[OE-core] [PATCH] cmake: Upgrade to 3.9.3 release

[Peter Kjellerstedt]

> -----Original Message-----
> From: openembedded-core-bounces at lists.openembedded.org
> [mailto:openembedded-core-bounces at lists.openembedded.org] On Behalf Of
> Alexander Kanavin
> Sent: den 10 oktober 2017 13:17
> To: Andre McCurdy <armccurdy at gmail.com>
> Cc: Otavio Salvador <otavio at ossystems.com.br>; OpenEmbedded Core
> Mailing List <openembedded-core at lists.openembedded.org>
> Subject: Re: [OE-core] [PATCH] cmake: Upgrade to 3.9.3 release
> 
> On 10/10/2017 04:01 AM, Andre McCurdy wrote:
> 
> >>> -LIC_FILES_CHKSUM = "file://Copyright.txt;md5=8d8c7bc32f8797d23f5cf605d9339d2d \
> >>> +LIC_FILES_CHKSUM = "file://Copyright.txt;md5=24600643e5d1d2b8f7478ae5c9074949 \
> >>>                      file://Source/cmake.h;beginline=1;endline=3;md5=4494dee184212fc89c469c3acd555a14"
> >>
> >> What has changed in Copyright.txt? If it's just the copyright 
> >> years, you can exclude the line using beginline/endline.
> >
> > The copyright statement and copyright year(s) are part of the
> > license. Slicing and dicing the license text to get a consistent 
> > hash probably isn't the right approach.
> 
> The purpose of LIC_FILES_CHECKSUM is to establish whether what the
> recipe claims in LICENSE matches what the upstream says in the source
> tree. For that purpose, when the code was published, who owns the code,
> or who made contributions to it are all not relevant and can be
> excluded. Also, such exclusions remove a major nuisance from recipe
> maintainers' job, and that is always a good thing.

That is not the entire story though. If you have COPY_LIC_MANIFEST and 
COPY_LIC_DIRS set in your configuration, the relevant licenses will be 
installed in the image, and for licenses specified with beginline and/or 
endline this only includes the specified lines.

Then, if the license requires that you include the copyright information, 
which is pretty common, e.g., BSD, leaving out that part just to avoid 
having to update the recipe once a year means that you are not really 
complying with the license... And neither will any users of the layer 
be who believe they are covered license wise by including the license 
information bitbake produces and installs in their images. 

True, you should always verify all licenses yourself for any code you 
use, but still being able to rely on all relevant parts of a license 
being copied by the build system sounds like something one should be 
able to expect.

> As a technicality, the years of publication and code owners are not a
> part of the license, they a part of the copyright notice (which may
> also include the license text if it's short, or a reference to it if 
> it's long):
> 
> https://en.wikipedia.org/wiki/Copyright_notice
> Alex

//Peter