Re: [PATCH v6] checkpatch.pl: Add SPDX license tag check

[Kate Stewart <kstewart@linuxfoundation.org>]

[-- Attachment #1: Type: text/plain, Size: 2910 bytes --]

On Fri, Feb 2, 2018 at 1:06 PM, Joe Perches <joe@perches.com> wrote:

> On Fri, 2018-02-02 at 12:27 -0600, Rob Herring wrote:
> > On Fri, Feb 2, 2018 at 9:49 AM, Igor Stoppa <igor.stoppa@huawei.com>
> wrote:
> > > On 02/02/18 17:40, Rob Herring wrote:
> > > > Add SPDX license tag check based on the rules defined in
> > >
> > > Shouldn't it also check that the license is compatible?
> > >
> >
> > Perhaps we shouldn't try to script legal advice.
>
> True.
>
> I believe what was meant was that the
> entry was a valid SPDX License entry
> that already exists as a specific file
> in the LICENSES/ path.
>
> So that entry must be some combination of:
>
> $ git ls-files LICENSES/ | cut -f3- -d'/' | sort
> BSD-2-Clause
> BSD-3-Clause
> BSD-3-Clause-Clear
> GPL-1.0
> GPL-2.0
> LGPL-2.0
> LGPL-2.1
> Linux-syscall-note
> MIT
> MPL-1.1
>
> From my perspective, it'd be better if the
> various + uses had their own individual
> license files in the LICENSES/ path.
>

At the end of december, the SPDX license list[1] was rev'd to
Version: 3.0 28 December 2017.   At the request of
FSF, the GNU license family would not use the "+" notation,
and would bias towards using "-only" and "-or-later", explicitly.
So adding both variants to the LICENSES/ path aligns with
this forward direction.


> Right now, there are many missing licenses
> that are already used by various existing
> SPDX-License-Identifier: entries.
>
>
> APACHE-2.0
> BSD
> CDDL
> CDDL-1.0
> ISC
> GPL-1.0+
> GPL-2.0+
> LGPL-2.1+
> OpenSSL
>
> There are odd entries like:
>
> GPL-2.0-only
>

This is the new way to represent GPLv2 only, as described above.
While the GPL-2.0 and GPL-2.0+ notation is still valid,  it is deprecated
in the latest version, so transitioning existing over time will probably
be needed.   So I think the list of licenses to be added to
LICENSES/ path is:

APACHE-2.0
BSD
CDDL
CDDL-1.0
ISC
GPL-1.0-only
GPL-1.0-or-later (note: actually same contents as one GPL-1.0-only)
GPL-2.0-only
GPL-2.0-or-later (same contents as GPL-2.0-only)
LGPL-2.0-only
LGPL-2.0-or-later (same contents as LGPL-2.0-only)
LGPL-2.1-only
LGPL-2.1-or-later (same contents as LGPL-2.1-only)
OpenSSL

Having files with the same contents, but different names is
irritating, but I can't see a another way of complying with REUSE
guidelines.   Any better suggestions?


> Parentheses around AND/OR aren't consistent.
>

The SPDX specification has an appendix that calls for "(",")"
around every license expresssion.   After discussion with some
developers it was decided to be ok to relax that, and only add them
when they were essential to clarify the logic.   The next rev of the
SPDX specification will have this clarified as well.   I think we caught
most of the changes in the kernel documentation patches for describing
this,  but if you have specific cases to be reviewed,  happy to have
a look.

Thanks, Kate


[1] https://spdx.org/licenses/

[-- Attachment #2: Type: text/html, Size: 4617 bytes --]