RE: [PATCH isar-cip-core v2] *: Add SPDX-License-Identifier MIT header

dinesh.kumar
2026-03-25T05:46:50Z

Thanks Jan.

Kamlesh,

Now all patches got merged, could you please proceed to complete best practices badge submission and clarify with David procedure for getting CIP project listed in the OpenSSF best practices portal?

Thanks & Regards,
Dinesh Kumar

-----Original Message-----
From: Jan Kiszka <jan.kiszka@siemens.com>
Sent: Tuesday, March 24, 2026 8:10 PM
To: Kamlesh Gurudasani <kamlesh@ti.com>; dinesh kumar(ＴＳＩＰ DITC_DIT-OST) <dinesh.kumar@toshiba-tsip.com>; cip-dev@lists.cip-project.org; pavel@denx.de
Subject: Re: [PATCH isar-cip-core v2] *: Add SPDX-License-Identifier MIT header

On 24.03.26 09:40, Kamlesh Gurudasani wrote:
> Add missing license headers to configuration, template, script, and
> wic partition layout files to make licensing consistent across the
> repository.
>
> Command Used:
> git ls-files | xargs grep -rL SPDX-License-Identifier
>
> Signed-off-by: Kamlesh Gurudasani <kamlesh@ti.com>
> ---
> Changes in v2:
> - added license to remaining files
> - Link to v1:
> https://lore.kernel.org/r/20260316-license-v1-1-5bb039f50c05@ti.com
> ---
> conf/distro/debian-bullseye-backports.list | 3 +++
> conf/distro/debian-buster-backports.list | 3 +++
> conf/distro/preferences.ovmf-snakeoil.conf | 3 +++
> conf/distro/preferences.swupdate-bullseye-backports.conf | 3 +++
> recipes-bsp/u-boot/files/ftpm-stmm.cfg | 3 +++
> recipes-bsp/u-boot/files/no-grub-workaround.cfg | 3 +++
> recipes-bsp/u-boot/files/qemu-extra.cfg | 3 +++
> recipes-bsp/u-boot/files/secure-boot.cfg | 3 +++
> recipes-bsp/u-boot/files/ti-extra.cfg | 3 +++
> recipes-core/customizations/files/99-silent-printk.conf | 3 +++
> recipes-core/customizations/files/99-watchdog.conf | 3 +++
> recipes-core/customizations/files/ssh-permit-root.conf | 3 +++
> recipes-core/home-fs/files/home.mount | 3 +++
> recipes-core/home-fs/files/postinst | 3 +++
> recipes-core/immutable-rootfs/files/95-disable-package-updates.preset | 3 +++
> recipes-core/immutable-rootfs/files/immutable-rootfs.tmpfiles.tmpl | 3 +++
> recipes-core/immutable-rootfs/files/postinst | 3 +++
> recipes-core/journald-config/files/persistent-journal.conf | 3 +++
> recipes-core/kernel-panic/files/sysrq-panic.service | 3 +++
> recipes-core/ltp/files/debian/control.tmpl | 3 +++
> recipes-core/ltp/files/debian/rules | 3 +++
> recipes-core/move-homedir-var/files/move-homedir-var.tmpfiles.tmpl | 3 +++
> recipes-core/security-customizations/files/postinst | 2 ++
> recipes-core/security-customizations/files/ssh-pam-remote.conf | 3 +++
> recipes-core/security-customizations/files/ssh-remote-session-term.conf | 3 +++
> recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl | 3 +++
> recipes-core/swupdate-config/files/hwrevision.tmpl | 3 +++
> recipes-core/swupdate-config/files/swupdate.cfg | 3 +++
> recipes-core/swupdate-handler-roundrobin/files/swupdate.handler.efibootguard.ini | 3 +++
> recipes-core/tmp-fs/files/postinst | 3 +++
> recipes-devtools/swupdate-signer/files/sign-swu-cms | 3 +++
> recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.env.tmpl | 3 +++
> recipes-initramfs/initramfs-crypt-hook/files/pwquality.conf | 3 +++
> recipes-initramfs/initramfs-factory-reset-hook/files/factory-reset-script.tmpl | 2 ++
> recipes-initramfs/initramfs-factory-reset-hook/files/reset-env.tmpl | 3 +++
> recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl | 2 ++
> recipes-initramfs/initramfs-overlay-hook/files/overlay_recovery_action.script | 2 ++
> recipes-kernel/linux/files/no-module-signing.cfg | 3 +++
> recipes-kernel/linux/files/no-tpm-hwrng.cfg | 3 +++
> recipes-kernel/linux/files/preempt-rt.cfg | 3 +++
> recipes-security/fail2ban-config/files/systemd-defaults.conf | 3 +++
> scripts/deploy-cip-core.sh | 3 +++
> scripts/generate-sb-db-from-existing-certificate.sh | 3 +++
> scripts/generate_secure_boot_keys.sh | 3 +++
> scripts/start-efishell.sh | 3 +++
> scripts/submit_lava.sh | 3 +++
> scripts/update-linux-cip.sh | 3 +++
> scripts/update-ltp.sh | 3 +++
> tests/templates/IEC_template.yml | 3 +++
> tests/templates/secureboot_corrupt_rootfs_steps.yml | 3 +++
> tests/templates/secureboot_negative_test.yml | 3 +++
> tests/templates/secureboot_template.yml | 3 +++
> tests/templates/secureboot_unsigned_bootloader_steps.yml | 3 +++
> tests/templates/secureboot_unsigned_kernel_steps.yml | 3 +++
> tests/templates/swupdate-test-action-M-COM.yml | 3 +++
> tests/templates/swupdate_corrupt_swu_artifact_steps.yml | 3 +++
> tests/templates/swupdate_corrupt_swu_steps.yml | 3 +++
> tests/templates/swupdate_negative_test.yml | 3 +++
> tests/templates/swupdate_reboot_without_confirm.yml | 3 +++
> tests/templates/swupdate_same_uuid_steps.yml | 3 +++
> tests/templates/swupdate_template.yml | 3 +++
> wic/ebg-signed-sysparts.inc | 3 +++
> wic/ebg-sysparts.inc | 3 +++
> wic/hihope-rzg2m-efibootguard.wks.in | 3 +++
> wic/qemu-arm64-efibootguard-secureboot.wks.in | 3 +++
> wic/qemu-arm64-efibootguard.wks.in | 3 +++
> wic/qemu-riscv64-efibootguard.wks.in | 3 +++
> wic/x86-uefi-efibootguard-secureboot.wks.in | 3 +++
> wic/x86-uefi-efibootguard.wks.in | 3 +++
> 69 files changed, 203 insertions(+)
>
> diff --git a/conf/distro/debian-bullseye-backports.list
> b/conf/distro/debian-bullseye-backports.list
> index 1594907..6107928 100644
> --- a/conf/distro/debian-bullseye-backports.list
> +++ b/conf/distro/debian-bullseye-backports.list
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> deb http://archive.debian.org/debian bullseye-backports main contrib
> non-free diff --git a/conf/distro/debian-buster-backports.list
> b/conf/distro/debian-buster-backports.list
> index 7134a35..842019e 100644
> --- a/conf/distro/debian-buster-backports.list
> +++ b/conf/distro/debian-buster-backports.list
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> deb http://archive.debian.org/debian buster-backports main contrib
> non-free diff --git a/conf/distro/preferences.ovmf-snakeoil.conf
> b/conf/distro/preferences.ovmf-snakeoil.conf
> index b51d1d4..25b7da4 100644
> --- a/conf/distro/preferences.ovmf-snakeoil.conf
> +++ b/conf/distro/preferences.ovmf-snakeoil.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> Package: ovmf
> Pin: release n=buster-backports
> Pin-Priority: 801
> diff --git a/conf/distro/preferences.swupdate-bullseye-backports.conf
> b/conf/distro/preferences.swupdate-bullseye-backports.conf
> index c5f6685..da307cd 100644
> --- a/conf/distro/preferences.swupdate-bullseye-backports.conf
> +++ b/conf/distro/preferences.swupdate-bullseye-backports.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> Package: dh-nodejs
> Pin: release n=bullseye-backports
> Pin-Priority: 801
> diff --git a/recipes-bsp/u-boot/files/ftpm-stmm.cfg
> b/recipes-bsp/u-boot/files/ftpm-stmm.cfg
> index af5da93..a6fe2a3 100644
> --- a/recipes-bsp/u-boot/files/ftpm-stmm.cfg
> +++ b/recipes-bsp/u-boot/files/ftpm-stmm.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> ### Enable OPTEE, fTPM and StMM
> CONFIG_TEE=y
> CONFIG_OPTEE=y
> diff --git a/recipes-bsp/u-boot/files/no-grub-workaround.cfg
> b/recipes-bsp/u-boot/files/no-grub-workaround.cfg
> index dc09edd..8a01ff6 100644
> --- a/recipes-bsp/u-boot/files/no-grub-workaround.cfg
> +++ b/recipes-bsp/u-boot/files/no-grub-workaround.cfg
> @@ -1,2 +1,5 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> ### Disable grub workaround
> # CONFIG_EFI_GRUB_ARM32_WORKAROUND is not set diff --git
> a/recipes-bsp/u-boot/files/qemu-extra.cfg
> b/recipes-bsp/u-boot/files/qemu-extra.cfg
> index e643db7..5380ad8 100644
> --- a/recipes-bsp/u-boot/files/qemu-extra.cfg
> +++ b/recipes-bsp/u-boot/files/qemu-extra.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> ### QEMU extra config
> CONFIG_MMC=y
> CONFIG_SUPPORT_EMMC_RPMB=y
> diff --git a/recipes-bsp/u-boot/files/secure-boot.cfg
> b/recipes-bsp/u-boot/files/secure-boot.cfg
> index 694356f..7b09a53 100644
> --- a/recipes-bsp/u-boot/files/secure-boot.cfg
> +++ b/recipes-bsp/u-boot/files/secure-boot.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> ### Secure boot config
> # CONFIG_BOOTSTD_DEFAULTS is not set
> # CONFIG_BOOTMETH_CROS is not set
> diff --git a/recipes-bsp/u-boot/files/ti-extra.cfg
> b/recipes-bsp/u-boot/files/ti-extra.cfg
> index c10d046..9500055 100644
> --- a/recipes-bsp/u-boot/files/ti-extra.cfg
> +++ b/recipes-bsp/u-boot/files/ti-extra.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> ### FTPM + RPMB + StandaloneMM setup
> CONFIG_OPTEE_SERVICE_DISCOVERY=y
> CONFIG_TPM=y
> diff --git a/recipes-core/customizations/files/99-silent-printk.conf
> b/recipes-core/customizations/files/99-silent-printk.conf
> index ad24d3a..c5b3799 100644
> --- a/recipes-core/customizations/files/99-silent-printk.conf
> +++ b/recipes-core/customizations/files/99-silent-printk.conf
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> kernel.printk = 3 4 1 3
> diff --git a/recipes-core/customizations/files/99-watchdog.conf
> b/recipes-core/customizations/files/99-watchdog.conf
> index c02756d..1f38c55 100644
> --- a/recipes-core/customizations/files/99-watchdog.conf
> +++ b/recipes-core/customizations/files/99-watchdog.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [Manager]
> RuntimeWatchdogSec=60s
> ShutdownWatchdogSec=60s
> diff --git a/recipes-core/customizations/files/ssh-permit-root.conf
> b/recipes-core/customizations/files/ssh-permit-root.conf
> index 1073982..ab26ab5 100644
> --- a/recipes-core/customizations/files/ssh-permit-root.conf
> +++ b/recipes-core/customizations/files/ssh-permit-root.conf
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> PermitRootLogin yes
> diff --git a/recipes-core/home-fs/files/home.mount
> b/recipes-core/home-fs/files/home.mount
> index 062517a..653495c 100644
> --- a/recipes-core/home-fs/files/home.mount
> +++ b/recipes-core/home-fs/files/home.mount
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [Unit]
> Description=Mount /home partition
> Before=local-fs.target
> diff --git a/recipes-core/home-fs/files/postinst
> b/recipes-core/home-fs/files/postinst
> index ab0db84..904aa73 100755
> --- a/recipes-core/home-fs/files/postinst
> +++ b/recipes-core/home-fs/files/postinst
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git
> a/recipes-core/immutable-rootfs/files/95-disable-package-updates.prese
> t
> b/recipes-core/immutable-rootfs/files/95-disable-package-updates.prese
> t
> index 7e6e9ef..b3b52ce 100644
> ---
> a/recipes-core/immutable-rootfs/files/95-disable-package-updates.prese
> t
> +++ b/recipes-core/immutable-rootfs/files/95-disable-package-updates.p
> +++ reset
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> disable apt-daily.timer
> disable apt-daily-upgrade.timer
> disable dpkg-db-backup.timer
> diff --git
> a/recipes-core/immutable-rootfs/files/immutable-rootfs.tmpfiles.tmpl
> b/recipes-core/immutable-rootfs/files/immutable-rootfs.tmpfiles.tmpl
> index e6d25d2..4cdfc6f 100644
> ---
> a/recipes-core/immutable-rootfs/files/immutable-rootfs.tmpfiles.tmpl
> +++ b/recipes-core/immutable-rootfs/files/immutable-rootfs.tmpfiles.tm
> +++ pl
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> L /var/lib/dpkg - - - - ${IMMUTABLE_DATA_DIR}/var/lib/dpkg
> d /var/log/audit 0700 root adm -
> d /var/lib/apt 0755 root root -
> diff --git a/recipes-core/immutable-rootfs/files/postinst
> b/recipes-core/immutable-rootfs/files/postinst
> index a6e1962..3b8071e 100644
> --- a/recipes-core/immutable-rootfs/files/postinst
> +++ b/recipes-core/immutable-rootfs/files/postinst
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git
> a/recipes-core/journald-config/files/persistent-journal.conf
> b/recipes-core/journald-config/files/persistent-journal.conf
> index 21dfde0..3e3419f 100644
> --- a/recipes-core/journald-config/files/persistent-journal.conf
> +++ b/recipes-core/journald-config/files/persistent-journal.conf
> @@ -1,2 +1,5 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [Journal]
> Storage=persistent
> diff --git a/recipes-core/kernel-panic/files/sysrq-panic.service
> b/recipes-core/kernel-panic/files/sysrq-panic.service
> index 4f199fe..e892165 100644
> --- a/recipes-core/kernel-panic/files/sysrq-panic.service
> +++ b/recipes-core/kernel-panic/files/sysrq-panic.service
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [Unit]
> Description=sysrq panic
>
> diff --git a/recipes-core/ltp/files/debian/control.tmpl
> b/recipes-core/ltp/files/debian/control.tmpl
> index 0bfc0c2..a7d0087 100644
> --- a/recipes-core/ltp/files/debian/control.tmpl
> +++ b/recipes-core/ltp/files/debian/control.tmpl
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> Source: ltp-full
> Section: embedded
> Priority: optional
> diff --git a/recipes-core/ltp/files/debian/rules
> b/recipes-core/ltp/files/debian/rules
> index 4e1747c..32d3c29 100755
> --- a/recipes-core/ltp/files/debian/rules
> +++ b/recipes-core/ltp/files/debian/rules
> @@ -1,4 +1,7 @@
> #!/usr/bin/make -f
> +#
> +# SPDX-License-Identifier: MIT
> +#
> export DEB_CFLAGS_MAINT_APPEND = -Wall -Wno-format-security export
> DEB_BUILD_MAINT_OPTIONS=hardening=-branch
>
> diff --git
> a/recipes-core/move-homedir-var/files/move-homedir-var.tmpfiles.tmpl
> b/recipes-core/move-homedir-var/files/move-homedir-var.tmpfiles.tmpl
> index 92e4a30..1821f92 100644
> ---
> a/recipes-core/move-homedir-var/files/move-homedir-var.tmpfiles.tmpl
> +++ b/recipes-core/move-homedir-var/files/move-homedir-var.tmpfiles.tm
> +++ pl
> @@ -1,2 +1,5 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> L /home - - - - /var/home
> C /var/home - - - - ${IMMUTABLE_DATA_DIR}/home diff --git
> a/recipes-core/security-customizations/files/postinst
> b/recipes-core/security-customizations/files/postinst
> index f8ebf9e..788e225 100755
> --- a/recipes-core/security-customizations/files/postinst
> +++ b/recipes-core/security-customizations/files/postinst
> @@ -3,6 +3,8 @@
> # CIP Security, generic profile
> # Security Package configurations
> #
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git
> a/recipes-core/security-customizations/files/ssh-pam-remote.conf
> b/recipes-core/security-customizations/files/ssh-pam-remote.conf
> index d460b0c..ea120b2 100644
> --- a/recipes-core/security-customizations/files/ssh-pam-remote.conf
> +++ b/recipes-core/security-customizations/files/ssh-pam-remote.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # Enable PAM configuration for Remote Session
> ChallengeResponseAuthentication yes KbdInteractiveAuthentication yes
> diff --git
> a/recipes-core/security-customizations/files/ssh-remote-session-term.c
> onf
> b/recipes-core/security-customizations/files/ssh-remote-session-term.c
> onf
> index d11b92e..171ea9b 100644
> ---
> a/recipes-core/security-customizations/files/ssh-remote-session-term.c
> onf
> +++ b/recipes-core/security-customizations/files/ssh-remote-session-te
> +++ rm.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # CR2.6: Remote session termination
> # Terminate remote session after inactive time period
>
> diff --git
> a/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
> b/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
> index 744b426..f750f3d 100644
> --- a/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
> +++ b/recipes-core/swupdate-config-wfx/files/suricatta_wfx.conf.tmpl
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> SWUPDATE_SURICATTA_ARGS="--server lua -u ${WFX_URL} -i $(cat /etc/machine-id)"
> diff --git a/recipes-core/swupdate-config/files/hwrevision.tmpl
> b/recipes-core/swupdate-config/files/hwrevision.tmpl
> index 1eb0996..b937200 100644
> --- a/recipes-core/swupdate-config/files/hwrevision.tmpl
> +++ b/recipes-core/swupdate-config/files/hwrevision.tmpl
> @@ -1 +1,4 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> cip-${MACHINE} ${MACHINE_HW_VERSION}
> diff --git a/recipes-core/swupdate-config/files/swupdate.cfg
> b/recipes-core/swupdate-config/files/swupdate.cfg
> index 3e2b45c..5c05fbe 100644
> --- a/recipes-core/swupdate-config/files/swupdate.cfg
> +++ b/recipes-core/swupdate-config/files/swupdate.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> globals :
> {
> bootloader = "ebg";
> diff --git
> a/recipes-core/swupdate-handler-roundrobin/files/swupdate.handler.efib
> ootguard.ini
> b/recipes-core/swupdate-handler-roundrobin/files/swupdate.handler.efib
> ootguard.ini
> index 58271da..8f93cc9 100644
> ---
> a/recipes-core/swupdate-handler-roundrobin/files/swupdate.handler.efib
> ootguard.ini
> +++ b/recipes-core/swupdate-handler-roundrobin/files/swupdate.handler.
> +++ efibootguard.ini
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [image]
> chainhandler=raw
>
> diff --git a/recipes-core/tmp-fs/files/postinst
> b/recipes-core/tmp-fs/files/postinst
> index 39067f1..ae0f74a 100755
> --- a/recipes-core/tmp-fs/files/postinst
> +++ b/recipes-core/tmp-fs/files/postinst
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/recipes-devtools/swupdate-signer/files/sign-swu-cms
> b/recipes-devtools/swupdate-signer/files/sign-swu-cms
> index cb0cd4a..bc1ec13 100644
> --- a/recipes-devtools/swupdate-signer/files/sign-swu-cms
> +++ b/recipes-devtools/swupdate-signer/files/sign-swu-cms
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
> in_file=$1
> out_file=$2
> inkey="/usr/share/swupdate-signing/swupdate-sign.key"
> diff --git
> a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.env.t
> mpl
> b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.env.t
> mpl
> index bb93361..452714d 100644
> ---
> a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.env.t
> mpl
> +++ b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.e
> +++ nv.tmpl
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> PARTITIONS="${CRYPT_PARTITIONS}"
> CREATE_FILE_SYSTEM_CMD="${CRYPT_CREATE_FILE_SYSTEM_CMD}"
> SETUP_TIMEOUT="${CRYPT_SETUP_TIMEOUT}"
> diff --git
> a/recipes-initramfs/initramfs-crypt-hook/files/pwquality.conf
> b/recipes-initramfs/initramfs-crypt-hook/files/pwquality.conf
> index d4c8981..8e087f2 100644
> --- a/recipes-initramfs/initramfs-crypt-hook/files/pwquality.conf
> +++ b/recipes-initramfs/initramfs-crypt-hook/files/pwquality.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # we don't have a dictionary in the initramfs # this solves the
> error "Password generation failed - required entropy too low for settings"
> dictcheck = 0
> diff --git
> a/recipes-initramfs/initramfs-factory-reset-hook/files/factory-reset-s
> cript.tmpl
> b/recipes-initramfs/initramfs-factory-reset-hook/files/factory-reset-s
> cript.tmpl
> index f0ad40c..94b5f8b 100644
> ---
> a/recipes-initramfs/initramfs-factory-reset-hook/files/factory-reset-s
> cript.tmpl
> +++ b/recipes-initramfs/initramfs-factory-reset-hook/files/factory-res
> +++ et-script.tmpl
> @@ -7,6 +7,8 @@
> # Authors:
> # Quirin Gylstorff <quirin.gylstorff@siemens.com> #
> +# SPDX-License-Identifier: MIT
> +#
> . /usr/share/factory-reset/reset-env
>
> . /scripts/cip-initramfs-functions
> diff --git
> a/recipes-initramfs/initramfs-factory-reset-hook/files/reset-env.tmpl
> b/recipes-initramfs/initramfs-factory-reset-hook/files/reset-env.tmpl
> index d3e18a2..07e2376 100644
> ---
> a/recipes-initramfs/initramfs-factory-reset-hook/files/reset-env.tmpl
> +++ b/recipes-initramfs/initramfs-factory-reset-hook/files/reset-env.t
> +++ mpl
> @@ -1,3 +1,6 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
> INITRAMFS_FACTORY_RESET_DEVICES="${INITRAMFS_FACTORY_RESET_DEVICES}"
> INITRAMFS_FACTORY_RESET_LUKS_FORMAT_TYPE="${INITRAMFS_FACTORY_RESET_LUKS_FORMAT_TYPE}"
> diff --git
> a/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl
> b/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl
> index bce588c..8a697f8 100644
> --- a/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl
> +++ b/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl
> @@ -7,6 +7,8 @@
> # Jan Kiszka <jan.kiszka@siemens.com> # Quirin Gylstorff
> <quirin.gylstorff@siemens.com> #
> +# SPDX-License-Identifier: MIT
> +#
>
> ovl_storage_path="${INITRAMFS_OVERLAY_STORAGE_PATH}"
> ovl_lower_dirs="${INITRAMFS_OVERLAY_PATHS}"
> diff --git
> a/recipes-initramfs/initramfs-overlay-hook/files/overlay_recovery_acti
> on.script
> b/recipes-initramfs/initramfs-overlay-hook/files/overlay_recovery_acti
> on.script
> index 0cd084b..11ca731 100644
> ---
> a/recipes-initramfs/initramfs-overlay-hook/files/overlay_recovery_acti
> on.script
> +++ b/recipes-initramfs/initramfs-overlay-hook/files/overlay_recovery_
> +++ action.script
> @@ -7,6 +7,8 @@
> # Authors:
> # Clara Kowalsky <clara.kowalsky@siemens.com> #
> +# SPDX-License-Identifier: MIT
> +#
>
> partition_fstype="$1"
> ovl_partition_device="$2"
> diff --git a/recipes-kernel/linux/files/no-module-signing.cfg
> b/recipes-kernel/linux/files/no-module-signing.cfg
> index ab54f68..064ef9c 100644
> --- a/recipes-kernel/linux/files/no-module-signing.cfg
> +++ b/recipes-kernel/linux/files/no-module-signing.cfg
> @@ -1,2 +1,5 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # CONFIG_SECURITY_LOCKDOWN_LSM is not set # CONFIG_MODULE_SIG is not
> set diff --git a/recipes-kernel/linux/files/no-tpm-hwrng.cfg
> b/recipes-kernel/linux/files/no-tpm-hwrng.cfg
> index ab46cd8..08e98ff 100644
> --- a/recipes-kernel/linux/files/no-tpm-hwrng.cfg
> +++ b/recipes-kernel/linux/files/no-tpm-hwrng.cfg
> @@ -1,2 +1,5 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # see
> https://lore.kernel.org/lkml/bbc41534-a2d9-42dc-ac8a-ff8a0b4fd41f@siem
> ens.com/
> # CONFIG_HW_RANDOM_TPM is not set
> diff --git a/recipes-kernel/linux/files/preempt-rt.cfg
> b/recipes-kernel/linux/files/preempt-rt.cfg
> index afbf53d..f558365 100644
> --- a/recipes-kernel/linux/files/preempt-rt.cfg
> +++ b/recipes-kernel/linux/files/preempt-rt.cfg
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # >= 5.10
> CONFIG_EXPERT=y
> CONFIG_PREEMPT_RT=y
> diff --git
> a/recipes-security/fail2ban-config/files/systemd-defaults.conf
> b/recipes-security/fail2ban-config/files/systemd-defaults.conf
> index 16e0d5e..32a8e48 100644
> --- a/recipes-security/fail2ban-config/files/systemd-defaults.conf
> +++ b/recipes-security/fail2ban-config/files/systemd-defaults.conf
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> [DEFAULT]
>
> syslog_backend = systemd
> diff --git a/scripts/deploy-cip-core.sh b/scripts/deploy-cip-core.sh
> index 623c216..1e08e47 100755
> --- a/scripts/deploy-cip-core.sh
> +++ b/scripts/deploy-cip-core.sh
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/scripts/generate-sb-db-from-existing-certificate.sh
> b/scripts/generate-sb-db-from-existing-certificate.sh
> index dddd9b5..42d09dd 100755
> --- a/scripts/generate-sb-db-from-existing-certificate.sh
> +++ b/scripts/generate-sb-db-from-existing-certificate.sh
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/scripts/generate_secure_boot_keys.sh
> b/scripts/generate_secure_boot_keys.sh
> index 8be0569..28ae34c 100755
> --- a/scripts/generate_secure_boot_keys.sh
> +++ b/scripts/generate_secure_boot_keys.sh
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/scripts/start-efishell.sh b/scripts/start-efishell.sh
> index fff8a6a..86e2ddd 100755
> --- a/scripts/start-efishell.sh
> +++ b/scripts/start-efishell.sh
> @@ -1,4 +1,7 @@
> #!/bin/sh
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> set -e
>
> diff --git a/scripts/submit_lava.sh b/scripts/submit_lava.sh index
> b3180a1..a4d20ec 100755
> --- a/scripts/submit_lava.sh
> +++ b/scripts/submit_lava.sh
> @@ -1,4 +1,7 @@
> #!/bin/bash
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # Copyright (C) 2024, Renesas Electronics Europe GmbH # Chris
> Paterson <chris.paterson2@renesas.com> # Sai Ashrith
> <sai.sathujoda@toshiba-tsip.com> diff --git
> a/scripts/update-linux-cip.sh b/scripts/update-linux-cip.sh index
> 5fbfa57..df306b2 100755
> --- a/scripts/update-linux-cip.sh
> +++ b/scripts/update-linux-cip.sh
> @@ -1,4 +1,7 @@
> #!/bin/bash
> +#
> +# SPDX-License-Identifier: MIT
> +#
> REPO_ROOT=$(git rev-parse --show-toplevel) pushd
> "${REPO_ROOT}"/recipes-kernel/linux >/dev/null || exit 1
>
> diff --git a/scripts/update-ltp.sh b/scripts/update-ltp.sh index
> dc8b947..321cc3c 100755
> --- a/scripts/update-ltp.sh
> +++ b/scripts/update-ltp.sh
> @@ -1,4 +1,7 @@
> #!/bin/bash
> +#
> +# SPDX-License-Identifier: MIT
> +#
>
> REPO_ROOT=$(git rev-parse --show-toplevel) pushd
> "${REPO_ROOT}"/recipes-core/ltp > /dev/null || exit diff --git
> a/tests/templates/IEC_template.yml b/tests/templates/IEC_template.yml
> index f8558cd..148f07e 100644
> --- a/tests/templates/IEC_template.yml
> +++ b/tests/templates/IEC_template.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> device_type: qemu
> job_name: #architecture# IEC layer testing
> timeouts:
> diff --git a/tests/templates/secureboot_corrupt_rootfs_steps.yml
> b/tests/templates/secureboot_corrupt_rootfs_steps.yml
> index b6f6628..5c47b30 100644
> --- a/tests/templates/secureboot_corrupt_rootfs_steps.yml
> +++ b/tests/templates/secureboot_corrupt_rootfs_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - "apt-get update"
> - "apt install -y fdisk"
> - "rootfs_start_sector=$(fdisk -l -o Name,Start cip-core-image-security-cip-core-#distribution#-#architecture#.wic | awk -v name=systema '$0 ~ name {print $2}')"
> diff --git a/tests/templates/secureboot_negative_test.yml
> b/tests/templates/secureboot_negative_test.yml
> index 2fcdbfa..a8e4226 100644
> --- a/tests/templates/secureboot_negative_test.yml
> +++ b/tests/templates/secureboot_negative_test.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> device_type: qemu
> job_name: #architecture# secure boot testing
> timeouts:
> diff --git a/tests/templates/secureboot_template.yml
> b/tests/templates/secureboot_template.yml
> index e29b64a..0a075e2 100644
> --- a/tests/templates/secureboot_template.yml
> +++ b/tests/templates/secureboot_template.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> device_type: qemu
> job_name: #architecture# secure boot testing
> timeouts:
> diff --git a/tests/templates/secureboot_unsigned_bootloader_steps.yml
> b/tests/templates/secureboot_unsigned_bootloader_steps.yml
> index 8d64b05..f4f4043 100644
> --- a/tests/templates/secureboot_unsigned_bootloader_steps.yml
> +++ b/tests/templates/secureboot_unsigned_bootloader_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - "apt-get update"
> - "apt install --yes guestfish sbsigntool"
> - "guestfish add cip-core-image-security-cip-core-#distribution#-#architecture#.wic : run : mount /dev/sda1 / : copy-out /EFI/BOOT/bootx64.efi ."
> diff --git a/tests/templates/secureboot_unsigned_kernel_steps.yml
> b/tests/templates/secureboot_unsigned_kernel_steps.yml
> index f097ed6..6ab334a 100644
> --- a/tests/templates/secureboot_unsigned_kernel_steps.yml
> +++ b/tests/templates/secureboot_unsigned_kernel_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - "apt-get update"
> - "apt install --yes guestfish sbsigntool"
> - "guestfish add cip-core-image-security-cip-core-#distribution#-#architecture#.wic : run : mount /dev/sda2 / : copy-out /linux.efi ."
> diff --git a/tests/templates/swupdate-test-action-M-COM.yml
> b/tests/templates/swupdate-test-action-M-COM.yml
> index 56ff106..69c9cb7 100644
> --- a/tests/templates/swupdate-test-action-M-COM.yml
> +++ b/tests/templates/swupdate-test-action-M-COM.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # TEST BLOCK 1
> # Fail the job if software update application failed
> - test:
> diff --git a/tests/templates/swupdate_corrupt_swu_artifact_steps.yml
> b/tests/templates/swupdate_corrupt_swu_artifact_steps.yml
> index 2fad3fd..043867e 100644
> --- a/tests/templates/swupdate_corrupt_swu_artifact_steps.yml
> +++ b/tests/templates/swupdate_corrupt_swu_artifact_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - curl -v --trace-time http://$LAVA_DISPATCHER_IP/tmp/$LAVA_JOB_ID/downloads/common/cip-core-image-security-cip-core-#distribution#-#architecture#.swu --output /root/cip-core-image-security-cip-core-#distribution#-#architecture#.swu
> - mkdir -p swu
> - cpio -ivd --directory=/root/swu <
> /root/cip-core-image-security-cip-core-#distribution#-#architecture#.s
> wu diff --git a/tests/templates/swupdate_corrupt_swu_steps.yml
> b/tests/templates/swupdate_corrupt_swu_steps.yml
> index 74c9217..3cdb793 100644
> --- a/tests/templates/swupdate_corrupt_swu_steps.yml
> +++ b/tests/templates/swupdate_corrupt_swu_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - curl -v --trace-time http://$LAVA_DISPATCHER_IP/tmp/$LAVA_JOB_ID/downloads/common/cip-core-image-security-cip-core-#distribution#-#architecture#.swu --output /root/cip-core-image-security-cip-core-#distribution#-#architecture#.swu
> - mkdir -p swu
> - dd if=/dev/zero
> of=/root/cip-core-image-security-cip-core-#distribution#-#architecture
> #.swu bs=1M count=5 diff --git
> a/tests/templates/swupdate_negative_test.yml
> b/tests/templates/swupdate_negative_test.yml
> index bb79b07..250eaa8 100644
> --- a/tests/templates/swupdate_negative_test.yml
> +++ b/tests/templates/swupdate_negative_test.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> device_type: qemu
> job_name: #architecture# software update testing
> timeouts:
> diff --git a/tests/templates/swupdate_reboot_without_confirm.yml
> b/tests/templates/swupdate_reboot_without_confirm.yml
> index bfad106..074eb1a 100644
> --- a/tests/templates/swupdate_reboot_without_confirm.yml
> +++ b/tests/templates/swupdate_reboot_without_confirm.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # qemu-swtpm.sock will be gone after soft reboot.
> # So the swtpm socket need to be started again for proper reboot #
> To start the swtpm daemon, first the existing one should be killed
> diff --git a/tests/templates/swupdate_same_uuid_steps.yml
> b/tests/templates/swupdate_same_uuid_steps.yml
> index 3ff2e02..8329055 100644
> --- a/tests/templates/swupdate_same_uuid_steps.yml
> +++ b/tests/templates/swupdate_same_uuid_steps.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> - curl -v --trace-time http://$LAVA_DISPATCHER_IP/tmp/$LAVA_JOB_ID/downloads/common/cip-core-image-security-cip-core-#distribution#-#architecture#.swu --output /root/cip-core-image-security-cip-core-#distribution#-#architecture#.swu
> - mkdir -p swu
> - cpio -ivd --directory=/root/swu <
> /root/cip-core-image-security-cip-core-#distribution#-#architecture#.s
> wu diff --git a/tests/templates/swupdate_template.yml
> b/tests/templates/swupdate_template.yml
> index e1f71a9..9a3366b 100644
> --- a/tests/templates/swupdate_template.yml
> +++ b/tests/templates/swupdate_template.yml
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> device_type: qemu
> job_name: #architecture# software update testing
> timeouts:
> diff --git a/wic/ebg-signed-sysparts.inc b/wic/ebg-signed-sysparts.inc
> index c35878f..8210598 100644
> --- a/wic/ebg-signed-sysparts.inc
> +++ b/wic/ebg-signed-sysparts.inc
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # default partition layout EFI Boot Guard usage, signed version
>
> # EFI partition containing efibootguard bootloader binary diff --git
> a/wic/ebg-sysparts.inc b/wic/ebg-sysparts.inc index 0290024..b7f1afa
> 100644
> --- a/wic/ebg-sysparts.inc
> +++ b/wic/ebg-sysparts.inc
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # default partition layout EFI Boot Guard usage
>
> # EFI partition containing efibootguard bootloader binary diff --git
> a/wic/hihope-rzg2m-efibootguard.wks.in
> b/wic/hihope-rzg2m-efibootguard.wks.in
> index fdbad14..99c8d10 100644
> --- a/wic/hihope-rzg2m-efibootguard.wks.in
> +++ b/wic/hihope-rzg2m-efibootguard.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # short-description: RZ/G2M image with EFI Boot Guard and SWUpdate #
> long-description: Disk image for HiHope RZ/G2M board with EFI Boot
> Guard and SWUpdate
>
> diff --git a/wic/qemu-arm64-efibootguard-secureboot.wks.in
> b/wic/qemu-arm64-efibootguard-secureboot.wks.in
> index 941a552..88eb91c 100644
> --- a/wic/qemu-arm64-efibootguard-secureboot.wks.in
> +++ b/wic/qemu-arm64-efibootguard-secureboot.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> include ebg-signed-sysparts.inc
>
> part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.verity"
> --align 1024 --fixed-size 1G --uuid "${ABROOTFS_PART_UUID_A}"
> --part-type 0FC63DAF-8483-4772-8E79-3D69D8477DE4 --part-name systema
> diff --git a/wic/qemu-arm64-efibootguard.wks.in
> b/wic/qemu-arm64-efibootguard.wks.in
> index 21c0b24..117c47c 100644
> --- a/wic/qemu-arm64-efibootguard.wks.in
> +++ b/wic/qemu-arm64-efibootguard.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # short-description: arm64 with EFI Boot Guard and SWUpdate #
> long-description: Disk image for arm64 machines with EFI Boot Guard
> and SWUpdate
>
> diff --git a/wic/qemu-riscv64-efibootguard.wks.in
> b/wic/qemu-riscv64-efibootguard.wks.in
> index 948c67d..a5dd09b 100644
> --- a/wic/qemu-riscv64-efibootguard.wks.in
> +++ b/wic/qemu-riscv64-efibootguard.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # short-description: riscv64 with EFI Boot Guard and SWUpdate #
> long-description: Disk image for riscv64 machines with EFI Boot Guard
> and SWUpdate
>
> diff --git a/wic/x86-uefi-efibootguard-secureboot.wks.in
> b/wic/x86-uefi-efibootguard-secureboot.wks.in
> index 2af3e58..f15f9e0 100644
> --- a/wic/x86-uefi-efibootguard-secureboot.wks.in
> +++ b/wic/x86-uefi-efibootguard-secureboot.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> include ebg-signed-sysparts.inc
>
> part --source rawcopy --sourceparams "file=${IMAGE_FULLNAME}.verity"
> --align 1024 --fixed-size 1G --uuid "${ABROOTFS_PART_UUID_A}"
> --part-type 0FC63DAF-8483-4772-8E79-3D69D8477DE4 --part-name systema
> diff --git a/wic/x86-uefi-efibootguard.wks.in
> b/wic/x86-uefi-efibootguard.wks.in
> index 3640ecf..982a87a 100644
> --- a/wic/x86-uefi-efibootguard.wks.in
> +++ b/wic/x86-uefi-efibootguard.wks.in
> @@ -1,3 +1,6 @@
> +#
> +# SPDX-License-Identifier: MIT
> +#
> # short-description: x86 with EFI Boot Guard and SWUpdate #
> long-description: Disk image for x86 machines with EFI Boot Guard and
> SWUpdate
>
>
> ---
> base-commit: e3158569eee297f1837a6d3fd7e0f1a0534c2b8b
> change-id: 20260316-license-c5fcde3618d2
>
> Best regards,

Thanks, applied. Will follow up with fixing two more spots so that we are only left with files that cannot receive headers.