Re: [PATCH] USB: add SPDX identifiers to all files in drivers/usb/

[Philippe Ombredanne <pombredanne@nexb.com>]

Rob:

On Sat, Oct 21, 2017 at 9:48 AM, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> On Fri, Oct 20, 2017 at 10:26:22AM -0500, Rob Herring wrote:
>> On Thu, Oct 19, 2017 at 3:38 AM, Greg Kroah-Hartman
>> <gregkh@linuxfoundation.org> wrote:
>> > It's good to have SPDX identifiers in all files to make it easier to
>> > audit the kernel tree for correct licenses.  This patch adds these
>> > identifiers to all files in drivers/usb/ based on a script and data from
>> > Thomas Gleixner, Philippe Ombredanne, and Kate Stewart.
>> >
>> > Cc: Thomas Gleixner <tglx@linutronix.de>
>> > Cc: Kate Stewart <kstewart@linuxfoundation.org>
>> > Cc: Philippe Ombredanne <pombredanne@nexb.com>
>> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> > ---
>> > Unless someone really complains, I'm going to add this to my tree for
>> > 4.15-rc1.
>>
>> Glad to see this. I've been suggesting folks use SPDX tags on dts
>> files as those are often dual licensed, so we have lots of license
>> boilerplate. But I've had some push back[1] but it's not something I
>> care to spend cycles on. It would be good to have some statement on
>> the use of tags. Anything new should use them (I can dust off my
>> checkpatch.pl check for this)? This is a good task for newbies? It's
>> each maintainer's decision? It's the copyright holder's (and their
>> lawyer's) decision?
>
> As for what type of a task this is, we have a script and a huge database
> that has been worked on by some people to make a lot of this pretty
> "automatic" to apply.

I am one of the people that worked on scanning kernels for licenses
using my scancode tool [1] to help there.

Regarding checkpatch.pl and tooling to help review patches I can think of
two things:

1. when there is SPDX identifier in a patch, it could be checked for validity
I have a library for this [2] (this is in Python not Perl) but the checks needed
should be fairly trivial since there is not an open number of license
variations in the kernel: this could be re-written in Perl alright.

2. scancode can detect the licenses fairly accurately to spit and suggest
an SPDX license identifier and/or provide input to remove boilerplate either
for new patches or existing code. Not sure how to best integrate this as a
patch check step. Docs? Server-side tool? Any idea?

What would be the best thing to do next?

[1] https://github.com/nexB/scancode-toolkit
[2] https://github.com/nexB/license-expression/
-- 
Cordially
Philippe Ombredanne