[OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum

[Peter Kjellerstedt]

> -----Original Message-----
> From: openembedded-core-bounces at lists.openembedded.org <openembedded-
> core-bounces at lists.openembedded.org> On Behalf Of Adrian Bunk
> Sent: den 4 september 2019 21:54
> To: Richard Purdie <richard.purdie at linuxfoundation.org>
> Cc: Patches and discussions about the oe-core layer <openembedded-
> core at lists.openembedded.org>
> Subject: Re: [OE-core] [PATCH 6/6] xz: Remove GPLv3 license checksum
> 
> On Wed, Sep 04, 2019 at 07:50:35PM +0100, Richard Purdie wrote:
> > On Wed, 2019-09-04 at 08:07 -0400, Mark Hatle wrote:
> > > On 9/3/19 1:59 PM, Wes Lindauer wrote:
> > > > Mark,
> > > >
> > > > In reference to "It typically does NOT include the license of
> > > > things used to
> > > > build the software (such as makefiles, autoconf fragments, etc)".
> > > > Since the only file that is licensed under GPLv3 is a M4 macro,
> > > > does that mean
> > > > the current patch is still valid? Shouldn't the GPLv3 license be
> > > > removed from
> > > > this recipe?
> > >
> > > Unless the M4 file is generating/injecting code into the build(very
> > > few I've
> > > seen do this), then I would say it's not under GPLv3 at all.  (And
> I
> > > wouldn't
> > > have included GPLv3 in the LICENSE statement.)
> > >
> > > But we need more consensus then just me saying so.
> > >
> > > This may be a good question for the OE-TSC to ensure that we have
> > > clarification
> > > on this issue, and it's not just me saying I think one way or
> > > another.
> >
> > Not sure it needs to go to the TSC, we just need a patch which
> clearly
> > says why the LICENSE statement is incorrect. I don't think the
> original
> > patch in the series was clear about why GPLv3 didn't apply but if the
> > commit message is improved, its probably fine.
> 
> I am getting more and more confused about both the patch and the
> semantics of LICENSE.
> 
> The status quo in the recipe is:
> 
> <--  snip  ->
> 
> # The source includes bits of PD, GPLv2, GPLv3, LGPLv2.1+, but the only
> file
> # which is GPLv3 is an m4 macro which isn't shipped in any of our
> packages,
> # and the LGPL bits are under lib/, which appears to be used for
> libgnu, which
> # appears to be used for DOS builds. So we're left with GPLv2+ and PD.
> LICENSE = "GPLv2+ & GPL-3.0-with-autoconf-exception & LGPLv2.1+ & PD"
> LICENSE_${PN} = "GPLv2+"
> LICENSE_${PN}-dev = "GPLv2+"
> LICENSE_${PN}-staticdev = "GPLv2+"
> LICENSE_${PN}-doc = "GPLv2+"
> LICENSE_${PN}-dbg = "GPLv2+"
> LICENSE_${PN}-locale = "GPLv2+"
> LICENSE_liblzma = "PD"
> 
> LIC_FILES_CHKSUM = "file://COPYING;md5=97d554a32881fee0aa283d96e47cb24a \
> 
> file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
> 
> file://COPYING.GPLv3;md5=d32239bcb673463ab874e80d47fae504 \
> 
> file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c \
> 
> file://lib/getopt.c;endline=23;md5=2069b0ee710572c03bb3114e4532cd84 \
>                     "
> 
> <--  snip  -->
> 
> My confusion about the patch is that it removes COPYING.GPLv3 from
> LIC_FILES_CHKSUM but keeps GPL-3.0-with-autoconf-exception in LICENSE.
> 
> My confusion about the semantics of LICENSE is that I fail to find a
> clear statement in the documentation that the legal meaning of LICENSE
> in OE is what Mark claims it would be. Is this just Marks personal
> opinion on what should be done, or is this undocumented tribal
> knowledge, or is the exact semantics of LICENSE documented
> somewhere in a language that lawyers understand?
> 
> My guess for the latter would be "undocumented tribal knowledge",
> and clarification is required what is actually correct or incorrect
> here. And I think this is also what Mark was asking for.
> 
> > Cheers,
> >
> > Richard
> 
> cu
> Adrian

Another thing that complicates this further is related to gathering and 
distributing the license information. E.g., if one uses COPY_LIC_DIR = "1" 
to automatically include all the license information for all packages 
installed in the image, this will include everything listed in 
LIC_FILES_CHKSUM regardless of which packages were installed. I.e., even 
if only liblzma (which is PD) is installed from xz, all of the GPL 
license texts will be installed in /usr/share/common-licenses/xz...

//Peter