Re: [ptxdist] [PATCH 2/6] rules/gnu-efi: Add new package.

[Roland Hieber <rhi@pengutronix.de>]

On Tue, Jul 20, 2021 at 03:08:53PM +0200, Christian Melki wrote:
> On 7/19/21 11:09 AM, Roland Hieber wrote:
> > Hi,
> > 
> > generally you can just prefix the commit message with the package name
> > (no "rules/"), that's how we usually do it. And no dot at the end of the
> > message.
> > 
> 
> Ack. Will do.
> 
> > More below:
> > 
> > On Fri, Jul 16, 2021 at 03:41:03PM +0200, Christian Melki wrote:
> >> Target GNU EFI library. Used for various EFI work.
> >> Depending on your needs, target binaries for EFI stuff might be needed.
> >> This is used by efitools etc.
> >>
> >> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> >> ---
> >>  rules/gnu-efi.in   |  6 ++++
> >>  rules/gnu-efi.make | 71 ++++++++++++++++++++++++++++++++++++++++++++++
> >>  2 files changed, 77 insertions(+)
> >>  create mode 100644 rules/gnu-efi.in
> >>  create mode 100644 rules/gnu-efi.make
> >>
> >> diff --git a/rules/gnu-efi.in b/rules/gnu-efi.in
> >> new file mode 100644
> >> index 000000000..b21192222
> >> --- /dev/null
> >> +++ b/rules/gnu-efi.in
> >> @@ -0,0 +1,6 @@
> >> +## SECTION=system_libraries
> >> +menuconfig GNU_EFI
> >> +	tristate
> >> +	prompt "gnu-efi                       "
> >> +	help
> >> +	  This is gnu-efi, a library for providing EFI functions.
> >> diff --git a/rules/gnu-efi.make b/rules/gnu-efi.make
> >> new file mode 100644
> >> index 000000000..33a27020b
> >> --- /dev/null
> >> +++ b/rules/gnu-efi.make
> >> @@ -0,0 +1,71 @@
> >> +# -*-makefile-*-
> >> +#
> >> +# Copyright (C) 2021 by Christian Melki <christian.melki@t2data.com>
> >> +#
> >> +# For further information about the PTXdist project and license conditions
> >> +# see the README file.
> >> +#
> >> +
> >> +#
> >> +# We provide this package
> >> +#
> >> +PACKAGES-$(PTXCONF_GNU_EFI) += gnu-efi
> >> +
> >> +#
> >> +# Paths and names
> >> +#
> >> +# No tags: use a fake descriptive commit-ish to include the date
> >> +GNU_EFI_VERSION		:= 3.0.13
> >> +GNU_EFI_MD5		:= 8ec4221f505c78e6fc375c2fd7f0c549
> >> +GNU_EFI			:= gnu-efi-$(GNU_EFI_VERSION)
> >> +GNU_EFI_SUFFIX		:= tar.bz2
> >> +GNU_EFI_URL		:= https://sourceforge.net/projects/gnu-efi/files/gnu-efi-$(GNU_EFI_VERSION).$(GNU_EFI_SUFFIX)
> >> +GNU_EFI_SOURCE		:= $(SRCDIR)/$(GNU_EFI).$(GNU_EFI_SUFFIX)
> >> +GNU_EFI_DIR		:= $(BUILDDIR)/$(GNU_EFI)
> >> +GNU_EFI_LICENSE		:= BSD
> > 
> > There are tons of slightly different BSD licenses… :-), please have a
> > look at the SPDX list [0] and choose the correct identifier. Also please
> > add a GNU_EFI_LICENSE_FILES variable as documentation how you came to
> > that conclusion. Or if you feel like skipping this part, "unknown" is
> > the special expression for "no one has looked at this yet".
> > 
> > [0]: <https://spdx.org/licenses/> 
> > 
> > The same applies to other patches in this series.
> > 
> > In this case, I found something relevant in README.efilib which applies
> > to the code in lib/ and inc/, but for the rest we'll have to fall back
> > to the comment headers in gnuefi/*.c for the rest. I'm using
> > spdx-license-match [1] here to get a diff between the version that is in
> > README.efilib and the template from SPDX:
> > 
> > [1]: <https://github.com/rohieb/spdx-license-match>
> > 
> >     $ sed -n '19,$p' README.efilib | spdx-license-match -n 3 --guess BSD
> >     [...]
> > 
> > Hm. All BSD matches are pretty bad, maybe this is not BSD after all?
> > 
> >     $ sed -n '19,$p' README.efilib | spdx-license-match
> >     [...]
> > 
> > Hmm. BSD-1-Clause is the best match, but the project license still looks
> > differently, mainly the first clause is missing, and an additional
> > sentence about EFI at the end. So I would classify it as "custom", not
> > BSD.
> > 
> >     $ sed -n '19,$p' README.efilib | md5sum
> >     b1b8d397eda0e4b82e34c7b58610dfcb
> > 
> > The headers in gnuefi/*.c look like BSD-3-Clause.
> > 
> >     $ sed -n 2,35p gnuefi/reloc_x86_64.c | spdx-license-match -g BSD-3
> >     [...]
> > 
> > Yes, the diff looks inconspicuous.
> > 
> >     $ sed -n 2,35p gnuefi/reloc_x86_64.c | md5sum
> >     8f99c3f647f56ad3fb9519d6026af2e2
> > 
> > This gives us:
> > 
> >     GNU_EFI_LICENSE         := custom
> >     GNU_EFI_LICENSE_FILES   := \
> >       file://README.efilib;startline=19;md5=b1b8d397eda0e4b82e34c7b58610dfcb
> >       file://gnuefi/reloc_x86_64.c;startline=2;endline=35;md5=8f99c3f647f56ad3fb9519d6026af2e2
> > 
> > 
> >  - Roland
> > 
> 
> Fine with me. To me, the code looks like BSD (3-Clause?) AND GPL-2.0+.
> GPL-2.0+ is what I would add.

Ah, I overlooked the GPL alternative in some of the gnuefi/* headers,
and some of them seem to be another BSD-style license, which does not
quite match anything that SPDX knows. So a better version is:

     GNU_EFI_LICENSE         := custom AND (custom OR GPL-2.0-or-later)
     GNU_EFI_LICENSE_FILES   := \
       file://README.efilib;startline=19;md5=b1b8d397eda0e4b82e34c7b58610dfcb
       file://gnuefi/reloc_x86_64.c;startline=2;endline=35;md5=8f99c3f647f56ad3fb9519d6026af2e2
       file://gnuefi/crt0-efi-mips64el.S;startline=4;endline=17;md5=3dee88fd23d0b0c91b6850ec6ffc9c02

> I don't really know what custom would for mean a user since I can't see
> it being used in any package? Is gnu-efi the only package being slightly
> imprecise with its license declaration?
> Also, why would you want to be that literal?

Yes, sorry… the documentation is missing here because the patch for that
is still stuck in discussion [0]. But we agreed on the part of using
"custom" for anything that was reviewed (even superficially), but does
not match a known SPDX identifier, and "unknown" for any package that
still needs a license review. See the patch for more info… :)

[0]: https://lore.ptxdist.org/ptxdist/20210608103639.24336-1-rhi@pengutronix.de/

> It's very clear to me that the intention of author and the code is to be
> BSD (and whatever still is left as GPL-2.0+).
> 
> Also, IANAL. :)

SPDX has a set of rules [1] how to match license texts to SPDX
identifiers. which were made up to prevent any ambiguities and
possibilities for debate that will inevitably happen when someone has to
decide whether two license texts are equivalent. In that way, license
matching is reproducable and it can easily be decided by a regex whether
two texts are equivalent. And the actual wording in README.efilib is
substantially different from SPDX's version of any of the BSD variants
that we cannot classify it as such without opening up a debate about
semantics. So in that case, it's better to err on the safe side and
classify it as "unknown", so the person who needs to do a license
compliance review knows that this needs to be investigated more
accurately.

[1]: https://spdx.dev/license-list/matching-guidelines/

 - Roland

> >> +
> >> +# ----------------------------------------------------------------------------
> >> +# Compile
> >> +# ----------------------------------------------------------------------------               
> >> +
> >> +ifdef PTXCONF_ARCH_X86 
> >> +GNU_EFI_ARCH = ia32
> >> +ifdef PTXCONF_ARCH_X86_64
> >> +GNU_EFI_ARCH = x86_64
> >> +endif
> >> +endif
> >> +ifdef PTXCONF_ARCH_ARM
> >> +GNU_EFI_ARCH = arm
> >> +endif
> >> +ifdef PTXCONF_ARCH_ARM64
> >> +GNU_EFI_ARCH = aarch64
> >> +endif
> >> +
> >> +GNU_EFI_CONF_TOOL	:= NO
> >> +GNU_EFI_MAKE_ENV	:= \
> >> +	ARCH=$(GNU_EFI_ARCH) \
> >> +	CROSS_COMPILE=$(COMPILER_PREFIX) \
> >> +	PREFIX=/usr \
> >> +	LIBDIR=/usr/$(CROSS_LIB_DIR)
> >> +
> >> +GNU_EFI_INSTALL_OPT := \
> >> +	INSTALLROOT=$(GNU_EFI_PKGDIR) \
> >> +	PREFIX=/usr \
> >> +	LIBDIR=/usr/$(CROSS_LIB_DIR) \
> >> +	install
> >> +
> >> +# ----------------------------------------------------------------------------
> >> +# Target-Install
> >> +# ----------------------------------------------------------------------------
> >> +
> >> +$(STATEDIR)/gnu-efi.targetinstall:
> >> +	@$(call targetinfo)
> >> +	@$(call install_init, gnu-efi)
> >> +	@$(call install_fixup, gnu-efi,PRIORITY,optional)
> >> +	@$(call install_fixup, gnu-efi,SECTION,base)
> >> +	@$(call install_fixup, gnu-efi,AUTHOR,"Christian Melki <christian.melki@t2data.com>")
> >> +	@$(call install_fixup, gnu-efi,DESCRIPTION,missing)
> >> +	@$(call install_finish, gnu-efi)
> >> +	@$(call touch)
> >> +
> >> +# vim: syntax=make
> >> -- 
> >> 2.32.0
> >>
> >>
> >> _______________________________________________
> >> ptxdist mailing list
> >> ptxdist@pengutronix.de
> >> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
> >>
> > 
> 
> 
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de

-- 
Roland Hieber, Pengutronix e.K.          | r.hieber@pengutronix.de     |
Steuerwalder Str. 21                     | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686         | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de