc)".
>>> Since the only file that is licensed under GPLv3 is a M4 macro, does that mean
>>> the current patch is still valid? Shouldn't the GPLv3 license be removed from
>>> this recipe?
>>
>> Unless the M4 file is generating/injecting code into the build(very few I've
>> seen do this),
>> ...
> 
> If the defines in config.h are "code" then many do.

Is there a license statement at the top of the config.h?  If so, then it counts.

Or is it just 'facts' (i.e. defines without any creative content)?  Then I don't
consider it relevant to the source license, based on statements I've seen elsewhere.

From the latest autoconf source code docs:

http://git.savannah.gnu.org/gitweb/?p=autoconf.git;a=blob;f=doc/autoconf.texi;h=2ac669696e730c051fbc072de4e5fe713f8b0f59;hb=HEAD

25843 @node Distributing
25844 @section Distributing @command{configure} Scripts
25845 @cindex License
25846
25847 @display
25848 What are the restrictions on distributing @command{configure}
25849 scripts that Autoconf generates?  How does that affect my
25850 programs that use them?
25851 @end display
25852
25853 There are no restrictions on how the configuration scripts that Autoconf
25854 produces may be distributed or used.  In Autoconf version 1, they were
25855 covered by the GNU General Public License.  We still encourage
25856 software authors to distribute their work under terms like those of the
25857 GPL, but doing so is not required to use Autoconf.
25858
25859 Of the other files that might be used with @command{configure},
25860 @file{config.h.in} is under whatever copyright you use for your
25861 @file{configure.ac}.  @file{config.sub} and @file{config.guess} have an
25862 exception to the GPL when they are used with an Autoconf-generated
25863 @command{configure} script, which permits you to distribute them under the
25864 same terms as the rest of your package.  @file{install-sh} is from the X
25865 Consortium and is not copyrighted.

So the terms of the config.h (from MY personal interpretation) is that it's
under the same terms as the how the rest of the source code is declared.  I.e.
even if autoconf is GPLv3, the output is not.

--Mark

>> --Mark
> 
> cu
> Adrian
> 

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Adrian Bunk]

On Wed, Sep 04, 2019 at 04:42:41PM -0400, Mark Hatle wrote:
> On 9/4/19 4:27 PM, Adrian Bunk wrote:
> > On Wed, Sep 04, 2019 at 08:07:58AM -0400, Mark Hatle wrote:
> >> On 9/3/19 1:59 PM, Wes Lindauer wrote:
> >> ...
> >>> In reference to "It typically does NOT include the license of things used to
> >>> build the software (such as makefiles, autoconf fragments, etc)".
> >>> Since the only file that is licensed under GPLv3 is a M4 macro, does that mean
> >>> the current patch is still valid? Shouldn't the GPLv3 license be removed from
> >>> this recipe?
> >>
> >> Unless the M4 file is generating/injecting code into the build(very few I've
> >> seen do this),
> >> ...
> > 
> > If the defines in config.h are "code" then many do.
> 
> Is there a license statement at the top of the config.h?  If so, then it counts.

No license statement is required for having copyright.

>...
> >From the latest autoconf source code docs:
>...

What comes from autoconf is GPL-3.0-with-autoconf-exception,
3rd party macros might have any license.

> Or is it just 'facts' (i.e. defines without any creative content)?  Then I don't
> consider it relevant to the source license,

When you argue along the lines of "generating/injecting code into the 
build" that sounds like what many autoconf macros are doing.

> based on statements I've seen elsewhere.
>...

Statements from lawyers, or from random non-lawyers on the internet like 
you and me who might be right or just repeat something incorrect?

The users for whom these questions actually matter most in practice
are lawyers from the "no GPLv3" camp, so their input might be useful.

> --Mark

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: [PATCH 6/6] xz: Remove GPLv3 license checksum

[Peter Kjellerstedt]

> -----Original Message-----
> From: openembedded-core-bounces@lists.openembedded.org <openembedded-
> core-bounces@lists.openembedded.org> On Behalf Of Adrian Bunk
> Sent: den 4 september 2019 21:54
> To: Richard Purdie <richard.purdie@linuxfoundation.org>
> Cc: Patches and discussions about the oe-core layer <openembedded-
> core@lists.openembedded.org>
> Subject: Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum
> 
> On Wed, Sep 04, 2019 at 07:50:35PM +0100, Richard Purdie wrote:
> > On Wed, 2019-09-04 at 08:07 -0400, Mark Hatle wrote:
> > > On 9/3/19 1:59 PM, Wes Lindauer wrote:
> > > > Mark,
> > > >
> > > > In reference to "It typically does NOT include the license of
> > > > things used to
> > > > build the software (such as makefiles, autoconf fragments, etc)".
> > > > Since the only file that is licensed under GPLv3 is a M4 macro,
> > > > does that mean
> > > > the current patch is still valid? Shouldn't the GPLv3 license be
> > > > removed from
> > > > this recipe?
> > >
> > > Unless the M4 file is generating/injecting code into the build(very
> > > few I've
> > > seen do this), then I would say it's not under GPLv3 at all.  (And
> I
> > > wouldn't
> > > have included GPLv3 in the LICENSE statement.)
> > >
> > > But we need more consensus then just me saying so.
> > >
> > > This may be a good question for the OE-TSC to ensure that we have
> > > clarification
> > > on this issue, and it's not just me saying I think one way or
> > > another.
> >
> > Not sure it needs to go to the TSC, we just need a patch which
> clearly
> > says why the LICENSE statement is incorrect. I don't think the
> original
> > patch in the series was clear about why GPLv3 didn't apply but if the
> > commit message is improved, its probably fine.
> 
> I am getting more and more confused about both the patch and the
> semantics of LICENSE.
> 
> The status quo in the recipe is:
> 
> <--  snip  ->
> 
> # The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the only
> file
> # which is GPLv3 is an m4 macro which isn't shipped in any of our
> packages,
> # and the LGPL bits are under lib/, which appears to be used for
> libgnu, which
> # appears to be used for DOS builds. So we're left with GPLv2+ and PD.
> LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ & PD"
> LICENSE_${PN} = "GPLv2+"
> LICENSE_${PN}-dev = "GPLv2+"
> LICENSE_${PN}-staticdev = "GPLv2+"
> LICENSE_${PN}-doc = "GPLv2+"
> LICENSE_${PN}-dbg = "GPLv2+"
> LICENSE_${PN}-locale = "GPLv2+"
> LICENSE_liblzma = "PD"
> 
> LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
> 
> file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
> 
> file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
> 
> file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
> 
> file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
>                     "
> 
> <--  snip  -->
> 
> My confusion about the patch is that it removes COPYING.GPLv3 from
> LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in LICENSE.
> 
> My confusion about the semantics of LICENSE is that I fail to find a
> clear statement in the documentation that the legal meaning of LICENSE
> in OE is what Mark claims it would be. Is this just Marks personal
> opinion on what should be done, or is this undocumented tribal
> knowledge, or is the exact semantics of LICENSE documented
> somewhere in a language that lawyers understand?
> 
> My guess for the latter would be "undocumented tribal knowledge",
> and clarification is required what is actually correct or incorrect
> here. And I think this is also what Mark was asking for.
> 
> > Cheers,
> >
> > Richard
> 
> cu
> Adrian

Another thing that complicates this further is related to gathering and 
distributing the license information. E.g., if one uses COPY_LIC_DIR = "1" 
to automatically include all the license information for all packages 
installed in the image, this will include everything listed in 
LIC_FILES_CHKSUM regardless of which packages were installed. I.e., even 
if only liblzma (which is PD) is installed from xz, all of the GPL 
license texts will be installed in /usr/share/common-licenses/xz...

//Peter