Re: [PATCH] linux-user: Add GPL-2.0+ SPDX license identifier

[Warner Losh]

> On Nov 4, 2021, at 4:14 PM, Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
> 
> On 11/4/21 16:17, Taylor Simpson wrote:
>>> -----Original Message-----
>>> From: Philippe Mathieu-Daudé <philippe.mathieu.daude@gmail.com> On
>>> Behalf Of Philippe Mathieu-Daudé
>>> Sent: Thursday, November 4, 2021 5:02 AM
>>> To: Daniel P. Berrangé <berrange@redhat.com>
>>> Cc: Taylor Simpson <tsimpson@quicinc.com>; Richard Henderson
>>> <richard.henderson@linaro.org>; qemu-devel@nongnu.org; Laurent Vivier
>>> <laurent@vivier.eu>
>>> Subject: Re: [PATCH] linux-user: Add GPL-2.0+ SPDX license identifier
>>> 
>>> On 11/4/21 10:06, Daniel P. Berrangé wrote:
>>>> 
>>>> When you say  "manually add", can you confirm that you explicitly
>>>> inspected every license header yourself to validate that the reported
>>>> match truely is GPL-2.0+, before adding the SPDX tag.
>>>> 
>>>> Adding licenses tags based merely on a 60% match, without doing human
>>>> inspection would be questionable.
>>> 
>>> Yes I explicitly inspected every license error before manually add the tag, 
>>> but
>>> I am human, so prone to errors, which is why peer review is important :)
>> 
>> This seems like more of a question for a lawyer to review than technical 
>> reviewers.
>> 
>> I remember discussing this when I made the initial submission.  At that 
>> time, there wasn't a broad policy on this.  Has that changed?
> 
> On the policy side, nothing changed.
> 
> In an earlier version I posted I was replacing the license text by the
> equivalent SPDX tag, but I've been told I can not *remove* a license
> text without an Ack from all the contributors who modified a file;
> however simply *adding* (although duplicating the information) would
> be OK.
> This is what I'm doing here (what 'technically' changed from earlier
> patch).

The Linux Kernel’s rules for this are a little more relaxed for ‘variants’ that 
the SPDX tool identifies. There’s over a hundred of the “this is GPL 2.0 or 
later” text that has been identified. As long as the SPDX tool matched, they 
were replaced.

On the other hand, FreeBSD has taken the approach of only adding SPDX tags for 
the last few years. We’re only now starting to allow files with only SPDX tags 
and are taking a hard look at what we need to do to start replacement.

Regardless of where qemu winds up between these extremes (the law is a series 
of grey issues, risk assessments, etc so there’s no one right answer), it would 
likely be best to explicitly document what the policy is in the future.

Warner