[OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[richard.purdie at linuxfoundation.org]

On Wed, 2019-09-04 at 16:18 -0400, Mark Hatle wrote:
> On 9/4/19 3:53 PM, Adrian Bunk wrote:
> > I am getting more and more confused about both the patch and the 
> > semantics of LICENSE.
> > 
> > The status quo in the recipe is:
> > 
> > <--  snip  ->
> > 
> > # The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the
> > only file
> > # which is GPLv3 is an m4 macro which isn't shipped in any of our
> > packages,
> > # and the LGPL bits are under lib/, which appears to be used for
> > libgnu, which
> > # appears to be used for DOS builds. So we're left with GPLv2+ and
> > PD.
> > LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ &
> > PD"
> > LICENSE_${PN} = "GPLv2+"
> > LICENSE_${PN}-dev = "GPLv2+"
> > LICENSE_${PN}-staticdev = "GPLv2+"
> > LICENSE_${PN}-doc = "GPLv2+"
> > LICENSE_${PN}-dbg = "GPLv2+"
> > LICENSE_${PN}-locale = "GPLv2+"
> > LICENSE_liblzma = "PD"
> > 
> > LIC_FILES_CHKSUM =
> > "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
> >                     file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80
> > fdaf4a4263 \
> >                     file://COPYING.GPLv3;md5=d32239bcb673463ab874e8
> > 0d47fae504 \
> >                     file://COPYING.LGPLv2.1;md5=4fbd65380cdd2559510
> > 79008b364516c \
> >                     file://lib/getopt.c;endline=23;md5=2069b0ee7105
> > 72c03bb3114e4532cd84 \
> >                     "
> > 
> > <--  snip  -->
> > 
> > My confusion about the patch is that it removes COPYING.GPLv3 from 
> > LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in
> > LICENSE.
> > 
> > My confusion about the semantics of LICENSE is that I fail to find
> > a 
> > clear statement in the documentation that the legal meaning of
> > LICENSE 
> > in OE is what Mark claims it would be. Is this just Marks personal 
> > opinion on what should be done, or is this undocumented tribal 
> > knowledge, or is the exact semantics of LICENSE documented
> > somewhere in a language that lawyers understand?
> > 
> > My guess for the latter would be "undocumented tribal knowledge",
> > and clarification is required what is actually correct or incorrect
> > here. And I think this is also what Mark was asking for.
> 
> It -was- documented at one time, but I suspect that documentation was
> revised
> and the language was lost (or it never made it into a final version
> of the docs.)
> 
> This is why I was suggesting the TSC weigh in, and just clarify that:
> 
> LICENSE = is the _source code_ license, and only includes items that
> are or
> could be included in the making of the binaries.  This does NOT
> include
> autoconf, automake, makefiles, etc that are only used during the
> build process,
> but not in the sources used to build the outputs.
> 
> LICENSE_<pkg> = is the binary license for a specific package.  It
> defaults to
> the same as the LICENSE.

Historically, most m4 files don't include their license. This meant
that we haven't accounted for them in LICENSE. Where they are present,
we've tended to turn a blind eye to them as they don't cover the
binaries produced which is the piece of key importance to most people,
this recipe was one of the ones which attempted to clarify the
situation.

I suspect we do need to include such things in LICENSE since for
example these licenses could have an impact on the license of output
from the source archiver for example which might include build scripts.

The result is rather ugly but licensing in general is :(

It also gets tricky as we delete many autoconf files and regenerate
them. You'd hope that was under the same license but...

Cheers,

Richard