Re: [patch 18/25] treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 43

From: Richard Fontana <rfontana@redhat.com>
To: Thomas Gleixner <tglx@linutronix.de>
Cc: J Lovejoy <opensource@jilayne.com>,
	Allison Randal <allison@lohutok.net>,
	linux-spdx@vger.kernel.org
Subject: Re: [patch 18/25] treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 43
Date: Wed, 22 May 2019 18:16:56 -0400	[thread overview]
Message-ID: <CAC1cPGxcEcpAeDbssiC8EGipSJBg=4kda-rUJm7CDui_LyMyLw@mail.gmail.com> (raw)
In-Reply-To: <alpine.DEB.2.21.1905221801540.1770@nanos.tec.linutronix.de>

On Wed, May 22, 2019 at 12:29 PM Thomas Gleixner <tglx@linutronix.de> wrote:
>
> While walking the dogs I thought more about this.
>
>   1) The random disclaimer (new or old) is not necessarily forming a new
>      license as long as the GPL (version) reference is unambiguous.
>
>      It's an (for GPLv2 tolerated and for GPLv3 documented) add on.

Yes, but it could be argued that it is meaningfully changing one
element of the license. Maybe SPDX ought to find a way to express that
through identifiers, maybe not. Maybe it's not important enough. Maybe
it's not important enough unless the disclaimer language crosses some
threshold of bizarreness.

If you look at how the other "allowed additional requirements" are
supposed to be handled in GPLv3, to me it wouldn't make sense or be
appropriate to delete them and replace them with a mere "GPL-3.0"
identifier string. I think an argument could be made that alternative
disclaimer language (at least if relatively sane) shouldn't really be
treated the same way as the other kinds of additional terms called out
in GPLv3. Indeed I've long felt that way. There's also the fact that
SPDX has a practice of coming up with identifiers for the other GPLv3
category of additional terms (additional permissions, corresponding to
SPDX "exceptions").

>   2) With a very quick scan (not complete and accurate) I found more than
>      20 variants of disclaimers bolted on a GPLv2 reference/boilerplate.
>      I fear there are more.
>
> So it's pretty unrealistic to create 20+ disclaimer IDs or 20+ new license
> IDs for those and either of these things would just help to proliferate
> that nonsense and create yet another mess in the SPDX realm.

That's a good point.

> I rather suggest to do the following:
>
>   1) Create a SPDX id 'CUSTOM_DISCLAIMER' and make the license identifier:
>
>      SPDX-License-Identifier: GPL-2.0-or-later AND CUSTOM_DISCLAIMER
>
>   2) Remove the GPL2.0 reference/boilerplate but keep the diclaimer in the
>      comment
>
>   3) Wrap the disclaimer into
>
>      DISCLAIMER_BEGIN
>
>       Random made up lawyerese
>
>      DISCLAIMER_END
>
> That gives us the following useful properties:
>
>      1) Avoid to go through the tedious process of creating disclaimer IDs
>         or new licenses and go through all the instances of SPDX/OSI and
>         whatever.
>
>      2) Allows to proceed with the cleanup
>
>      3) Precicely marks the custom disclaimer for compliance tools. Even a
>         halfways trivial awk script can extract them that way.
>
> We still can go after the copyright holders who added that mess at the same
> time, but we do not depend on their willingness, availability ...
>
> Thoughts?

This seems like a good solution. I think any viable solution has to
involve preserving the "nonstandard" disclaimer text in the files.

Richard