Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SPDX license tags and checking tool #17001

Open
wants to merge 13 commits into
base: master
Choose a base branch
from

Conversation

robn
Copy link
Member

@robn robn commented Jan 28, 2025

Motivation and Context

After another fun cycle of OpenZFS licensing opinions being shared, I decided I would like to better understand what our licensing situation actually is, with a view to maybe someday setting a clear policy for new contributions and being able to enforce it.

A reasonable place to start is to add SPDX license identifier tags to every source file, and then write a program to enforce these for new files.

Description

Most of this PR is adding license tags to files that have clear and unambiguous license headers. It's arranged as multiple commits, but that's mostly a side effect of my method, which was a glorified search-and-replace.

The final commit adds a program called spdxcheck, to be run as part of checkstyle. This interrogates git for a canonical file list, searches them all for license tags, then decides if they have the correct license tag based on a number of factors. It reports on:

  • files that do not have a tag that should
  • files that have a tag that should not
  • files that have the "wrong" tag for their path

I've documented a lot of this in spdxcheck itself, so I won't repeat it all here. It's sort of written with an eye towards a license policy that doesn't currently exist, but would likely say something like: we prefer X, we tolerate Y, and in these specific places, these different rules apply.

One important thing to note is that this PR is not trying to change any licenses, but rather reflect what's already there. Along the way, I found that we have quite a few files that don't have clear licenses (either ambiguous or omitted entirely), and many that are "wrong" for what they are, usually either GPL code in the core or FreeBSD platform code, or CDDL code in the Linux platform code. So, spdxcheck is carrying a lot of exclusions and overrides that I intend to sort out, but that will take time, as it's going to involve a lot of study of the history and a lot of actually asking original authors to clarify.

How Has This Been Tested?

No code changes. spdxcheck was developed in tandem with applying tags to files and building out exception lists, until it ran clean.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Performance enhancement (non-breaking change which improves efficiency)
  • Code cleanup (non-breaking change which makes code smaller or more readable)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Library ABI change (libzfs, libzfs_core, libnvpair, libuutil and libzfsbootenv)
  • Documentation (a change to man pages or other documentation)

Checklist:

robn added 13 commits January 28, 2025 22:32
SPDX have repeatedly rejected the creation of a tag for a public domain
dedication, as not all dedications are clear and unambiguious in their
meaning and not all jurisdictions permit relinquishing a copyright
anyway.

A reasonably common workaround appears to be to create a local
(project-specific) identifier to convey whatever meaning the project
wishes it to. To cover OpenZFS' use of third-party code with a public
domain dedication, we use this custom tag.

Further reading:
- https://github.com/spdx/old-wiki/blob/main/Pages/Legal%20Team/Decisions/Dealing%20with%20Public%20Domain%20within%20SPDX%20Files.md
- https://spdx.github.io/spdx-spec/v2.3/other-licensing-information-detected/
- https://cr.yp.to/spdx.html

Sponsored-by: https://despairlabs.com/sponsor/
Signed-off-by: Rob Norris <[email protected]>
@amotin amotin added the Status: Code Review Needed Ready for review and testing label Jan 28, 2025
@robn robn requested a review from behlendorf January 28, 2025 21:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Status: Code Review Needed Ready for review and testing
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants