Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Peter Kjellerstedt]

> -Original Message-
> From: openembedded-core-boun...@lists.openembedded.org  core-boun...@lists.openembedded.org> On Behalf Of Adrian Bunk
> Sent: den 4 september 2019 21:54
> To: Richard Purdie 
> Cc: Patches and discussions about the oe-core layer  c...@lists.openembedded.org>
> Subject: Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum
> 
> On Wed, Sep 04, 2019 at 07:50:35PM +0100, Richard Purdie wrote:
> > On Wed, 2019-09-04 at 08:07 -0400, Mark Hatle wrote:
> > > On 9/3/19 1:59 PM, Wes Lindauer wrote:
> > > > Mark,
> > > >
> > > > In reference to "It typically does NOT include the license of
> > > > things used to
> > > > build the software (such as makefiles, autoconf fragments, etc)".
> > > > Since the only file that is licensed under GPLv3 is a M4 macro,
> > > > does that mean
> > > > the current patch is still valid? Shouldn't the GPLv3 license be
> > > > removed from
> > > > this recipe?
> > >
> > > Unless the M4 file is generating/injecting code into the build(very
> > > few I've
> > > seen do this), then I would say it's not under GPLv3 at all.  (And
> I
> > > wouldn't
> > > have included GPLv3 in the LICENSE statement.)
> > >
> > > But we need more consensus then just me saying so.
> > >
> > > This may be a good question for the OE-TSC to ensure that we have
> > > clarification
> > > on this issue, and it's not just me saying I think one way or
> > > another.
> >
> > Not sure it needs to go to the TSC, we just need a patch which
> clearly
> > says why the LICENSE statement is incorrect. I don't think the
> original
> > patch in the series was clear about why GPLv3 didn't apply but if the
> > commit message is improved, its probably fine.
> 
> I am getting more and more confused about both the patch and the
> semantics of LICENSE.
> 
> The status quo in the recipe is:
> 
> <--  snip  ->
> 
> # The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the only
> file
> # which is GPLv3 is an m4 macro which isn't shipped in any of our
> packages,
> # and the LGPL bits are under lib/, which appears to be used for
> libgnu, which
> # appears to be used for DOS builds. So we're left with GPLv2+ and PD.
> LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ & PD"
> LICENSE_${PN} = "GPLv2+"
> LICENSE_${PN}-dev = "GPLv2+"
> LICENSE_${PN}-staticdev = "GPLv2+"
> LICENSE_${PN}-doc = "GPLv2+"
> LICENSE_${PN}-dbg = "GPLv2+"
> LICENSE_${PN}-locale = "GPLv2+"
> LICENSE_liblzma = "PD"
> 
> LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
> 
> file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
> 
> file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
> 
> file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
> 
> file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
> "
> 
> <--  snip  -->
> 
> My confusion about the patch is that it removes COPYING.GPLv3 from
> LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in LICENSE.
> 
> My confusion about the semantics of LICENSE is that I fail to find a
> clear statement in the documentation that the legal meaning of LICENSE
> in OE is what Mark claims it would be. Is this just Marks personal
> opinion on what should be done, or is this undocumented tribal
> knowledge, or is the exact semantics of LICENSE documented
> somewhere in a language that lawyers understand?
> 
> My guess for the latter would be "undocumented tribal knowledge",
> and clarification is required what is actually correct or incorrect
> here. And I think this is also what Mark was asking for.
> 
> > Cheers,
> >
> > Richard
> 
> cu
> Adrian

Another thing that complicates this further is related to gathering and 
distributing the license information. E.g., if one uses COPY_LIC_DIR = "1" 
to automatically include all the license information for all packages 
installed in the image, this will include everything listed in 
LIC_FILES_CHKSUM regardless of which packages were installed. I.e., even 
if only liblzma (which is PD) is installed from xz, all of the GPL 
license texts will be installed in /usr/share/common-licenses/xz...

//Peter

-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Adrian Bunk]

On Wed, Sep 04, 2019 at 04:42:41PM -0400, Mark Hatle wrote:
> On 9/4/19 4:27 PM, Adrian Bunk wrote:
> > On Wed, Sep 04, 2019 at 08:07:58AM -0400, Mark Hatle wrote:
> >> On 9/3/19 1:59 PM, Wes Lindauer wrote:
> >> ...
> >>> In reference to "It typically does NOT include the license of things used 
> >>> to
> >>> build the software (such as makefiles, autoconf fragments, etc)".
> >>> Since the only file that is licensed under GPLv3 is a M4 macro, does that 
> >>> mean
> >>> the current patch is still valid? Shouldn't the GPLv3 license be removed 
> >>> from
> >>> this recipe?
> >>
> >> Unless the M4 file is generating/injecting code into the build(very few 
> >> I've
> >> seen do this),
> >> ...
> > 
> > If the defines in config.h are "code" then many do.
> 
> Is there a license statement at the top of the config.h?  If so, then it 
> counts.

No license statement is required for having copyright.

>...
> >From the latest autoconf source code docs:
>...

What comes from autoconf is GPL-3.0-with-autoconf-exception,
3rd party macros might have any license.

> Or is it just 'facts' (i.e. defines without any creative content)?  Then I 
> don't
> consider it relevant to the source license,

When you argue along the lines of "generating/injecting code into the 
build" that sounds like what many autoconf macros are doing.

> based on statements I've seen elsewhere.
>...

Statements from lawyers, or from random non-lawyers on the internet like 
you and me who might be right or just repeat something incorrect?

The users for whom these questions actually matter most in practice
are lawyers from the "no GPLv3" camp, so their input might be useful.

> --Mark

cu
Adrian

-- 

   "Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
   "Only a promise," Lao Er said.
   Pearl S. Buck - Dragon Seed

-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Mark Hatle]

On 9/4/19 4:27 PM, Adrian Bunk wrote:
> On Wed, Sep 04, 2019 at 08:07:58AM -0400, Mark Hatle wrote:
>> On 9/3/19 1:59 PM, Wes Lindauer wrote:
>> ...
>>> In reference to "It typically does NOT include the license of things used to
>>> build the software (such as makefiles, autoconf fragments, etc)".
>>> Since the only file that is licensed under GPLv3 is a M4 macro, does that 
>>> mean
>>> the current patch is still valid? Shouldn't the GPLv3 license be removed 
>>> from
>>> this recipe?
>>
>> Unless the M4 file is generating/injecting code into the build(very few I've
>> seen do this),
>> ...
> 
> If the defines in config.h are "code" then many do.

Is there a license statement at the top of the config.h?  If so, then it counts.

Or is it just 'facts' (i.e. defines without any creative content)?  Then I don't
consider it relevant to the source license, based on statements I've seen 
elsewhere.

>From the latest autoconf source code docs:

http://git.savannah.gnu.org/gitweb/?p=autoconf.git;a=blob;f=doc/autoconf.texi;h=2ac669696e730c051fbc072de4e5fe713f8b0f59;hb=HEAD

25843 @node Distributing
25844 @section Distributing @command{configure} Scripts
25845 @cindex License
25846
25847 @display
25848 What are the restrictions on distributing @command{configure}
25849 scripts that Autoconf generates?  How does that affect my
25850 programs that use them?
25851 @end display
25852
25853 There are no restrictions on how the configuration scripts that Autoconf
25854 produces may be distributed or used.  In Autoconf version 1, they were
25855 covered by the GNU General Public License.  We still encourage
25856 software authors to distribute their work under terms like those of the
25857 GPL, but doing so is not required to use Autoconf.
25858
25859 Of the other files that might be used with @command{configure},
25860 @file{config.h.in} is under whatever copyright you use for your
25861 @file{configure.ac}.  @file{config.sub} and @file{config.guess} have an
25862 exception to the GPL when they are used with an Autoconf-generated
25863 @command{configure} script, which permits you to distribute them under the
25864 same terms as the rest of your package.  @file{install-sh} is from the X
25865 Consortium and is not copyrighted.

So the terms of the config.h (from MY personal interpretation) is that it's
under the same terms as the how the rest of the source code is declared.  I.e.
even if autoconf is GPLv3, the output is not.

--Mark

>> --Mark
> 
> cu
> Adrian
> 

-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[richard . purdie]

On Wed, 2019-09-04 at 16:18 -0400, Mark Hatle wrote:
> On 9/4/19 3:53 PM, Adrian Bunk wrote:
> > I am getting more and more confused about both the patch and the 
> > semantics of LICENSE.
> > 
> > The status quo in the recipe is:
> > 
> > <--  snip  ->
> > 
> > # The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the
> > only file
> > # which is GPLv3 is an m4 macro which isn't shipped in any of our
> > packages,
> > # and the LGPL bits are under lib/, which appears to be used for
> > libgnu, which
> > # appears to be used for DOS builds. So we're left with GPLv2+ and
> > PD.
> > LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ &
> > PD"
> > LICENSE_${PN} = "GPLv2+"
> > LICENSE_${PN}-dev = "GPLv2+"
> > LICENSE_${PN}-staticdev = "GPLv2+"
> > LICENSE_${PN}-doc = "GPLv2+"
> > LICENSE_${PN}-dbg = "GPLv2+"
> > LICENSE_${PN}-locale = "GPLv2+"
> > LICENSE_liblzma = "PD"
> > 
> > LIC_FILES_CHKSUM =
> > "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
> > file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80
> > fdaf4a4263 \
> > file://COPYING.GPLv3;md5=d32239bcb673463ab874e8
> > 0d47fae504 \
> > file://COPYING.LGPLv2.1;md5=4fbd65380cdd2559510
> > 79008b364516c \
> > file://lib/getopt.c;endline=23;md5=2069b0ee7105
> > 72c03bb3114e4532cd84 \
> > "
> > 
> > <--  snip  -->
> > 
> > My confusion about the patch is that it removes COPYING.GPLv3 from 
> > LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in
> > LICENSE.
> > 
> > My confusion about the semantics of LICENSE is that I fail to find
> > a 
> > clear statement in the documentation that the legal meaning of
> > LICENSE 
> > in OE is what Mark claims it would be. Is this just Marks personal 
> > opinion on what should be done, or is this undocumented tribal 
> > knowledge, or is the exact semantics of LICENSE documented
> > somewhere in a language that lawyers understand?
> > 
> > My guess for the latter would be "undocumented tribal knowledge",
> > and clarification is required what is actually correct or incorrect
> > here. And I think this is also what Mark was asking for.
> 
> It -was- documented at one time, but I suspect that documentation was
> revised
> and the language was lost (or it never made it into a final version
> of the docs.)
> 
> This is why I was suggesting the TSC weigh in, and just clarify that:
> 
> LICENSE = is the _source code_ license, and only includes items that
> are or
> could be included in the making of the binaries.  This does NOT
> include
> autoconf, automake, makefiles, etc that are only used during the
> build process,
> but not in the sources used to build the outputs.
> 
> LICENSE_ = is the binary license for a specific package.  It
> defaults to
> the same as the LICENSE.

Historically, most m4 files don't include their license. This meant
that we haven't accounted for them in LICENSE. Where they are present,
we've tended to turn a blind eye to them as they don't cover the
binaries produced which is the piece of key importance to most people,
this recipe was one of the ones which attempted to clarify the
situation.

I suspect we do need to include such things in LICENSE since for
example these licenses could have an impact on the license of output
from the source archiver for example which might include build scripts.

The result is rather ugly but licensing in general is :(

It also gets tricky as we delete many autoconf files and regenerate
them. You'd hope that was under the same license but...

Cheers,

Richard




-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Mark Hatle]

On 9/4/19 4:18 PM, Mark Hatle wrote:
> On 9/4/19 3:53 PM, Adrian Bunk wrote:
>> On Wed, Sep 04, 2019 at 07:50:35PM +0100, Richard Purdie wrote:
>>> On Wed, 2019-09-04 at 08:07 -0400, Mark Hatle wrote:
 On 9/3/19 1:59 PM, Wes Lindauer wrote:
> Mark,
>
> In reference to "It typically does NOT include the license of
> things used to
> build the software (such as makefiles, autoconf fragments, etc)".
> Since the only file that is licensed under GPLv3 is a M4 macro,
> does that mean
> the current patch is still valid? Shouldn't the GPLv3 license be
> removed from
> this recipe?

 Unless the M4 file is generating/injecting code into the build(very
 few I've
 seen do this), then I would say it's not under GPLv3 at all.  (And I
 wouldn't
 have included GPLv3 in the LICENSE statement.)

 But we need more consensus then just me saying so.

 This may be a good question for the OE-TSC to ensure that we have
 clarification
 on this issue, and it's not just me saying I think one way or
 another.
>>>
>>> Not sure it needs to go to the TSC, we just need a patch which clearly
>>> says why the LICENSE statement is incorrect. I don't think the original
>>> patch in the series was clear about why GPLv3 didn't apply but if the
>>> commit message is improved, its probably fine.
>>
>> I am getting more and more confused about both the patch and the 
>> semantics of LICENSE.
>>
>> The status quo in the recipe is:
>>
>> <--  snip  ->
>>
>> # The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the only file
>> # which is GPLv3 is an m4 macro which isn't shipped in any of our packages,
>> # and the LGPL bits are under lib/, which appears to be used for libgnu, 
>> which
>> # appears to be used for DOS builds. So we're left with GPLv2+ and PD.
>> LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ & PD"
>> LICENSE_${PN} = "GPLv2+"
>> LICENSE_${PN}-dev = "GPLv2+"
>> LICENSE_${PN}-staticdev = "GPLv2+"
>> LICENSE_${PN}-doc = "GPLv2+"
>> LICENSE_${PN}-dbg = "GPLv2+"
>> LICENSE_${PN}-locale = "GPLv2+"
>> LICENSE_liblzma = "PD"
>>
>> LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
>> 
>> file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
>> 
>> file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
>> 
>> file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
>> 
>> file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
>> "
>>
>> <--  snip  -->
>>
>> My confusion about the patch is that it removes COPYING.GPLv3 from 
>> LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in LICENSE.
>>
>> My confusion about the semantics of LICENSE is that I fail to find a 
>> clear statement in the documentation that the legal meaning of LICENSE 
>> in OE is what Mark claims it would be. Is this just Marks personal 
>> opinion on what should be done, or is this undocumented tribal 
>> knowledge, or is the exact semantics of LICENSE documented
>> somewhere in a language that lawyers understand?
>>
>> My guess for the latter would be "undocumented tribal knowledge",
>> and clarification is required what is actually correct or incorrect
>> here. And I think this is also what Mark was asking for.
> 
> It -was- documented at one time, but I suspect that documentation was revised
> and the language was lost (or it never made it into a final version of the 
> docs.)
> 
> This is why I was suggesting the TSC weigh in, and just clarify that:
> 
> LICENSE = is the _source code_ license, and only includes items that are or
> could be included in the making of the binaries.  This does NOT include
> autoconf, automake, makefiles, etc that are only used during the build 
> process,
> but not in the sources used to build the outputs.
> 
> LICENSE_ = is the binary license for a specific package.  It defaults to
> the same as the LICENSE.

Replying to myself  from meta/conf/documentation.conf:

LICENSE[doc] = "The list of source licenses for the recipe. Logical operators
'&' or '|' and parentheses can be used."


Not sure if this clarifies, but that is the internally documented version.

>From the current mega-manual:

LICENSE: This variable specifies the license for the software. If you do not
know the license under which the software you are building is distributed, you
should go to the source code and look for that information. Typical files
containing this information include COPYING, LICENSE, and README files. You
could also find the information near the top of a source file.


So again, my reading is not compiled (output) items, like autoconf, makefiles,
etc would not be considered 'source code'.  But again, I think this really
requires clarification so there is no ambiguity as to what was intended.

--Mark

> --Mark
> 
>>> Cheers,
>>>
>>> Richard
>>
>> cu
>> Adrian
>>
> 

-- 

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Adrian Bunk]

On Wed, Sep 04, 2019 at 08:07:58AM -0400, Mark Hatle wrote:
> On 9/3/19 1:59 PM, Wes Lindauer wrote:
>...
> > In reference to "It typically does NOT include the license of things used to
> > build the software (such as makefiles, autoconf fragments, etc)".
> > Since the only file that is licensed under GPLv3 is a M4 macro, does that 
> > mean
> > the current patch is still valid? Shouldn't the GPLv3 license be removed 
> > from
> > this recipe?
> 
> Unless the M4 file is generating/injecting code into the build(very few I've
> seen do this),
>...

If the defines in config.h are "code" then many do.

> --Mark

cu
Adrian

-- 

   "Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
   "Only a promise," Lao Er said.
   Pearl S. Buck - Dragon Seed

-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Mark Hatle]

On 9/4/19 3:53 PM, Adrian Bunk wrote:
> On Wed, Sep 04, 2019 at 07:50:35PM +0100, Richard Purdie wrote:
>> On Wed, 2019-09-04 at 08:07 -0400, Mark Hatle wrote:
>>> On 9/3/19 1:59 PM, Wes Lindauer wrote:
 Mark,

 In reference to "It typically does NOT include the license of
 things used to
 build the software (such as makefiles, autoconf fragments, etc)".
 Since the only file that is licensed under GPLv3 is a M4 macro,
 does that mean
 the current patch is still valid? Shouldn't the GPLv3 license be
 removed from
 this recipe?
>>>
>>> Unless the M4 file is generating/injecting code into the build(very
>>> few I've
>>> seen do this), then I would say it's not under GPLv3 at all.  (And I
>>> wouldn't
>>> have included GPLv3 in the LICENSE statement.)
>>>
>>> But we need more consensus then just me saying so.
>>>
>>> This may be a good question for the OE-TSC to ensure that we have
>>> clarification
>>> on this issue, and it's not just me saying I think one way or
>>> another.
>>
>> Not sure it needs to go to the TSC, we just need a patch which clearly
>> says why the LICENSE statement is incorrect. I don't think the original
>> patch in the series was clear about why GPLv3 didn't apply but if the
>> commit message is improved, its probably fine.
> 
> I am getting more and more confused about both the patch and the 
> semantics of LICENSE.
> 
> The status quo in the recipe is:
> 
> <--  snip  ->
> 
> # The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the only file
> # which is GPLv3 is an m4 macro which isn't shipped in any of our packages,
> # and the LGPL bits are under lib/, which appears to be used for libgnu, which
> # appears to be used for DOS builds. So we're left with GPLv2+ and PD.
> LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ & PD"
> LICENSE_${PN} = "GPLv2+"
> LICENSE_${PN}-dev = "GPLv2+"
> LICENSE_${PN}-staticdev = "GPLv2+"
> LICENSE_${PN}-doc = "GPLv2+"
> LICENSE_${PN}-dbg = "GPLv2+"
> LICENSE_${PN}-locale = "GPLv2+"
> LICENSE_liblzma = "PD"
> 
> LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
> file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 
> \
> file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 
> \
> 
> file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
> 
> file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
> "
> 
> <--  snip  -->
> 
> My confusion about the patch is that it removes COPYING.GPLv3 from 
> LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in LICENSE.
> 
> My confusion about the semantics of LICENSE is that I fail to find a 
> clear statement in the documentation that the legal meaning of LICENSE 
> in OE is what Mark claims it would be. Is this just Marks personal 
> opinion on what should be done, or is this undocumented tribal 
> knowledge, or is the exact semantics of LICENSE documented
> somewhere in a language that lawyers understand?
> 
> My guess for the latter would be "undocumented tribal knowledge",
> and clarification is required what is actually correct or incorrect
> here. And I think this is also what Mark was asking for.

It -was- documented at one time, but I suspect that documentation was revised
and the language was lost (or it never made it into a final version of the 
docs.)

This is why I was suggesting the TSC weigh in, and just clarify that:

LICENSE = is the _source code_ license, and only includes items that are or
could be included in the making of the binaries.  This does NOT include
autoconf, automake, makefiles, etc that are only used during the build process,
but not in the sources used to build the outputs.

LICENSE_ = is the binary license for a specific package.  It defaults to
the same as the LICENSE.

--Mark

>> Cheers,
>>
>> Richard
> 
> cu
> Adrian
> 

-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Adrian Bunk]

On Wed, Sep 04, 2019 at 07:50:35PM +0100, Richard Purdie wrote:
> On Wed, 2019-09-04 at 08:07 -0400, Mark Hatle wrote:
> > On 9/3/19 1:59 PM, Wes Lindauer wrote:
> > > Mark,
> > > 
> > > In reference to "It typically does NOT include the license of
> > > things used to
> > > build the software (such as makefiles, autoconf fragments, etc)".
> > > Since the only file that is licensed under GPLv3 is a M4 macro,
> > > does that mean
> > > the current patch is still valid? Shouldn't the GPLv3 license be
> > > removed from
> > > this recipe?
> > 
> > Unless the M4 file is generating/injecting code into the build(very
> > few I've
> > seen do this), then I would say it's not under GPLv3 at all.  (And I
> > wouldn't
> > have included GPLv3 in the LICENSE statement.)
> > 
> > But we need more consensus then just me saying so.
> > 
> > This may be a good question for the OE-TSC to ensure that we have
> > clarification
> > on this issue, and it's not just me saying I think one way or
> > another.
> 
> Not sure it needs to go to the TSC, we just need a patch which clearly
> says why the LICENSE statement is incorrect. I don't think the original
> patch in the series was clear about why GPLv3 didn't apply but if the
> commit message is improved, its probably fine.

I am getting more and more confused about both the patch and the 
semantics of LICENSE.

The status quo in the recipe is:

<--  snip  ->

# The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the only file
# which is GPLv3 is an m4 macro which isn't shipped in any of our packages,
# and the LGPL bits are under lib/, which appears to be used for libgnu, which
# appears to be used for DOS builds. So we're left with GPLv2+ and PD.
LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ & PD"
LICENSE_${PN} = "GPLv2+"
LICENSE_${PN}-dev = "GPLv2+"
LICENSE_${PN}-staticdev = "GPLv2+"
LICENSE_${PN}-doc = "GPLv2+"
LICENSE_${PN}-dbg = "GPLv2+"
LICENSE_${PN}-locale = "GPLv2+"
LICENSE_liblzma = "PD"

LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \

file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \

file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
"

<--  snip  -->

My confusion about the patch is that it removes COPYING.GPLv3 from 
LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in LICENSE.

My confusion about the semantics of LICENSE is that I fail to find a 
clear statement in the documentation that the legal meaning of LICENSE 
in OE is what Mark claims it would be. Is this just Marks personal 
opinion on what should be done, or is this undocumented tribal 
knowledge, or is the exact semantics of LICENSE documented
somewhere in a language that lawyers understand?

My guess for the latter would be "undocumented tribal knowledge",
and clarification is required what is actually correct or incorrect
here. And I think this is also what Mark was asking for.

> Cheers,
> 
> Richard

cu
Adrian

-- 

   "Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
   "Only a promise," Lao Er said.
   Pearl S. Buck - Dragon Seed

-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Richard Purdie]

On Wed, 2019-09-04 at 08:07 -0400, Mark Hatle wrote:
> On 9/3/19 1:59 PM, Wes Lindauer wrote:
> > Mark,
> > 
> > In reference to "It typically does NOT include the license of
> > things used to
> > build the software (such as makefiles, autoconf fragments, etc)".
> > Since the only file that is licensed under GPLv3 is a M4 macro,
> > does that mean
> > the current patch is still valid? Shouldn't the GPLv3 license be
> > removed from
> > this recipe?
> 
> Unless the M4 file is generating/injecting code into the build(very
> few I've
> seen do this), then I would say it's not under GPLv3 at all.  (And I
> wouldn't
> have included GPLv3 in the LICENSE statement.)
> 
> But we need more consensus then just me saying so.
> 
> This may be a good question for the OE-TSC to ensure that we have
> clarification
> on this issue, and it's not just me saying I think one way or
> another.

Not sure it needs to go to the TSC, we just need a patch which clearly
says why the LICENSE statement is incorrect. I don't think the original
patch in the series was clear about why GPLv3 didn't apply but if the
commit message is improved, its probably fine.

Cheers,

Richard

-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Mark Hatle]

On 9/3/19 1:59 PM, Wes Lindauer wrote:
> Mark,
> 
> In reference to "It typically does NOT include the license of things used to
> build the software (such as makefiles, autoconf fragments, etc)".
> Since the only file that is licensed under GPLv3 is a M4 macro, does that mean
> the current patch is still valid? Shouldn't the GPLv3 license be removed from
> this recipe?

Unless the M4 file is generating/injecting code into the build(very few I've
seen do this), then I would say it's not under GPLv3 at all.  (And I wouldn't
have included GPLv3 in the LICENSE statement.)

But we need more consensus then just me saying so.

This may be a good question for the OE-TSC to ensure that we have clarification
on this issue, and it's not just me saying I think one way or another.

--Mark

> Wes L
> 
> On Tue, Aug 27, 2019 at 2:28 PM Mark Hatle  > wrote:
> 
> On 8/27/19 1:04 PM, Adrian Bunk wrote:
> > On Fri, Aug 16, 2019 at 01:50:14PM -0700, Khem Raj wrote:
> >> On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer 
>  > wrote:
> >>>
> >>> Although xz has some files that are GPLv3 licensed, none of them get
> >>> packaged up, and therefore none of it ends up in the final rootfs. 
> Since
> >>> there is no GPLv3 code in the final image, we don't want to include it
> >>> when we collect licenses, as that would give the incorrect impression
> >>> that the image contains GPLv3 code.
> >>
> >> We will be distributing this in src packages though. Maybe these files
> >> should be deleted before the build even starts.
> >
> > OE does licence tracking on binary packages, not on source packages.
> 
> It tracks -both-.  Since MOST recipes and binary packages agree, people 
> don't
> often know this.
> 
> LICENSE is the -recipe source license-.  Nothing more nothing less.  It
> typically does NOT include the license of things used to build the 
> software
> (such as makefiles, autoconf fragments, etc), but must include the 
> license of
> any sources that are or may be used to construct binaries.
> 
> LICENSE_ is automatically defined as LICENSE.  If a binary 
> package has
> a difference license (which must ALWAYS be a subset of the recipe 
> LICENSE), then
> it can be specified independently.
> 
> See sysfsutils as an example:
> 
> LICENSE = "GPLv2 & LGPLv2.1"
> LICENSE_${PN} = "GPLv2"
> LICENSE_libsysfs = "LGPLv2.1"
> 
> recipe is made of of source code consisting of GPLv2 and LGPLv2.1.
> 
> The LICENSE_${PN} is expected to be GPLv2, while the LICENSE_libsysfs is
> expected to be LGPLv2.1.
> 
> 
> The LIC_FILES_CHKSUM is supposed to represent the -recipe- source 
> license.  If
> the component is used to build the binaries, then it needs to be listed 
> (but
> only has to be listed once).
> 
> If the component MIGHT be used, it needs to be listed.
> 
> If the component will NOT be used, then it should not be listed (and it's
> advised to remove it from the source to avoid accidental usage...)
> 
> --Mark
> 
> 
> > There are recipes that build binary packages with different licences
> > from the same sources.
> >
> > cu
> > Adrian
> >
> 
> -- 
> ___
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> 
> http://lists.openembedded.org/mailman/listinfo/openembedded-core
> 

-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Wes Lindauer]

Mark,

In reference to "It typically does NOT include the license of things used
to build the software (such as makefiles, autoconf fragments, etc)".
Since the only file that is licensed under GPLv3 is a M4 macro, does that
mean the current patch is still valid? Shouldn't the GPLv3 license be
removed from this recipe?

Wes L

On Tue, Aug 27, 2019 at 2:28 PM Mark Hatle  wrote:

> On 8/27/19 1:04 PM, Adrian Bunk wrote:
> > On Fri, Aug 16, 2019 at 01:50:14PM -0700, Khem Raj wrote:
> >> On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer <
> wesley.linda...@gmail.com> wrote:
> >>>
> >>> Although xz has some files that are GPLv3 licensed, none of them get
> >>> packaged up, and therefore none of it ends up in the final rootfs.
> Since
> >>> there is no GPLv3 code in the final image, we don't want to include it
> >>> when we collect licenses, as that would give the incorrect impression
> >>> that the image contains GPLv3 code.
> >>
> >> We will be distributing this in src packages though. Maybe these files
> >> should be deleted before the build even starts.
> >
> > OE does licence tracking on binary packages, not on source packages.
>
> It tracks -both-.  Since MOST recipes and binary packages agree, people
> don't
> often know this.
>
> LICENSE is the -recipe source license-.  Nothing more nothing less.  It
> typically does NOT include the license of things used to build the software
> (such as makefiles, autoconf fragments, etc), but must include the license
> of
> any sources that are or may be used to construct binaries.
>
> LICENSE_ is automatically defined as LICENSE.  If a binary
> package has
> a difference license (which must ALWAYS be a subset of the recipe
> LICENSE), then
> it can be specified independently.
>
> See sysfsutils as an example:
>
> LICENSE = "GPLv2 & LGPLv2.1"
> LICENSE_${PN} = "GPLv2"
> LICENSE_libsysfs = "LGPLv2.1"
>
> recipe is made of of source code consisting of GPLv2 and LGPLv2.1.
>
> The LICENSE_${PN} is expected to be GPLv2, while the LICENSE_libsysfs is
> expected to be LGPLv2.1.
>
>
> The LIC_FILES_CHKSUM is supposed to represent the -recipe- source
> license.  If
> the component is used to build the binaries, then it needs to be listed
> (but
> only has to be listed once).
>
> If the component MIGHT be used, it needs to be listed.
>
> If the component will NOT be used, then it should not be listed (and it's
> advised to remove it from the source to avoid accidental usage...)
>
> --Mark
>
>
> > There are recipes that build binary packages with different licences
> > from the same sources.
> >
> > cu
> > Adrian
> >
>
> --
> ___
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core
>
-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Mark Hatle]

On 8/27/19 1:04 PM, Adrian Bunk wrote:
> On Fri, Aug 16, 2019 at 01:50:14PM -0700, Khem Raj wrote:
>> On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer  
>> wrote:
>>>
>>> Although xz has some files that are GPLv3 licensed, none of them get
>>> packaged up, and therefore none of it ends up in the final rootfs. Since
>>> there is no GPLv3 code in the final image, we don't want to include it
>>> when we collect licenses, as that would give the incorrect impression
>>> that the image contains GPLv3 code.
>>
>> We will be distributing this in src packages though. Maybe these files
>> should be deleted before the build even starts.
> 
> OE does licence tracking on binary packages, not on source packages.

It tracks -both-.  Since MOST recipes and binary packages agree, people don't
often know this.

LICENSE is the -recipe source license-.  Nothing more nothing less.  It
typically does NOT include the license of things used to build the software
(such as makefiles, autoconf fragments, etc), but must include the license of
any sources that are or may be used to construct binaries.

LICENSE_ is automatically defined as LICENSE.  If a binary package has
a difference license (which must ALWAYS be a subset of the recipe LICENSE), then
it can be specified independently.

See sysfsutils as an example:

LICENSE = "GPLv2 & LGPLv2.1"
LICENSE_${PN} = "GPLv2"
LICENSE_libsysfs = "LGPLv2.1"

recipe is made of of source code consisting of GPLv2 and LGPLv2.1.

The LICENSE_${PN} is expected to be GPLv2, while the LICENSE_libsysfs is
expected to be LGPLv2.1.


The LIC_FILES_CHKSUM is supposed to represent the -recipe- source license.  If
the component is used to build the binaries, then it needs to be listed (but
only has to be listed once).

If the component MIGHT be used, it needs to be listed.

If the component will NOT be used, then it should not be listed (and it's
advised to remove it from the source to avoid accidental usage...)

--Mark


> There are recipes that build binary packages with different licences 
> from the same sources.
> 
> cu
> Adrian
> 

-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Adrian Bunk]

On Fri, Aug 16, 2019 at 01:50:14PM -0700, Khem Raj wrote:
> On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer  
> wrote:
> >
> > Although xz has some files that are GPLv3 licensed, none of them get
> > packaged up, and therefore none of it ends up in the final rootfs. Since
> > there is no GPLv3 code in the final image, we don't want to include it
> > when we collect licenses, as that would give the incorrect impression
> > that the image contains GPLv3 code.
> 
> We will be distributing this in src packages though. Maybe these files
> should be deleted before the build even starts.

OE does licence tracking on binary packages, not on source packages.

There are recipes that build binary packages with different licences 
from the same sources.

cu
Adrian

-- 

   "Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
   "Only a promise," Lao Er said.
   Pearl S. Buck - Dragon Seed

-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Wes Lindauer]

Yes, I see that could be a valid concern. Is this a sign that poky needs
per-package LIC_FILES_CHKSUM variables the same way each package can set
different LICENSE values? I would like to continue to use Yocto to collect
licenses for compliance reasons, but in this case I am getting an incorrect
license file in my image. In my configuration, I am placing "GPLv3" in
INCOMPATIBLE_LICENSES. Is there any way to use this information at rootfs
time to exclude GPLv3 licenses from being collected? Do you have any
recommendations for how I should proceed with collecting accurate licenses
in my image?

Thanks for your help,
Wes L

On Fri, Aug 16, 2019 at 4:50 PM Khem Raj  wrote:

> On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer 
> wrote:
> >
> > Although xz has some files that are GPLv3 licensed, none of them get
> > packaged up, and therefore none of it ends up in the final rootfs. Since
> > there is no GPLv3 code in the final image, we don't want to include it
> > when we collect licenses, as that would give the incorrect impression
> > that the image contains GPLv3 code.
>
> We will be distributing this in src packages though. Maybe these files
> should be deleted before the build even starts.
> >
> > Also fixes the endline for getopt.c which had a couple of non-license
> > text lines at the bottom.
> > ---
> >  meta/recipes-extended/xz/xz_5.2.4.bb | 3 +--
> >  1 file changed, 1 insertion(+), 2 deletions(-)
> >
> > diff --git a/meta/recipes-extended/xz/xz_5.2.4.bb
> b/meta/recipes-extended/xz/xz_5.2.4.bb
> > index 791746e1cf..e6725e5f12 100644
> > --- a/meta/recipes-extended/xz/xz_5.2.4.bb
> > +++ b/meta/recipes-extended/xz/xz_5.2.4.bb
> > @@ -17,9 +17,8 @@ LICENSE_liblzma = "PD"
> >
> >  LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a
> \
> >
> file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
> > -
> file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
> >
> file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
> > -
> file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
> > +
> file://lib/getopt.c;endline=21;md5=32575ca1a42c5fa04aac6f08566ddf48 \
> >  "
> >
> >  SRC_URI = "http://tukaani.org/xz/xz-${PV}.tar.gz;
> > --
> > 2.14.5
> >
> > --
> > ___
> > Openembedded-core mailing list
> > Openembedded-core@lists.openembedded.org
> > http://lists.openembedded.org/mailman/listinfo/openembedded-core
>
-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Khem Raj]

On Fri, Aug 16, 2019 at 12:46 PM Wes Lindauer  wrote:
>
> Although xz has some files that are GPLv3 licensed, none of them get
> packaged up, and therefore none of it ends up in the final rootfs. Since
> there is no GPLv3 code in the final image, we don't want to include it
> when we collect licenses, as that would give the incorrect impression
> that the image contains GPLv3 code.

We will be distributing this in src packages though. Maybe these files
should be deleted before the build even starts.
>
> Also fixes the endline for getopt.c which had a couple of non-license
> text lines at the bottom.
> ---
>  meta/recipes-extended/xz/xz_5.2.4.bb | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/meta/recipes-extended/xz/xz_5.2.4.bb 
> b/meta/recipes-extended/xz/xz_5.2.4.bb
> index 791746e1cf..e6725e5f12 100644
> --- a/meta/recipes-extended/xz/xz_5.2.4.bb
> +++ b/meta/recipes-extended/xz/xz_5.2.4.bb
> @@ -17,9 +17,8 @@ LICENSE_liblzma = "PD"
>
>  LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
>  
> file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
> -
> file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
>  
> file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
> -
> file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
> +
> file://lib/getopt.c;endline=21;md5=32575ca1a42c5fa04aac6f08566ddf48 \
>  "
>
>  SRC_URI = "http://tukaani.org/xz/xz-${PV}.tar.gz;
> --
> 2.14.5
>
> --
> ___
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core
-- 
___
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core