Re: Meta-question on GPL compliance of this activity

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, May 24, 2019 at 04:24:25PM -0400, Allison Randal wrote:
> Which seems to leave the options of generating a condensed list of
> historical notices from the git history and either:
> 
> - adding the generated file to the release tarball, or

As the person who generates the release tarballs these days, this is
going to be tough.  It's an automated process that generates it directly
from the git tree itself so that anyone else can also do the same thing
and verify that what we released is identical to what the git tree has.

Reproducable builds are good to have :)

If I have to have the servers run some other script that magically
injects it into the tarball, that's going to be a big problem as it
makes verification of the tarball _much_ more difficult :(

> - posting the generated file on some kernel.org domain (updated with
> each release), and linking to it from some sensible doc file in the git
> repo, possibly: Documentation/process/license-rules.rst

We can do this, again, if it is something that is actually workable.

Again, remember we have over 65 thousand files in the kernel source
tree.  Any single file that tries to reference them all, in any form, is
going to be unworkable.  As a simple experiment, has anyone tried to run
something like 'reuse' on the kernel source tree today and seen what the
output is?  Good luck with that :)

thanks,

greg k-h

> In my experience, Kernel teams for Linux distros tend to pull their
> Kernel source from git rather than the tarballs anyway, so the second
> method of posting the generated file is probably a more reliable way to
> get the information passed through to the distros.

Why would a distro kernel package suck in a random file off of the web
that could change at any point in time and isn't obviously related to
the kernel tree itself (i.e. part of it?)

And wouldn't they really need to post their _OWN_ file as everyone who
ships a kernel changes it in some way (for good reasons.)  So
individuals would need to be able to generate their own file somehow.

Anyway, I'm trying to say that a "single file" is going to be a major
pain in the rear with almost no benefit that I can see.

Again, has anyone demanded such a thing from any other project that has
switched to only SPDX tags (like uboot?)

thanks,

greg k-h