Re: [PATCH isar-cip-core v2] *: Add SPDX-License-Identifier MIT header

Jan Kiszka
2026-03-24T14:39:58Z

On 24.03.26 09:40, Kamlesh Gurudasani wrote:
> Add missing license headers to configuration, template, script,
> and wic partition layout files to make licensing consistent
> across the repository.
>
> Command Used:
> git ls-files | xargs grep -rL SPDX-License-Identifier
>
> Signed-off-by: Kamlesh Gurudasani <kamlesh@ti.com>
> ---
> Changes in v2:
> - added license to remaining files
> - Link to v1: https://lore.kernel.org/r/20260316-license-v1-1-5bb039f50c05@ti.com
> ---
> conf/distro/debian-bullseye-backports.list | 3 +++
> conf/distro/debian-buster-backports.list | 3 +++
> conf/distro/preferences.ovmf-snakeoil.conf | 3 +++
> conf/distro/preferences.swupdate-bullseye-backports.conf | 3 +++
> recipes-bsp/u-boot/files/ftpm-stmm.cfg | 3 +++
> recipes-bsp/u-boot/files/no-grub-workaround.cfg | 3 +++
> recipes-bsp/u-boot/files/qemu-extra.cfg | 3 +++
> recipes-bsp/u-boot/files/secure-boot.cfg | 3 +++
> recipes-bsp/u-boot/files/ti-extra.cfg | 3 +++
> recipes-core/customizations/files/99-silent-printk.conf | 3 +++
> recipes-core/customizations/files/99-watchdog.conf | 3 +++
> recipes-core/customizations/files/ssh-permit-root.conf | 3 +++
> recipes-core/home-fs/files/home.mount | 3 +++
> recipes-core/home-fs/files/postinst | 3 +++
> recipes-core/immutable-rootfs/files/95-disable-package-updates.preset | 3 +++
> recipes-core/immutable-rootfs/files/immutable-rootfs.tmpfiles.tmpl | 3 +++
> recipes-core/immutable-rootfs/files/postinst | 3 +++
> recipes-core/journald-config/files/persistent-journal.conf | 3 +++
> recipes-core/kernel-panic/files/sysrq-panic.service | 3 +++
> recipes-core/ltp/files/debian/control.tmpl | 3 +++
> recipes-core/ltp/files/debian/rules | 3 +++
> recipes-core/move-homedir-var/files/move-homedir-var.tmpfiles.tmpl | 3 +++
> recipes-core/security-customizations/files/postinst | 2 ++
> recipes-core/security-customizations/files/ssh-pam-remote.conf | 3 +++
> recipes-core/security-customizations/files/ssh-remote-session-term.conf | 3 +++
> recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl | 3 +++
> recipes-core/swupdate-config/files/hwrevision.tmpl | 3 +++
> recipes-core/swupdate-config/files/swupdate.cfg | 3 +++
> recipes-core/swupdate-handler-roundrobin/files/swupdate.handler.efibootguard.ini | 3 +++
> recipes-core/tmp-fs/files/postinst | 3 +++
> recipes-devtools/swupdate-signer/files/sign-swu-cms | 3 +++
> recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.env.tmpl | 3 +++
> recipes-initramfs/initramfs-crypt-hook/files/pwquality.conf | 3 +++
> recipes-initramfs/initramfs-factory-reset-hook/files/factory-reset-script.tmpl | 2 ++
> recipes-initramfs/initramfs-factory-reset-hook/files/reset-env.tmpl | 3 +++
> recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl | 2 ++
> recipes-initramfs/initramfs-overlay-hook/files/overlay_recovery_action.script | 2 ++
> recipes-kernel/linux/files/no-module-signing.cfg | 3 +++
> recipes-kernel/linux/files/no-tpm-hwrng.cfg | 3 +++
> recipes-kernel/linux/files/preempt-rt.cfg | 3 +++
> recipes-security/fail2ban-config/files/systemd-defaults.conf | 3 +++
> scripts/deploy-cip-core.sh | 3 +++
> scripts/generate-sb-db-from-existing-certificate.sh | 3 +++
> scripts/generate_secure_boot_keys.sh | 3 +++
> scripts/start-efishell.sh | 3 +++
> scripts/submit_lava.sh | 3 +++
> scripts/update-linux-cip.sh | 3 +++
> scripts/update-ltp.sh | 3 +++
> tests/templates/IEC_template.yml | 3 +++
> tests/templates/secureboot_corrupt_rootfs_steps.yml | 3 +++
> tests/templates/secureboot_negative_test.yml | 3 +++
> tests/templates/secureboot_template.yml | 3 +++
> tests/templates/secureboot_unsigned_bootloader_steps.yml | 3 +++
> tests/templates/secureboot_unsigned_kernel_steps.yml | 3 +++
> tests/templates/swupdate-test-action-M-COM.yml | 3 +++
> tests/templates/swupdate_corrupt_swu_artifact_steps.yml | 3 +++
> tests/templates/swupdate_corrupt_swu_steps.yml | 3 +++
> tests/templates/swupdate_negative_test.yml | 3 +++
> tests/templates/swupdate_reboot_without_confirm.yml | 3 +++
> tests/templates/swupdate_same_uuid_steps.yml | 3 +++
> tests/templates/swupdate_template.yml | 3 +++
> wic/ebg-signed-sysparts.inc | 3 +++
> wic/ebg-sysparts.inc | 3 +++
> wic/hihope-rzg2m-efibootguard.wks.in | 3 +++
> wic/qemu-arm64-efibootguard-secureboot.wks.in | 3 +++
> wic/qemu-arm64-efibootguard.wks.in | 3 +++
> wic/qemu-riscv64-efibootguard.wks.in | 3 +++
> wic/x86-uefi-efibootguard-secureboot.wks.in | 3 +++
> wic/x86-uefi-efibootguard.wks.in | 3 +++
> 69 files changed, 203 insertions(+)
>
> diff --git a/conf/distro/debian-bullseye-backports.list b/conf/distro/debian-bullseye-backports.list
> index 1594907..6107928 100644
> --- a/conf/distro/debian-bullseye-backports.list
> +++ b/conf/distro/debian-bullseye-backports.list
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> deb http://archive.debian.org/debian bullseye-backports main contrib non-free
> diff --git a/conf/distro/debian-buster-backports.list b/conf/distro/debian-buster-backports.list
> index 7134a35..842019e 100644
> --- a/conf/distro/debian-buster-backports.list
> +++ b/conf/distro/debian-buster-backports.list
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> deb http://archive.debian.org/debian buster-backports main contrib non-free
> diff --git a/conf/distro/preferences.ovmf-snakeoil.conf b/conf/distro/preferences.ovmf-snakeoil.conf
> index b51d1d4..25b7da4 100644
> --- a/conf/distro/preferences.ovmf-snakeoil.conf
> +++ b/conf/distro/preferences.ovmf-snakeoil.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> Package: ovmf
> Pin: release n=buster-backports
> Pin-Priority: 801
> diff --git a/conf/distro/preferences.swupdate-bullseye-backports.conf b/conf/distro/preferences.swupdate-bullseye-backports.conf
> index c5f6685..da307cd 100644
> --- a/conf/distro/preferences.swupdate-bullseye-backports.conf
> +++ b/conf/distro/preferences.swupdate-bullseye-backports.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> Package: dh-nodejs
> Pin: release n=bullseye-backports
> Pin-Priority: 801
> diff --git a/recipes-bsp/u-boot/files/ftpm-stmm.cfg b/recipes-bsp/u-boot/files/ftpm-stmm.cfg
> index af5da93..a6fe2a3 100644
> --- a/recipes-bsp/u-boot/files/ftpm-stmm.cfg
> +++ b/recipes-bsp/u-boot/files/ftpm-stmm.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> ### Enable OPTEE, fTPM and StMM
> CONFIG_TEE=y
> CONFIG_OPTEE=y
> diff --git a/recipes-bsp/u-boot/files/no-grub-workaround.cfg b/recipes-bsp/u-boot/files/no-grub-workaround.cfg
> index dc09edd..8a01ff6 100644
> --- a/recipes-bsp/u-boot/files/no-grub-workaround.cfg
> +++ b/recipes-bsp/u-boot/files/no-grub-workaround.cfg
> @@ -1,2 +1,5 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> ### Disable grub workaround
> # CONFIG_EFI_GRUB_ARM32_WORKAROUND is not set
> diff --git a/recipes-bsp/u-boot/files/qemu-extra.cfg b/recipes-bsp/u-boot/files/qemu-extra.cfg
> index e643db7..5380ad8 100644
> --- a/recipes-bsp/u-boot/files/qemu-extra.cfg
> +++ b/recipes-bsp/u-boot/files/qemu-extra.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> ### QEMU extra config
> CONFIG_MMC=y
> CONFIG_SUPPORT_EMMC_RPMB=y
> diff --git a/recipes-bsp/u-boot/files/secure-boot.cfg b/recipes-bsp/u-boot/files/secure-boot.cfg
> index 694356f..7b09a53 100644
> --- a/recipes-bsp/u-boot/files/secure-boot.cfg
> +++ b/recipes-bsp/u-boot/files/secure-boot.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> ### Secure boot config
> # CONFIG_BOOTSTD_DEFAULTS is not set
> # CONFIG_BOOTMETH_CROS is not set
> diff --git a/recipes-bsp/u-boot/files/ti-extra.cfg b/recipes-bsp/u-boot/files/ti-extra.cfg
> index c10d046..9500055 100644
> --- a/recipes-bsp/u-boot/files/ti-extra.cfg
> +++ b/recipes-bsp/u-boot/files/ti-extra.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> ### FTPM + RPMB + StandaloneMM setup
> CONFIG_OPTEE_SERVICE_DISCOVERY=y
> CONFIG_TPM=y
> diff --git a/recipes-core/customizations/files/99-silent-printk.conf b/recipes-core/customizations/files/99-silent-printk.conf
> index ad24d3a..c5b3799 100644
> --- a/recipes-core/customizations/files/99-silent-printk.conf
> +++ b/recipes-core/customizations/files/99-silent-printk.conf
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> kernel.printk = 3 4 1 3
> diff --git a/recipes-core/customizations/files/99-watchdog.conf b/recipes-core/customizations/files/99-watchdog.conf
> index c02756d..1f38c55 100644
> --- a/recipes-core/customizations/files/99-watchdog.conf
> +++ b/recipes-core/customizations/files/99-watchdog.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [Manager]
> RuntimeWatchdogSec=60s
> ShutdownWatchdogSec=60s
> diff --git a/recipes-core/customizations/files/ssh-permit-root.conf b/recipes-core/customizations/files/ssh-permit-root.conf
> index 1073982..ab26ab5 100644
> --- a/recipes-core/customizations/files/ssh-permit-root.conf
> +++ b/recipes-core/customizations/files/ssh-permit-root.conf
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> PermitRootLogin yes
> diff --git a/recipes-core/home-fs/files/home.mount b/recipes-core/home-fs/files/home.mount
> index 062517a..653495c 100644
> --- a/recipes-core/home-fs/files/home.mount
> +++ b/recipes-core/home-fs/files/home.mount
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [Unit]
> Description=Mount /home partition
> Before=local-fs.target
> diff --git a/recipes-core/home-fs/files/postinst b/recipes-core/home-fs/files/postinst
> index ab0db84..904aa73 100755
> --- a/recipes-core/home-fs/files/postinst
> +++ b/recipes-core/home-fs/files/postinst
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/recipes-core/immutable-rootfs/files/95-disable-package-updates.preset b/recipes-core/immutable-rootfs/files/95-disable-package-updates.preset
> index 7e6e9ef..b3b52ce 100644
> --- a/recipes-core/immutable-rootfs/files/95-disable-package-updates.preset
> +++ b/recipes-core/immutable-rootfs/files/95-disable-package-updates.preset
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> disable apt-daily.timer
> disable apt-daily-upgrade.timer
> disable dpkg-db-backup.timer
> diff --git a/recipes-core/immutable-rootfs/files/immutable-rootfs.tmpfiles.tmpl b/recipes-core/immutable-rootfs/files/immutable-rootfs.tmpfiles.tmpl
> index e6d25d2..4cdfc6f 100644
> --- a/recipes-core/immutable-rootfs/files/immutable-rootfs.tmpfiles.tmpl
> +++ b/recipes-core/immutable-rootfs/files/immutable-rootfs.tmpfiles.tmpl
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> L /var/lib/dpkg - - - - ${IMMUTABLE_DATA_DIR}/var/lib/dpkg
> d /var/log/audit 0700 root adm -
> d /var/lib/apt 0755 root root -
> diff --git a/recipes-core/immutable-rootfs/files/postinst b/recipes-core/immutable-rootfs/files/postinst
> index a6e1962..3b8071e 100644
> --- a/recipes-core/immutable-rootfs/files/postinst
> +++ b/recipes-core/immutable-rootfs/files/postinst
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/recipes-core/journald-config/files/persistent-journal.conf b/recipes-core/journald-config/files/persistent-journal.conf
> index 21dfde0..3e3419f 100644
> --- a/recipes-core/journald-config/files/persistent-journal.conf
> +++ b/recipes-core/journald-config/files/persistent-journal.conf
> @@ -1,2 +1,5 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [Journal]
> Storage=persistent
> diff --git a/recipes-core/kernel-panic/files/sysrq-panic.service b/recipes-core/kernel-panic/files/sysrq-panic.service
> index 4f199fe..e892165 100644
> --- a/recipes-core/kernel-panic/files/sysrq-panic.service
> +++ b/recipes-core/kernel-panic/files/sysrq-panic.service
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [Unit]
> Description=sysrq panic
>
> diff --git a/recipes-core/ltp/files/debian/control.tmpl b/recipes-core/ltp/files/debian/control.tmpl
> index 0bfc0c2..a7d0087 100644
> --- a/recipes-core/ltp/files/debian/control.tmpl
> +++ b/recipes-core/ltp/files/debian/control.tmpl
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> Source: ltp-full
> Section: embedded
> Priority: optional
> diff --git a/recipes-core/ltp/files/debian/rules b/recipes-core/ltp/files/debian/rules
> index 4e1747c..32d3c29 100755
> --- a/recipes-core/ltp/files/debian/rules
> +++ b/recipes-core/ltp/files/debian/rules
> @@ -1,4 +1,7 @@
> #!/usr/bin/make -f
> +#
> +# SPDX-License-Identifier: MIT
> +#
> export DEB_CFLAGS_MAINT_APPEND = -Wall -Wno-format-security
> export DEB_BUILD_MAINT_OPTIONS=hardening=-branch
>
> diff --git a/recipes-core/move-homedir-var/files/move-homedir-var.tmpfiles.tmpl b/recipes-core/move-homedir-var/files/move-homedir-var.tmpfiles.tmpl
> index 92e4a30..1821f92 100644
> --- a/recipes-core/move-homedir-var/files/move-homedir-var.tmpfiles.tmpl
> +++ b/recipes-core/move-homedir-var/files/move-homedir-var.tmpfiles.tmpl
> @@ -1,2 +1,5 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> L /home - - - - /var/home
> C /var/home - - - - ${IMMUTABLE_DATA_DIR}/home
> diff --git a/recipes-core/security-customizations/files/postinst b/recipes-core/security-customizations/files/postinst
> index f8ebf9e..788e225 100755
> --- a/recipes-core/security-customizations/files/postinst
> +++ b/recipes-core/security-customizations/files/postinst
> @@ -3,6 +3,8 @@
> # CIP Security, generic profile
> # Security Package configurations
> #
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/recipes-core/security-customizations/files/ssh-pam-remote.conf b/recipes-core/security-customizations/files/ssh-pam-remote.conf
> index d460b0c..ea120b2 100644
> --- a/recipes-core/security-customizations/files/ssh-pam-remote.conf
> +++ b/recipes-core/security-customizations/files/ssh-pam-remote.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # Enable PAM configuration for Remote Session
> ChallengeResponseAuthentication yes
> KbdInteractiveAuthentication yes
> diff --git a/recipes-core/security-customizations/files/ssh-remote-session-term.conf b/recipes-core/security-customizations/files/ssh-remote-session-term.conf
> index d11b92e..171ea9b 100644
> --- a/recipes-core/security-customizations/files/ssh-remote-session-term.conf
> +++ b/recipes-core/security-customizations/files/ssh-remote-session-term.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # CR2.6: Remote session termination
> # Terminate remote session after inactive time period
>
> diff --git a/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl b/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
> index 744b426..f750f3d 100644
> --- a/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
> +++ b/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> SWUPDATE_SURICATTA_ARGS="--server lua -u ${WFX_URL} -i $(cat /etc/machine-id)"
> diff --git a/recipes-core/swupdate-config/files/hwrevision.tmpl b/recipes-core/swupdate-config/files/hwrevision.tmpl
> index 1eb0996..b937200 100644
> --- a/recipes-core/swupdate-config/files/hwrevision.tmpl
> +++ b/recipes-core/swupdate-config/files/hwrevision.tmpl
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> cip-${MACHINE} ${MACHINE_HW_VERSION}
> diff --git a/recipes-core/swupdate-config/files/swupdate.cfg b/recipes-core/swupdate-config/files/swupdate.cfg
> index 3e2b45c..5c05fbe 100644
> --- a/recipes-core/swupdate-config/files/swupdate.cfg
> +++ b/recipes-core/swupdate-config/files/swupdate.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> globals :
> {
> bootloader = "ebg";
> diff --git a/recipes-core/swupdate-handler-roundrobin/files/swupdate.handler.efibootguard.ini b/recipes-core/swupdate-handler-roundrobin/files/swupdate.handler.efibootguard.ini
> index 58271da..8f93cc9 100644
> --- a/recipes-core/swupdate-handler-roundrobin/files/swupdate.handler.efibootguard.ini
> +++ b/recipes-core/swupdate-handler-roundrobin/files/swupdate.handler.efibootguard.ini
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [image]
> chainhandler=raw
>
> diff --git a/recipes-core/tmp-fs/files/postinst b/recipes-core/tmp-fs/files/postinst
> index 39067f1..ae0f74a 100755
> --- a/recipes-core/tmp-fs/files/postinst
> +++ b/recipes-core/tmp-fs/files/postinst
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/recipes-devtools/swupdate-signer/files/sign-swu-cms b/recipes-devtools/swupdate-signer/files/sign-swu-cms
> index cb0cd4a..bc1ec13 100644
> --- a/recipes-devtools/swupdate-signer/files/sign-swu-cms
> +++ b/recipes-devtools/swupdate-signer/files/sign-swu-cms
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
> in_file=$1
> out_file=$2
> inkey="/usr/share/swupdate-signing/swupdate-sign.key"
> diff --git a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.env.tmpl b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.env.tmpl
> index bb93361..452714d 100644
> --- a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.env.tmpl
> +++ b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.env.tmpl
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> PARTITIONS="${CRYPT_PARTITIONS}"
> CREATE_FILE_SYSTEM_CMD="${CRYPT_CREATE_FILE_SYSTEM_CMD}"
> SETUP_TIMEOUT="${CRYPT_SETUP_TIMEOUT}"
> diff --git a/recipes-initramfs/initramfs-crypt-hook/files/pwquality.conf b/recipes-initramfs/initramfs-crypt-hook/files/pwquality.conf
> index d4c8981..8e087f2 100644
> --- a/recipes-initramfs/initramfs-crypt-hook/files/pwquality.conf
> +++ b/recipes-initramfs/initramfs-crypt-hook/files/pwquality.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # we don't have a dictionary in the initramfs
> # this solves the error "Password generation failed - required entropy too low for settings"
> dictcheck = 0
> diff --git a/recipes-initramfs/initramfs-factory-reset-hook/files/factory-reset-script.tmpl b/recipes-initramfs/initramfs-factory-reset-hook/files/factory-reset-script.tmpl
> index f0ad40c..94b5f8b 100644
> --- a/recipes-initramfs/initramfs-factory-reset-hook/files/factory-reset-script.tmpl
> +++ b/recipes-initramfs/initramfs-factory-reset-hook/files/factory-reset-script.tmpl
> @@ -7,6 +7,8 @@
> # Authors:
> # Quirin Gylstorff <quirin.gylstorff@siemens.com>
> #
> +# SPDX-License-Identifier: MIT
> +#
> . /usr/share/factory-reset/reset-env
>
> . /scripts/cip-initramfs-functions
> diff --git a/recipes-initramfs/initramfs-factory-reset-hook/files/reset-env.tmpl b/recipes-initramfs/initramfs-factory-reset-hook/files/reset-env.tmpl
> index d3e18a2..07e2376 100644
> --- a/recipes-initramfs/initramfs-factory-reset-hook/files/reset-env.tmpl
> +++ b/recipes-initramfs/initramfs-factory-reset-hook/files/reset-env.tmpl
> @@ -1,3 +1,6 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
> INITRAMFS_FACTORY_RESET_DEVICES="${INITRAMFS_FACTORY_RESET_DEVICES}"
> INITRAMFS_FACTORY_RESET_LUKS_FORMAT_TYPE="${INITRAMFS_FACTORY_RESET_LUKS_FORMAT_TYPE}"
> diff --git a/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl b/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl
> index bce588c..8a697f8 100644
> --- a/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl
> +++ b/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl
> @@ -7,6 +7,8 @@
> # Jan Kiszka <jan.kiszka@siemens.com>
> # Quirin Gylstorff <quirin.gylstorff@siemens.com>
> #
> +# SPDX-License-Identifier: MIT
> +#
>
> ovl_storage_path="${INITRAMFS_OVERLAY_STORAGE_PATH}"
> ovl_lower_dirs="${INITRAMFS_OVERLAY_PATHS}"
> diff --git a/recipes-initramfs/initramfs-overlay-hook/files/overlay_recovery_action.script b/recipes-initramfs/initramfs-overlay-hook/files/overlay_recovery_action.script
> index 0cd084b..11ca731 100644
> --- a/recipes-initramfs/initramfs-overlay-hook/files/overlay_recovery_action.script
> +++ b/recipes-initramfs/initramfs-overlay-hook/files/overlay_recovery_action.script
> @@ -7,6 +7,8 @@
> # Authors:
> # Clara Kowalsky <clara.kowalsky@siemens.com>
> #
> +# SPDX-License-Identifier: MIT
> +#
>
> partition_fstype="$1"
> ovl_partition_device="$2"
> diff --git a/recipes-kernel/linux/files/no-module-signing.cfg b/recipes-kernel/linux/files/no-module-signing.cfg
> index ab54f68..064ef9c 100644
> --- a/recipes-kernel/linux/files/no-module-signing.cfg
> +++ b/recipes-kernel/linux/files/no-module-signing.cfg
> @@ -1,2 +1,5 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # CONFIG_SECURITY_LOCKDOWN_LSM is not set
> # CONFIG_MODULE_SIG is not set
> diff --git a/recipes-kernel/linux/files/no-tpm-hwrng.cfg b/recipes-kernel/linux/files/no-tpm-hwrng.cfg
> index ab46cd8..08e98ff 100644
> --- a/recipes-kernel/linux/files/no-tpm-hwrng.cfg
> +++ b/recipes-kernel/linux/files/no-tpm-hwrng.cfg
> @@ -1,2 +1,5 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # see https://lore.kernel.org/lkml/bbc41534-a2d9-42dc-ac8a-ff8a0b4fd41f@siemens.com/
> # CONFIG_HW_RANDOM_TPM is not set
> diff --git a/recipes-kernel/linux/files/preempt-rt.cfg b/recipes-kernel/linux/files/preempt-rt.cfg
> index afbf53d..f558365 100644
> --- a/recipes-kernel/linux/files/preempt-rt.cfg
> +++ b/recipes-kernel/linux/files/preempt-rt.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # >= 5.10
> CONFIG_EXPERT=y
> CONFIG_PREEMPT_RT=y
> diff --git a/recipes-security/fail2ban-config/files/systemd-defaults.conf b/recipes-security/fail2ban-config/files/systemd-defaults.conf
> index 16e0d5e..32a8e48 100644
> --- a/recipes-security/fail2ban-config/files/systemd-defaults.conf
> +++ b/recipes-security/fail2ban-config/files/systemd-defaults.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [DEFAULT]
>
> syslog_backend = systemd
> diff --git a/scripts/deploy-cip-core.sh b/scripts/deploy-cip-core.sh
> index 623c216..1e08e47 100755
> --- a/scripts/deploy-cip-core.sh
> +++ b/scripts/deploy-cip-core.sh
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/scripts/generate-sb-db-from-existing-certificate.sh b/scripts/generate-sb-db-from-existing-certificate.sh
> index dddd9b5..42d09dd 100755
> --- a/scripts/generate-sb-db-from-existing-certificate.sh
> +++ b/scripts/generate-sb-db-from-existing-certificate.sh
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/scripts/generate_secure_boot_keys.sh b/scripts/generate_secure_boot_keys.sh
> index 8be0569..28ae34c 100755
> --- a/scripts/generate_secure_boot_keys.sh
> +++ b/scripts/generate_secure_boot_keys.sh
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/scripts/start-efishell.sh b/scripts/start-efishell.sh
> index fff8a6a..86e2ddd 100755
> --- a/scripts/start-efishell.sh
> +++ b/scripts/start-efishell.sh
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/scripts/submit_lava.sh b/scripts/submit_lava.sh
> index b3180a1..a4d20ec 100755
> --- a/scripts/submit_lava.sh
> +++ b/scripts/submit_lava.sh
> @@ -1,4 +1,7 @@
> #!/bin/bash
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # Copyright (C) 2024, Renesas Electronics Europe GmbH
> # Chris Paterson <chris.paterson2@renesas.com>
> # Sai Ashrith <sai.sathujoda@toshiba-tsip.com>
> diff --git a/scripts/update-linux-cip.sh b/scripts/update-linux-cip.sh
> index 5fbfa57..df306b2 100755
> --- a/scripts/update-linux-cip.sh
> +++ b/scripts/update-linux-cip.sh
> @@ -1,4 +1,7 @@
> #!/bin/bash
> +#
> +# SPDX-License-Identifier: MIT
> +#
> REPO_ROOT=$(git rev-parse --show-toplevel)
> pushd "${REPO_ROOT}"/recipes-kernel/linux >/dev/null || exit 1
>
> diff --git a/scripts/update-ltp.sh b/scripts/update-ltp.sh
> index dc8b947..321cc3c 100755
> --- a/scripts/update-ltp.sh
> +++ b/scripts/update-ltp.sh
> @@ -1,4 +1,7 @@
> #!/bin/bash
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> REPO_ROOT=$(git rev-parse --show-toplevel)
> pushd "${REPO_ROOT}"/recipes-core/ltp > /dev/null || exit
> diff --git a/tests/templates/IEC_template.yml b/tests/templates/IEC_template.yml
> index f8558cd..148f07e 100644
> --- a/tests/templates/IEC_template.yml
> +++ b/tests/templates/IEC_template.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> device_type: qemu
> job_name: #architecture# IEC layer testing
> timeouts:
> diff --git a/tests/templates/secureboot_corrupt_rootfs_steps.yml b/tests/templates/secureboot_corrupt_rootfs_steps.yml
> index b6f6628..5c47b30 100644
> --- a/tests/templates/secureboot_corrupt_rootfs_steps.yml
> +++ b/tests/templates/secureboot_corrupt_rootfs_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - "apt-get update"
> - "apt install -y fdisk"
> - "rootfs_start_sector=$(fdisk -l -o Name,Start cip-core-image-security-cip-core-#distribution#-#architecture#.wic | awk -v name=systema '$0 ~ name {print $2}')"
> diff --git a/tests/templates/secureboot_negative_test.yml b/tests/templates/secureboot_negative_test.yml
> index 2fcdbfa..a8e4226 100644
> --- a/tests/templates/secureboot_negative_test.yml
> +++ b/tests/templates/secureboot_negative_test.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> device_type: qemu
> job_name: #architecture# secure boot testing
> timeouts:
> diff --git a/tests/templates/secureboot_template.yml b/tests/templates/secureboot_template.yml
> index e29b64a..0a075e2 100644
> --- a/tests/templates/secureboot_template.yml
> +++ b/tests/templates/secureboot_template.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> device_type: qemu
> job_name: #architecture# secure boot testing
> timeouts:
> diff --git a/tests/templates/secureboot_unsigned_bootloader_steps.yml b/tests/templates/secureboot_unsigned_bootloader_steps.yml
> index 8d64b05..f4f4043 100644
> --- a/tests/templates/secureboot_unsigned_bootloader_steps.yml
> +++ b/tests/templates/secureboot_unsigned_bootloader_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - "apt-get update"
> - "apt install --yes guestfish sbsigntool"
> - "guestfish add cip-core-image-security-cip-core-#distribution#-#architecture#.wic : run : mount /dev/sda1 / : copy-out /EFI/BOOT/bootx64.efi ."
> diff --git a/tests/templates/secureboot_unsigned_kernel_steps.yml b/tests/templates/secureboot_unsigned_kernel_steps.yml
> index f097ed6..6ab334a 100644
> --- a/tests/templates/secureboot_unsigned_kernel_steps.yml
> +++ b/tests/templates/secureboot_unsigned_kernel_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - "apt-get update"
> - "apt install --yes guestfish sbsigntool"
> - "guestfish add cip-core-image-security-cip-core-#distribution#-#architecture#.wic : run : mount /dev/sda2 / : copy-out /linux.efi ."
> diff --git a/tests/templates/swupdate-test-action-M-COM.yml b/tests/templates/swupdate-test-action-M-COM.yml
> index 56ff106..69c9cb7 100644
> --- a/tests/templates/swupdate-test-action-M-COM.yml
> +++ b/tests/templates/swupdate-test-action-M-COM.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # TEST BLOCK 1
> # Fail the job if software update application failed
> - test:
> diff --git a/tests/templates/swupdate_corrupt_swu_artifact_steps.yml b/tests/templates/swupdate_corrupt_swu_artifact_steps.yml
> index 2fad3fd..043867e 100644
> --- a/tests/templates/swupdate_corrupt_swu_artifact_steps.yml
> +++ b/tests/templates/swupdate_corrupt_swu_artifact_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - curl -v --trace-time http://$LAVA_DISPATCHER_IP/tmp/$LAVA_JOB_ID/downloads/common/cip-core-image-security-cip-core-#distribution#-#architecture#.swu --output /root/cip-core-image-security-cip-core-#distribution#-#architecture#.swu
> - mkdir -p swu
> - cpio -ivd --directory=/root/swu < /root/cip-core-image-security-cip-core-#distribution#-#architecture#.swu
> diff --git a/tests/templates/swupdate_corrupt_swu_steps.yml b/tests/templates/swupdate_corrupt_swu_steps.yml
> index 74c9217..3cdb793 100644
> --- a/tests/templates/swupdate_corrupt_swu_steps.yml
> +++ b/tests/templates/swupdate_corrupt_swu_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - curl -v --trace-time http://$LAVA_DISPATCHER_IP/tmp/$LAVA_JOB_ID/downloads/common/cip-core-image-security-cip-core-#distribution#-#architecture#.swu --output /root/cip-core-image-security-cip-core-#distribution#-#architecture#.swu
> - mkdir -p swu
> - dd if=/dev/zero of=/root/cip-core-image-security-cip-core-#distribution#-#architecture#.swu bs=1M count=5
> diff --git a/tests/templates/swupdate_negative_test.yml b/tests/templates/swupdate_negative_test.yml
> index bb79b07..250eaa8 100644
> --- a/tests/templates/swupdate_negative_test.yml
> +++ b/tests/templates/swupdate_negative_test.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> device_type: qemu
> job_name: #architecture# software update testing
> timeouts:
> diff --git a/tests/templates/swupdate_reboot_without_confirm.yml b/tests/templates/swupdate_reboot_without_confirm.yml
> index bfad106..074eb1a 100644
> --- a/tests/templates/swupdate_reboot_without_confirm.yml
> +++ b/tests/templates/swupdate_reboot_without_confirm.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # qemu-swtpm.sock will be gone after soft reboot.
> # So the swtpm socket need to be started again for proper reboot
> # To start the swtpm daemon, first the existing one should be killed
> diff --git a/tests/templates/swupdate_same_uuid_steps.yml b/tests/templates/swupdate_same_uuid_steps.yml
> index 3ff2e02..8329055 100644
> --- a/tests/templates/swupdate_same_uuid_steps.yml
> +++ b/tests/templates/swupdate_same_uuid_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - curl -v --trace-time http://$LAVA_DISPATCHER_IP/tmp/$LAVA_JOB_ID/downloads/common/cip-core-image-security-cip-core-#distribution#-#architecture#.swu --output /root/cip-core-image-security-cip-core-#distribution#-#architecture#.swu
> - mkdir -p swu
> - cpio -ivd --directory=/root/swu < /root/cip-core-image-security-cip-core-#distribution#-#architecture#.swu
> diff --git a/tests/templates/swupdate_template.yml b/tests/templates/swupdate_template.yml
> index e1f71a9..9a3366b 100644
> --- a/tests/templates/swupdate_template.yml
> +++ b/tests/templates/swupdate_template.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> device_type: qemu
> job_name: #architecture# software update testing
> timeouts:
> diff --git a/wic/ebg-signed-sysparts.inc b/wic/ebg-signed-sysparts.inc
> index c35878f..8210598 100644
> --- a/wic/ebg-signed-sysparts.inc
> +++ b/wic/ebg-signed-sysparts.inc
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # default partition layout EFI Boot Guard usage, signed version
>
> # EFI partition containing efibootguard bootloader binary
> diff --git a/wic/ebg-sysparts.inc b/wic/ebg-sysparts.inc
> index 0290024..b7f1afa 100644
> --- a/wic/ebg-sysparts.inc
> +++ b/wic/ebg-sysparts.inc
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # default partition layout EFI Boot Guard usage
>
> # EFI partition containing efibootguard bootloader binary
> diff --git a/wic/hihope-rzg2m-efibootguard.wks.in b/wic/hihope-rzg2m-efibootguard.wks.in
> index fdbad14..99c8d10 100644
> --- a/wic/hihope-rzg2m-efibootguard.wks.in
> +++ b/wic/hihope-rzg2m-efibootguard.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # short-description: RZ/G2M image with EFI Boot Guard and SWUpdate
> # long-description: Disk image for HiHope RZ/G2M board with EFI Boot Guard and SWUpdate
>
> diff --git a/wic/qemu-arm64-efibootguard-secureboot.wks.in b/wic/qemu-arm64-efibootguard-secureboot.wks.in
> index 941a552..88eb91c 100644
> --- a/wic/qemu-arm64-efibootguard-secureboot.wks.in
> +++ b/wic/qemu-arm64-efibootguard-secureboot.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> include ebg-signed-sysparts.inc
>
> part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.verity" --align 1024 --fixed-size 1G --uuid "${ABROOTFS_PART_UUID_A}" --part-type 0FC63DAF-8483-4772-8E79-3D69D8477DE4 --part-name systema
> diff --git a/wic/qemu-arm64-efibootguard.wks.in b/wic/qemu-arm64-efibootguard.wks.in
> index 21c0b24..117c47c 100644
> --- a/wic/qemu-arm64-efibootguard.wks.in
> +++ b/wic/qemu-arm64-efibootguard.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # short-description: arm64 with EFI Boot Guard and SWUpdate
> # long-description: Disk image for arm64 machines with EFI Boot Guard and SWUpdate
>
> diff --git a/wic/qemu-riscv64-efibootguard.wks.in b/wic/qemu-riscv64-efibootguard.wks.in
> index 948c67d..a5dd09b 100644
> --- a/wic/qemu-riscv64-efibootguard.wks.in
> +++ b/wic/qemu-riscv64-efibootguard.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # short-description: riscv64 with EFI Boot Guard and SWUpdate
> # long-description: Disk image for riscv64 machines with EFI Boot Guard and SWUpdate
>
> diff --git a/wic/x86-uefi-efibootguard-secureboot.wks.in b/wic/x86-uefi-efibootguard-secureboot.wks.in
> index 2af3e58..f15f9e0 100644
> --- a/wic/x86-uefi-efibootguard-secureboot.wks.in
> +++ b/wic/x86-uefi-efibootguard-secureboot.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> include ebg-signed-sysparts.inc
>
> part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.verity" --align 1024 --fixed-size 1G --uuid "${ABROOTFS_PART_UUID_A}" --part-type 0FC63DAF-8483-4772-8E79-3D69D8477DE4 --part-name systema
> diff --git a/wic/x86-uefi-efibootguard.wks.in b/wic/x86-uefi-efibootguard.wks.in
> index 3640ecf..982a87a 100644
> --- a/wic/x86-uefi-efibootguard.wks.in
> +++ b/wic/x86-uefi-efibootguard.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # short-description: x86 with EFI Boot Guard and SWUpdate
> # long-description: Disk image for x86 machines with EFI Boot Guard and SWUpdate
>
>
> ---
> base-commit: e3158569eee297f1837a6d3fd7e0f1a0534c2b8b
> change-id: 20260316-license-c5fcde3618d2
>
> Best regards,

Thanks, applied. Will follow up with fixing two more spots so that we
are only left with files that cannot receive headers.