From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=TByz=UC=vger.kernel.org=linux-spdx-owner@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-4.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED
	autolearn=ham autolearn_force=no version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id C4434C04AB5
	for <linux-spdx@archiver.kernel.org>; Mon,  3 Jun 2019 12:37:08 +0000 (UTC)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
	by mail.kernel.org (Postfix) with ESMTP id A1C3828108
	for <linux-spdx@archiver.kernel.org>; Mon,  3 Jun 2019 12:37:08 +0000 (UTC)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1726349AbfFCMhI (ORCPT <rfc822;linux-spdx@archiver.kernel.org>);
        Mon, 3 Jun 2019 08:37:08 -0400
Received: from mout.kundenserver.de ([212.227.126.135]:34069 "EHLO
        mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1726336AbfFCMhI (ORCPT
        <rfc822;linux-spdx@vger.kernel.org>); Mon, 3 Jun 2019 08:37:08 -0400
Received: from [192.168.1.110] ([95.118.71.36]) by mrelayeu.kundenserver.de
 (mreue009 [212.227.15.167]) with ESMTPSA (Nemesis) id
 1Mgvj3-1gv88k3ijV-00hL6q; Mon, 03 Jun 2019 14:36:59 +0200
Subject: Re: [Batch 16 patch 01/25] treewide: Replace GPLv2
 boilerplate/reference with SPDX - rule 226
To:     Armijn Hemel - Tjaldur Software Governance Solutions 
        <armijn@tjaldur.nl>, Thomas Gleixner <tglx@linutronix.de>,
        linux-spdx@vger.kernel.org
References: <20190602204441.312079455@linutronix.de>
 <20190602204653.087533673@linutronix.de>
 <1a0494fe-8925-39e0-c57d-7f19fdda98e6@metux.net>
 <e47edf4c-a813-77a8-bf14-eb596d140bdb@tjaldur.nl>
From:   "Enrico Weigelt, metux IT consult" <lkml@metux.net>
Organization: metux IT consult
Message-ID: <63f9b07d-248d-c813-705c-60810b95a8c4@metux.net>
Date:   Mon, 3 Jun 2019 14:36:58 +0200
User-Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.2.1
MIME-Version: 1.0
In-Reply-To: <e47edf4c-a813-77a8-bf14-eb596d140bdb@tjaldur.nl>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K1:1xljtfGT6voWkEdckAQ0pJaJ+5ADzDbatCMzKm00t/5YQLdlcOy
 L5ca8j16O9x5uaVnI40Q5meny3N0JdLE3W7lgkpXANlqlISPWSa/uCUiQEV1Dr1IZYsOC4m
 JEDT9bKZi50wold5NarTNkS9gCPs+h0AWrswax/ygQc9vAQ4fFwgUOydkjNAlcxHnyjDVed
 GUdqV6tXHzBL/MQOkbyvw==
X-UI-Out-Filterresults: notjunk:1;V03:K0:E6g+Lh70qIY=:yNR6JgpepC2vJgZsPQwFAa
 OzU1gtAMyUSYzxgrsSloew1WtMFJ/gjWQ1OHMTy/VnJrrQuuUqU75Iwqa/P1gG1MLBghD2JKW
 KtkzDiCdAIHPhcE/oDrSbtHSO55f967sj0bAP2TRCyDrrHgXAqLtzUWc3z2utXjzQ/ox7YmXU
 pCV90WZxh1hXAcPfJwqwUIcWt/yR9ck2c7FDWcdEDTXTxqJT/VFzQszBfr8pZFH/SHCpLg9Bn
 jAKMnWG/QybHc82RICbf/TctwENTKc7NgeIZpcAzvSZAUXjkbZpourjWMMngYhtjbKYQO7lWE
 Ysq1d35JZA1CMWU/ewKSLaSTEIrlBI53IeMSiKldna/SLAXox1LkJnfMc/mSuzMcxQhmsmoaG
 L9Xbo5iXQxDS8UNob9DONXDKvdcDR/jD8Nz+WLGjtmjfXXJxq35K/jFJ2nd1XdXg9HlPwS29c
 Cs5sRoxR490eZSYEn7pc9R/4QkEaSDdF8BHkPijR9VbFJqnW7h3KX9BDz7+1MOF6biYtaXPvA
 A4zu3hTDa+KUX0O4z3kKyK5BCXc3TkBBZa0bRwKMiQ81GsVbVzeN2Lw53q8hzkMIaZsaD18m3
 KiQjrmxtRaKfpLYjfGixGUI7/61oQyBxLrWr+6lBJi5KCMBofracUtsCyeOS4AS076xOj4pyA
 p+XWsjU9iM6hRlcZc/A9vPV9PCsnxnlIzrkWAFn3jgZv431mqlllGCa9DE6YOX6+s0G/NXI6W
 ri/brLgSTY2c5yP3QtEGj5ouSaSGmgwsLduWPXZvZ1nL2kQ9z914WOh5qwKU8h6+IkUwDfxSG
 rkybG5ASUTRQm62ASrXlyHsxKEnkxbfDdep/gHqBvLWmFC+X56SCAdz+za8BOWAypLN8UOO
Sender: linux-spdx-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-spdx.vger.kernel.org>
X-Mailing-List: linux-spdx@vger.kernel.org
Archived-At: <https://lore.kernel.org/linux-spdx/63f9b07d-248d-c813-705c-60810b95a8c4@metux.net/>
List-Archive: <https://lore.kernel.org/linux-spdx/>
List-Post: <mailto:linux-spdx@vger.kernel.org>

On 03.06.19 12:46, Armijn Hemel - Tjaldur Software Governance Solutions
wrote:

<snip>

> Yes, I think they would be. That being said, copyright notices in the
> Linux kernel are horribly out of date/inaccurate and even Git does not
> do a good job of recording these (garbage in, garbage out). Git only has
> a single "Author" field and I know of commits where the commit message
> had two authors listed and the that was added had three authors listed.
> Then there are all kinds of silly tags in the Linux kernel where it is
> absolutely unclear whether or not someone is claiming copyright or not.
> See for examples this article:
> https://www.ifosslr.org/index.php/ifosslr/article/view/121

uh, I didn't expect it to be that complicated :o
I was assuming that Author: and Signed-off-by: would be sufficient.
(okay, we'd need some git-blame counterpart that honors Signed-off-by).

> Also, author doesn't necessarily mean copyright owner, company
> affiliation also does not necessarily mean copyright is with the company
> (it depends on the work contract) and it would require a lot more
> research to find the true copyright owner.
> 
> The copyright statements also have other relevant information, such as
> years. This is relevant to find out which copyright laws were in effect
> when the code was published.

hmm, maybe we should start w/ introducing some rules for that for all
new code ?

Maybe:

Rule 1: If not stated otherwise, the Signed-Off-By indicates the signer
        claims copyright for the added or replaced lines of code.
        This only affect any lines of code that were already present
        (and unchanged) before these rules taking effect.
Rule 2: New files shall have some SPDX-Copyright: header (checkpatch
        should check for that).
Rule 3: If the SPDX-Copyright header is present, all mentioned authors
        claim copyright for the whole file, except for claims from other
        rules.
Rule 4: For existing files, SPDX-Copyright header may be added on a per-
        case basis, when actual copyright claims have been validated.
Rule 5: If the author is transferring his claims to some company, this
        company shall be mentioned in the Signed-Off-By or SPDX-
        Copyright headers.

Certainly, it will take a long time, until everything is really cleared
up, but IMHO a good start, at least for all new code.

> There was a discussion about this a few days ago (please see the list
> archive). Personally I don't see the benefit.

There already have been lawsuits on GPL violations. For such, the actual
copyright holders of the disputed code have be clear.

Personally, I wouldn't spend too much efforts in here, but I'd wish to
have some clear rules for any new contributions (in order to not making
the situation worse as it already is).


--mtx


-- 
Enrico Weigelt, metux IT consult
Free software and Linux embedded engineering
info@metux.net -- +49-151-27565287