Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SPDX license tags and checking tool #17001

Open
wants to merge 13 commits into
base: master
Choose a base branch
from

Conversation

robn
Copy link
Member

@robn robn commented Jan 28, 2025

Motivation and Context

After another fun cycle of OpenZFS licensing opinions being shared, I decided I would like to better understand what our licensing situation actually is, with a view to maybe someday setting a clear policy for new contributions and being able to enforce it.

A reasonable place to start is to add SPDX license identifier tags to every source file, and then write a program to enforce these for new files.

Description

Most of this PR is adding license tags to files that have clear and unambiguous license headers. It's arranged as multiple commits, but that's mostly a side effect of my method, which was a glorified search-and-replace.

The final commit adds a program called spdxcheck, to be run as part of checkstyle. This interrogates git for a canonical file list, searches them all for license tags, then decides if they have the correct license tag based on a number of factors. It reports on:

  • files that do not have a tag that should
  • files that have a tag that should not
  • files that have the "wrong" tag for their path

I've documented a lot of this in spdxcheck itself, so I won't repeat it all here. It's sort of written with an eye towards a license policy that doesn't currently exist, but would likely say something like: we prefer X, we tolerate Y, and in these specific places, these different rules apply.

One important thing to note is that this PR is not trying to change any licenses, but rather reflect what's already there. Along the way, I found that we have quite a few files that don't have clear licenses (either ambiguous or omitted entirely), and many that are "wrong" for what they are, usually either GPL code in the core or FreeBSD platform code, or CDDL code in the Linux platform code. So, spdxcheck is carrying a lot of exclusions and overrides that I intend to sort out, but that will take time, as it's going to involve a lot of study of the history and a lot of actually asking original authors to clarify.

How Has This Been Tested?

No code changes. spdxcheck was developed in tandem with applying tags to files and building out exception lists, until it ran clean.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Performance enhancement (non-breaking change which improves efficiency)
  • Code cleanup (non-breaking change which makes code smaller or more readable)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Library ABI change (libzfs, libzfs_core, libnvpair, libuutil and libzfsbootenv)
  • Documentation (a change to man pages or other documentation)

Checklist:

@amotin amotin added the Status: Code Review Needed Ready for review and testing label Jan 28, 2025
@robn robn requested a review from behlendorf January 28, 2025 21:58
@robn robn force-pushed the spdx-license-tags branch 2 times, most recently from 8bc3e50 to 35ea0f5 Compare February 5, 2025 08:02
@tonyhutter
Copy link
Contributor

For the curious:

license count
0BSD 1
LGPL-2.1-or-later 1
OpenSSL-standalone 1
Brian-Gladman-3-Clause 4
LicenseRef-OpenZFS-ThirdParty-PublicDomain 7
Apache-2.0 24
MIT 53
BSD-3-Clause 64
GPL-2.0-or-later 71
BSD-2-Clause 101
CDDL-1.0 2912

@tonyhutter
Copy link
Contributor

I manually tested with two fake files. The changes have to be in your commit as the PR description mentions, but it worked correctly:

$ scripts/spdxcheck.pl
missing license tag: module/zfs/hello.c
invalid license tag: module/zfs/hello2.c
    (got Fake-license; expected: CDDL-1.0 0BSD BSD-2-Clause BSD-3-Clause MIT)

@robn robn force-pushed the spdx-license-tags branch from 35ea0f5 to 62412d5 Compare February 6, 2025 02:51
@robn
Copy link
Member Author

robn commented Feb 6, 2025

FYI, if you were to remove all the exceptions and overrides in spdxcheck.pl (robn@41e4b6e), you get this output: gist robn/073a88c5. These are things that I intend to sort out over the coming months, as mentioned above.

@robn robn force-pushed the spdx-license-tags branch 2 times, most recently from f0379df to 50d5bfc Compare February 10, 2025 11:34
@robn robn force-pushed the spdx-license-tags branch from 50d5bfc to 338f2b1 Compare February 17, 2025 10:41
Copy link
Contributor

@behlendorf behlendorf left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Thanks for helping to somewhat clarify the situation and adding a tool for this.

@behlendorf behlendorf added Status: Accepted Ready to integrate (reviewed, tested) and removed Status: Code Review Needed Ready for review and testing labels Feb 24, 2025
@robn robn force-pushed the spdx-license-tags branch from 338f2b1 to 9960185 Compare February 24, 2025 20:48
@robn
Copy link
Member Author

robn commented Feb 24, 2025

Last push rebased to master and conflicts resolved.

@github-actions github-actions bot removed the Status: Accepted Ready to integrate (reviewed, tested) label Feb 24, 2025
@robn robn force-pushed the spdx-license-tags branch from 9960185 to 79c7608 Compare February 25, 2025 22:58
robn added 11 commits February 26, 2025 12:35
robn added 2 commits February 26, 2025 12:35
SPDX have repeatedly rejected the creation of a tag for a public domain
dedication, as not all dedications are clear and unambiguious in their
meaning and not all jurisdictions permit relinquishing a copyright
anyway.

A reasonably common workaround appears to be to create a local
(project-specific) identifier to convey whatever meaning the project
wishes it to. To cover OpenZFS' use of third-party code with a public
domain dedication, we use this custom tag.

Further reading:
- https://github.com/spdx/old-wiki/blob/main/Pages/Legal%20Team/Decisions/Dealing%20with%20Public%20Domain%20within%20SPDX%20Files.md
- https://spdx.github.io/spdx-spec/v2.3/other-licensing-information-detected/
- https://cr.yp.to/spdx.html

Sponsored-by: https://despairlabs.com/sponsor/
Signed-off-by: Rob Norris <[email protected]>
@robn robn force-pushed the spdx-license-tags branch from 79c7608 to bde3a12 Compare February 26, 2025 01:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants