Re: [libvirt PATCH 00/20] Use SPDX-License-Identifier

On Tue, Aug 04, 2020 at 08:10:02PM +0200, Ján Tomko wrote: > On a Tuesday in 2020, Eric Blake wrote: > > On 8/4/20 12:33 PM, Daniel P. Berrangé wrote: > > > On Tue, Aug 04, 2020 at 07:22:40PM +0200, Ján Tomko wrote: > > > > Replace the license blurb in every single file with: > > > > SPDX-License-Identifier: <human-readable-string> > > > > Coincidentally, this is also machine readable. > > > > > > I've requested legal clarification previously on whether doing this > > > kind of replacement is possible. > > Thank you for asking that. > I was assmuing based on https://gitlab.com/libvirt/libvirt-ci/-/merge_requests/39 > where you only objected to the copyright change that such change in > the license blurb is okay. I should have been clearer in that review. I looked at the git log history and foiund that all except 1 contributor was doing so as a Red Hat employee, and so we could assume Red Hat copyright for all the code.

As a representative of Red Hat, we can make such changes if Red Hat holds *exclusive* copyright on the file changed.

There is one non-Red Hat contributor we still needed an ACK from though. > > > The response I got was that it is > > > NOT acceptable unless you have the permission of all copyright > > > holders on the source files. The terms of the GPL require that > > > license notices are not modified. Replacing this header with the > > > SPDX tag counts as modification, even though its essentially > > > just a different way of presenting the same information. > > > > > > NB, the fact that the kernel did such a conversion is not on its > > > own, a sufficient ok for doing it in libvirt, as we don't see > > > the prep work/analysis/discussions that led into the kernel's > > > change. > > I'm sorry, I haven't been following the kernel lists. Given that > the consent of *all* the contributors is needed, should I just > drop the idea or would you be open to acking the changes where > you are one of the contributors (IOW: libvirt) For libvirt.git we've such a broad contributor base, and we've copy+pasted code between files so frequently, that its very difficult to prove who holds copyright on individual files. Especially due to our early CVS days, we can't trust the git logs either, since alot of code was committed on behalf of other people.

For any brand new projects people start though, I'd encourage usage of only SPDX tags. For libvirt-devaddr.git for example, I intend to only use SPDX. There might be some other easy repos such as lang bindings where we can see all the contributors are Red Hat copyright and make a similar change without difficulty. > > > So NACK to this change. > > > > While wholesale replacement of the text is legally problematic, _adding_ > > the SPDX tag (in addition to what is already present), should not be an > > issue, if you want to respin a lighter-weight patch along those lines. > > That might be beneficial in the GPL-v3+ cases. Possibly GPL-v2+ cases > (as opposed to LGPL-v2+ cases) to single them out. > > I don't see the point in libvirt adding more of cruft while not removing > any.

There's a potential benefit of having SPDX, even if license text is not removed in that it allows for easier machine interrogation fo the source. ....as long as the tags are consistent with the license header of course

For example FSF has a tool called "reuse" helps to audit code https://reuse.software/ Overall I have a slight bias in favour of having SPDX tags, even with the license text still present, but I agree the benefit is marginal.

Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|