Re: unclear license identifiers

[Quentin Schulz <quentin.schulz@cherry.de>]

On 1/8/26 4:47 PM, Quentin Schulz wrote:
> Hi Oliver,
> 
> On 12/19/25 4:51 PM, oliver Fendt wrote:
>> [You don't often get email from ofendt@googlemail.com. Learn why this 
>> is important at https://aka.ms/LearnAboutSenderIdentification ]
>>
>> Hi all,
>>
>> I recently did a license analysis of u-boot an I came across some
>> unclear license information in files. I do not know whether this is
>> the right place to put my points, nevertheless I want to share my
>> findings.
>> 1. the file https://eur02.safelinks.protection.outlook.com/? 
>> url=https%3A%2F%2Fgithub.com%2Fu-boot%2Fu- 
>> boot%2Fblob%2Fmaster%2Fdrivers%2Fmmc%2Fsdhci- 
>> cadence6.c&data=05%7C02%7Cquentin.schulz%40cherry.de%7Cdde9821aaf3941a7103108de3f284ddd%7C5e0e1b5221b54e7b83bb514ec460677e%7C0%7C0%7C639017639504977773%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=g9tZGco8ca9ScjhMgxCxzBwZfHvzdMtCoKPg%2FeERyBo%3D&reserved=0
>> contains the following information SPDX-License-Identifier:
>> GPL-2.0-or-platform_driver which is not a valid license identifier, I
>> think GPL-2.0-or-later is meant here.
>>
> 
> +Cc @Kuan Lim Lee, @Alex Soo, @Wei Liang Lim who contributed the driver, 
> they should be able to answer what the intended license was (I assume 
> the same as you).
> 
>> 2. the file https://eur02.safelinks.protection.outlook.com/? 
>> url=https%3A%2F%2Fgithub.com%2Fu-boot%2Fu- 
>> boot%2Fblob%2Fmaster%2Fdts%2Fupstream%2Fsrc%2Farm64%2Farm%2Fjuno- 
>> clocks.dtsi&data=05%7C02%7Cquentin.schulz%40cherry.de%7Cdde9821aaf3941a7103108de3f284ddd%7C5e0e1b5221b54e7b83bb514ec460677e%7C0%7C0%7C639017639504990800%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=xIjuRJ6aCai1Qkrjyox1zoeuBeqraiHFqrURQoqyPuM%3D&reserved=0
>> contains the following information "This file is licensed under a dual
>> GPLv2 or BSD license." the BSD license term is vague is it
>> BSD-3-Clause or BSD-2-Clause or 0BSD or...
>>
> 
> We get this file from the Linux kernel, so report that there. This file 
> is more than a decade old, but arm is still active in the community so 
> you should be able to find someone to answer this question.
> 
> See: https://elixir.bootlin.com/linux/v6.18.3/source/arch/arm64/boot/ 
> dts/arm/juno-clocks.dtsi
> We do NOT modify any file in dts/ folder in U-Boot. It's imported 
> (merged) from https://git.kernel.org/pub/scm/linux/kernel/git/ 
> devicetree/devicetree-rebasing.git/ which is generated from the Linux 
> kernel tree from Torvalds.
> 
>> 3. the file https://eur02.safelinks.protection.outlook.com/? 
>> url=https%3A%2F%2Fgithub.com%2Fu-boot%2Fu- 
>> boot%2Fblob%2Fmaster%2Flib%2Fzstd%2Fcommon%2Fcpu.h&data=05%7C02%7Cquentin.schulz%40cherry.de%7Cdde9821aaf3941a7103108de3f284ddd%7C5e0e1b5221b54e7b83bb514ec460677e%7C0%7C0%7C639017639504999145%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=V%2BBI%2BTuw8%2FJfOA9BHSmIO6Mu9tDFE%2BRI5TEZtfuHFRE%3D&reserved=0
>> an others contain the following text:
>>   * Copyright (c) Facebook, Inc.
>>   * All rights reserved.
>>   *
>>   * This source code is licensed under both the BSD-style license 
>> (found in the
>>   * LICENSE file in the root directory of this source tree) and the 
>> GPLv2 (found
>>   * in the COPYING file in the root directory of this source tree).
>>   * You may select, at your option, one of the above-listed licenses.
>>
>> when looking up the zstd repo on GitHub there is the same file
> 
> Be careful when doing those cross-checks. We import a specific version 
> of files, so you need to check at that specific time in the repo history 
> what the license was.
> 

And guess who checked the version used in Linux kernel and not in U-Boot :)

>> https://eur02.safelinks.protection.outlook.com/? 
>> url=https%3A%2F%2Fgithub.com%2Ffacebook%2Fzstd%2Fblob%2Fdev%2Flib%2Fcommon%2Fcpu.h&data=05%7C02%7Cquentin.schulz%40cherry.de%7Cdde9821aaf3941a7103108de3f284ddd%7C5e0e1b5221b54e7b83bb514ec460677e%7C0%7C0%7C639017639505006974%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=vUDaUjdiT8I5VC5suVIYVFdZDMJmVXJwoOyUdCzrlug%3D&reserved=0 with the
>> same license information. The root directory contains a COPYING file
>> and a LICENSE file (both are not present in u-boot) the COPYING file
>> contains the text of the GPL-2.0 and the LICENSE file contains the
>> following text:
>> Redistribution and use in source and binary forms, with or without 
>> modification,
>> are permitted provided that the following conditions are met:
>>
>>   * Redistributions of source code must retain the above copyright 
>> notice, this
>>     list of conditions and the following disclaimer.
>>
>>   * Redistributions in binary form must reproduce the above copyright 
>> notice,
>>     this list of conditions and the following disclaimer in the 
>> documentation
>>     and/or other materials provided with the distribution.
>>
>>   * Neither the name Facebook, nor Meta, nor the names of its 
>> contributors may
>>     be used to endorse or promote products derived from this software 
>> without
>>     specific prior written permission.
>>
>> THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 
>> "AS IS" AND
>> ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
>> IMPLIED
>> WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
>> DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 
>> LIABLE FOR
>> ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
>> DAMAGES
>> (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
>> SERVICES;
>> LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 
>> CAUSED AND ON
>> ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>> (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 
>> OF THIS
>> SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>>
>> Which is an individualized BSD-3-Clause license. Since the
>> BSD-3-Clause license is very clear in the wording " must reproduce the
>> above copyright notice, this list of conditions and the following
>> disclaimer in the documentation" the exact original license text of
>> the BSD-3-Clause license from Meta must be reproduced. Furthermore the
> 
> IANAL, so don't know if we *really* need to have this customized BSD 
> license text in our tree or if a generic BSD license text + the 
> appropriate copyright notice in each imported file would be enough. The 
> copyright seems to be the same in lib/zstd/decompress_sources.h in U- 
> Boot and LICENSE in the zstd repo, so that could be covered this way.
> 
>> GPL-2.0 is acc. to the text GPL-2.0-only and not GPL-2.0-or-later like
>> it is mentioned in
>> https://eur02.safelinks.protection.outlook.com/? 
>> url=https%3A%2F%2Fgithub.com%2Fu-boot%2Fu- 
>> boot%2Fblob%2Fmaster%2Flib%2Fzstd%2Fdecompress_sources.h&data=05%7C02%7Cquentin.schulz%40cherry.de%7Cdde9821aaf3941a7103108de3f284ddd%7C5e0e1b5221b54e7b83bb514ec460677e%7C0%7C0%7C639017639505015023%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=hQFytbMb02p%2FbodM3WFBtQUNa9qABC8vPhMQ%2FrdL9E8%3D&reserved=0:
>> /* SPDX-License-Identifier: GPL-2.0+ OR BSD-3-Clause */
>> /*
>>   * Copyright (c) Facebook, Inc.
>>   * All rights reserved.
>>   *
>>   * This source code is licensed under both the BSD-style license 
>> (found in the
>>   * LICENSE file in the root directory of this source tree) and the 
>> GPLv2 (found
>>   * in the COPYING file in the root directory of this source tree).
>>   * You may select, at your option, one of the above-listed licenses.
>>
> 
> https://github.com/facebook/zstd/blob/v1.5.7/contrib/linux-kernel/ 
> decompress_sources.h. It's specified as later in the SPDX-License- 
> Identifier.
> 

Here it should be https://github.com/facebook/zstd/blob/v1.5.2/LICENSE 
instead. But same remarks apply.

Cheers,
Quentin