Re: [ptxdist] [PATCH 2/2] libnl3: fix license identifier (GPL-2.0-only -> LGPL-2.1-only)

[Alexander Dahl <ada@thorsis.com>]

Hei hei,

Am Mittwoch, 9. Oktober 2019, 10:22:02 CEST schrieb Roland Hieber:
> On Tue, Oct 08, 2019 at 10:01:50PM +0200, Andreas Pretzsch wrote:
> > One of the changes 3.4.0 -> 3.5.0 was to add SPDX tags all
> > across the source files. They are now tagged as LGPL-2.1-only.
> > 
> > The lib code itself had written LGPL-2.1-only headers already,
> > as did most of the commandline tools (src/nf-* and src/nl-*).
> > Very few of the cli tools have written GPL-2.0-only headers
> > even now, but the LGPL-2.1-only SPDX tag was added there also.
> > But given the use of those cli tools, and the meaning of LGPL
> > for regular executables, they are probably fine as LGPL, too.

I would consider that as a bug, which should be filed there.

> > For details, see https://github.com/thom311/libnl/pull/219
> > It was accepted mainline as commit cee0b1b 'Add SPDX identifiers'.

This should not have been accepted that way upstream. :-/

> > Therefore update the license tag in the rule to follow mainline.
> > 
> > Signed-off-by: Andreas Pretzsch <apr@cn-eng.de>
> > ---
> > 
> >  rules/libnl3.make | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/rules/libnl3.make b/rules/libnl3.make
> > index 153c7b80e..5b3af0065 100644
> > --- a/rules/libnl3.make
> > +++ b/rules/libnl3.make
> > @@ -22,7 +22,7 @@ LIBNL3_SUFFIX	:= tar.gz
> > 
> >  LIBNL3_URL	:=
> >  https://github.com/thom311/libnl/releases/download/$(LIBNL3_RELEASE)/$(L
> >  IBNL3).$(LIBNL3_SUFFIX) LIBNL3_SOURCE	:=
> >  $(SRCDIR)/$(LIBNL3).$(LIBNL3_SUFFIX)
> >  LIBNL3_DIR	:= $(BUILDDIR)/$(LIBNL3)
> > 
> > -LIBNL3_LICENSE	:= GPL-2.0-only
> > +LIBNL3_LICENSE	:= LGPL-2.1-only
> 
> It's also a good idea to add
> LIBNL3_LICENSE_FILES    :=
> file://COPYING;md5=4fbd65380cdd255951079008b364516c so we get a hint where
> the license is and when it changes again.
> 
> I threw licensecheck [1] at the code. There a few files which have
> comments identifying them as GPL-2.0-only, but also now have a
> "SPDX-License-Identifier: LGPL-2.1-only" tag:
> 
> ./src/idiag-socket-details.c	GPL (v2)
> ./src/nl-addr-add.c	GPL (v2)
> ./src/nl-addr-delete.c	GPL (v2)
> ./src/nl-addr-list.c	GPL (v2)
> ./src/nl-cls-add.c	GPL (v2)
> 
> as well as several files in ./include/linux-private/linux/, which are
> GPL-2.0 WITH Linux-syscall-note or GPL-2.0+ WITH Linux-syscall-note
> (obviously copied from the kernel, although I don't understand why).
> 
> ./lib/xfrm and ./include/netlink/ are BSD-3-Clause.
> 
> So I guess until we can argue that those files don't make it into a
> compiled binary, the license statement should be
> LGPL-2.1-only AND GPL-2.0-only AND GPL-2.0 WITH Linux-syscall-note and
> GPL-2.0+ WITH Linux-syscall-note and BSD-3-Clause.
> 
> [1]: https://metacpan.org/pod/App::Licensecheck

FWIW, I created a ticket [1] back in May 2019 after the discussion starting 
here: 

https://www.mail-archive.com/ptxdist@pengutronix.de/msg14394.html

Maybe someone wants to add the correct SPDX identifiers and license texts and 
sent PR to upstream? As far as I could see in upstream PR #219 already, the 
maintainer would happily apply those?

Greets
Alex

[1] https://github.com/thom311/libnl/issues/215


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de