Codestin Search App

SPDX identifiers in the kernel

Posted Nov 16, 2017 19:14 UTC (Thu) by compenguy (guest, #25359)
Parent article: SPDX identifiers in the kernel

SPDX license identifiers are generally insufficient for license compliance. They an important first step in the process of identifying whether compliance is possible, and categorizing what types of obligations compliance carries, but it doesn't help with the actual process of compliance.

Most open source licenses carry a requirement that you distribute the exact license text for the work with the work. Simply saying "this is under the MIT license" is inadequate. Distributing a template MIT license is inadequate. Distributing the exact text of the MIT license file provided by the copyright holders (generally containing one or more copyright statements) is what's required. Without the means to locate and collate the obligatory license files, compliance is difficult, expensive, and easy to get wrong.

tl;dr: I really hope that once they get these license identifiers into files, they don't say "yay, we did it!" and stop. In many instances they'll need to either annotate the source with the full text of each original license, or provide the path to each of those original licenses in the source tree.

to post comments

SPDX identifiers in the kernel

Posted Nov 16, 2017 19:36 UTC (Thu) by sharkhands (guest, #114731) [Link] (7 responses)

How does this work with projects which have short license comments (i.e. "Distributed under the terms of the MIT license") in source files, and then a separate LICENSE.txt or the like which is intended to apply globally to the codebase?

SPDX identifiers in the kernel

Posted Nov 16, 2017 23:19 UTC (Thu) by JdGordy (subscriber, #70103) [Link] (6 responses)

Presumably there would be an implicit "see the LICENSE.TXT for the full text" associated with this tag?

SPDX identifiers in the kernel

Posted Nov 17, 2017 9:33 UTC (Fri) by tglx (subscriber, #31301) [Link] (5 responses)

Yes, that's in the documentation which is under review right now.

Any SPDX identifier used in the kernel must have a corresponding file under
LICENSES/... The file name is the same as the SPDX identifier and it contains
the full license text along with some machine parsable meta data.

SPDX identifiers in the kernel

Posted Nov 17, 2017 18:59 UTC (Fri) by compenguy (guest, #25359) [Link] (4 responses)

> The file name is the same as the SPDX identifier and it contains the full license text along with some machine parsable meta data.

I don't understand how that system will work.

There could be 12 files, each under the license with the SPDX identifier "BSD-2-Clause", but each of those 12 could (and likely would) have different copyright statements or other additional text. So if they all reference a file named "BSD-2-Clause", how will the correct variant of the data be included? "cat foo1/LICENSE.txt foo2/LICENSE.txt foo3/LICENSE.txt ... > BSD-2-Clause" probably follows the letter of the license terms, but not the spirit because there's no way to know which entry in that file corresponds with a specific source file.

SPDX identifiers in the kernel

Posted Nov 19, 2017 11:06 UTC (Sun) by Jonno (guest, #49613) [Link] (3 responses)

> There could be 12 files, each under the license with the SPDX identifier "BSD-2-Clause", but each of those 12 could (and likely would) have different copyright statements or other additional text. So if they all reference a file named "BSD-2-Clause", how will the correct variant of the data be included?

The SPDX identifier "BSD-2-Clause" refers *explicitly* to the BSD 2-clause "Simplified" License [1]. If the licence text differs, you use a different SPDX identifier. The SPDX Licence List [2] currently contain 15 BSD licence variants, and more can be added as needed.

[1] https://spdx.org/licenses/BSD-2-Clause.html
[2] https://spdx.org/licenses/

SPDX identifiers in the kernel

Posted Nov 19, 2017 16:54 UTC (Sun) by compenguy (guest, #25359) [Link] (2 responses)

> If the licence text differs, you use a different SPDX identifier. The SPDX Licence List [2] currently contain 15 BSD licence variants, and more can be added as needed.

The license variants cover the different *terms* of the license, not the variations in copyright statement, nor will they ever.

Look at the link you supplied for the SPDX BSD-2-Clause license. All the text in red is boilerplate that must be filled in with the actual values for the project whose license you're attempting to comply with:

> Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

Templatized or boilerplate copies of the license are insufficient to meet this requirement.

SPDX identifiers in the kernel

Posted Nov 20, 2017 13:22 UTC (Mon) by Jonno (guest, #49613) [Link] (1 responses)

>> If the licence text differs, you use a different SPDX identifier.
> The license variants cover the different *terms* of the license, not the variations in copyright statement, nor will they ever.

True, but the problem with the BSD licences are that the *terms* of the licence differs depending on the copyright holder (as the original BSD licence explicitly mentioned "University of California, Berkeley" and other copyright holders replaced that with their own name when they released code under an equivalent license).

For example, the *only* difference between the *terms* of BSD-2-Clause and BSD-2-Clause-NetBSD are these two phrases:

(1) "THE COPYRIGHT HOLDERS" <-> "THE NETBSD FOUNDATION, INC."
(2) "THE COPYRIGHT HOLDER" <-> "THE FOUNDATION"

>> Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
>Templatized or boilerplate copies of the license are insufficient to meet this requirement.

Obviously using SPDX to *identify* the licence does not absolve you of the responsibility to also *comply* with the license. But SPDX license identifiers *can* make it easier to do so.

Consider the following hypothetical project of 5 source files. Note that file01.c and file02.c have different copyright holders and thus different copyright notices, but both are under the same licence, so you only need one copy of the license *terms* (located in the file LICENSE.BSD-2-Clause). However, file03.c is copied from NetBSD and are thus under a slightly different license. Therefore it does not only uses a different copyright notice, but also a different SPDX license identifier and a separate copy of the license terms (this time located in LICENSE.BSD-2-Clause-NetBSD). Note that LICENSE.BSD-2-Clause and LICENSE.BSD-2-Clause-NetBSD only differs by 4 words, but (as you said) some sort of template would not actually comply with either license, and you therefore need to carry both versions. Next is file04.c which is copied from FreeBSD, which is under another slightly different license, and thus a third SPDX license identifier and a third license file. And finally we have file05.c which contains parts copied from NetBSD, parts copied from FreeBSD, and parts written by me, which means that to use this file you need to comply with both the NetBSD license and the FreeBSD license (which fortunately are compatible with each other, you just need to keep both license files around to comply with both of them at the same time). All in total there are 5 source files with a total of 6 copyright notices, but thanks to the SPDX license identifiers we only need one copy each of the 3 license terms.

========== file01.c ==========
// Copyright (c) 2012-2016 Joe Random Hacker
// SPDX-License-Identifier: BSD-2-Clause
...

========== file02.c ==========
// Copyright (c) 2017 Jon Severinsson
// SPDX-License-Identifier: BSD-2-Clause
...

========== file03.c ==========
// Copyright (c) 2008 The NetBSD Foundation, Inc.
// SPDX-License-Identifier: BSD-2-Clause-NetBSD
...

========== file04.c ==========
// Copyright (c) 1992-2012 The FreeBSD Project
// SPDX-License-Identifier: BSD-2-Clause-FreeBSD
...

========== file05.c ==========
// Copyright (c) 2008 The NetBSD Foundation, Inc.
// Copyright (c) 1992-2012 The FreeBSD Project
// Copyright (c) 2017 Jon Severinsson
// SPDX-License-Identifier: BSD-2-Clause-NetBSD AND BSD-2-Clause-FreeBSD
...

==== LICENSE.BSD-2-Clause ====
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

= LICENSE.BSD-2-Clause-NetBSD =
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

= LICENSE.BSD-2-Clause-FreeBSD =
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

The views and conclusions contained in the software and documentation are those of the authors and should not be interpreted as representing official policies, either expressed or implied, of the FreeBSD Project.

SPDX identifiers in the kernel

Posted Nov 20, 2017 15:27 UTC (Mon) by compenguy (guest, #25359) [Link]

I'm just going to stop here, because we clearly got different guidance from our corporate copyright lawyers.

I will say that the policy we enacted based on that guidance is very similar to the policies of all the other corporations I've worked with, as well as a wide range of products I've used. I will also direct you to SPDX's own documentation for producing SDPX distribution notices: https://spdx.org/sites/cpstandard/files/pages/files/spdx-...

SPDX identifiers in the kernel

Posted Nov 30, 2017 14:34 UTC (Thu) by pombredanne (guest, #113982) [Link]

Did you read the docs? https://lwn.net/Articles/738809/ ?

SPDX identifiers in the kernel

Posted Dec 8, 2017 10:22 UTC (Fri) by hook (guest, #62261) [Link]

Of course adding the SPDX short identifiers into the code is not a cure-all, but it is a massive step forward for clarity. Especially in a code-base as huge as the Linux kernel.

As for general best practices on copyright and license info, have you checked <https://reuse.software/> yet?