[libvirt PATCH 00/20] Use SPDX-License-Identifier

[Daniel P. Berrangé]

On Tue, Aug 04, 2020 at 08:10:02PM +0200, Ján Tomko wrote:
> On a Tuesday in 2020, Eric Blake wrote:
> > On 8/4/20 12:33 PM, Daniel P. Berrangé wrote:
> > > On Tue, Aug 04, 2020 at 07:22:40PM +0200, Ján Tomko wrote:
> > > > Replace the license blurb in every single file with:
> > > >   SPDX-License-Identifier: <human-readable-string>
> > > > Coincidentally, this is also machine readable.
> > > 
> > > I've requested legal clarification previously on whether doing this
> > > kind of replacement is possible.
> 
> Thank you for asking that.
> I was assmuing based on https://gitlab.com/libvirt/libvirt-ci/-/merge_requests/39
> where you only objected to the copyright change that such change in
> the license blurb is okay.

I should have been clearer in that review. I looked at the git log
history and foiund that all except 1 contributor was doing so as a
Red Hat employee, and so we could assume Red Hat copyright for all
the code. As a representative of Red Hat, we can make such changes
if Red Hat holds *exclusive* copyright on the file changed. There
is one non-Red Hat contributor we still needed an ACK from though.

> > > The response I got was that it is
> > > NOT acceptable unless you have the permission of all copyright
> > > holders on the source files. The terms of the GPL require that
> > > license notices are not modified. Replacing this header with the
> > > SPDX tag counts as modification, even though its essentially
> > > just a different way of presenting the same information.
> > > 
> > > NB, the fact that the kernel did such a conversion is not on its
> > > own, a sufficient ok for doing it in libvirt, as we don't see
> > > the prep work/analysis/discussions that led into the kernel's
> > > change.
> 
> I'm sorry, I haven't been following the kernel lists. Given that
> the consent of *all* the contributors is needed, should I just
> drop the idea or would you be open to acking the changes where
> you are one of the contributors (IOW: libvirt)

For libvirt.git we've such a broad contributor base, and we've
copy+pasted code between files so frequently, that its very
difficult to prove who holds copyright on individual files.
Especially due to our early CVS days, we can't trust the git
logs either, since alot of code was committed on behalf of
other people.

For any brand new projects people start though, I'd encourage
usage of only SPDX tags. For libvirt-devaddr.git for example,
I intend to only use SPDX.

There might be some other easy repos such as lang bindings
where we can see all the contributors are Red Hat copyright
and make a similar change without difficulty.

> > > So NACK to this change.
> > 
> > While wholesale replacement of the text is legally problematic, _adding_
> > the SPDX tag (in addition to what is already present), should not be an
> > issue, if you want to respin a lighter-weight patch along those lines.
> 
> That might be beneficial in the GPL-v3+ cases. Possibly GPL-v2+ cases
> (as opposed to LGPL-v2+ cases) to single them out.
> 
> I don't see the point in libvirt adding more of cruft while not removing
> any.

There's a potential benefit of having SPDX, even if license text is not
removed in that it allows for easier machine interrogation fo the source.
....as long  as the tags are consistent with the license header of course

For example FSF has a tool called "reuse" helps to audit code
https://reuse.software/

Overall I have a slight bias in favour of having SPDX tags, even with the
license text still present, but I agree the benefit is marginal.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|