Re: [yocto] Suggestions on improvements

["Robert Berger" <robert.berger.yocto.user@gmail.com>]

Hi,

On 08/01/2021 04:59, Meh Mbeh Ida Delphine wrote:
 >
 > Due to some mismatches, warnings pop up during the build. Below are some
 > few sample warnings and I'm aware of false positives;
Why do you think they are false positives?

 >
 > WARNING: glibc-2.32-r0 do_package: License for package nscd is {'GPL-2.0
 > WITH Linux-syscall-note'} vs GPLv2 & LGPLv2.1
Check this file:

FileName: 
./spdx_temp/git/.pc/0026-inject-file-assembly-directives.patch/sysdeps/aarch64/crti.S
FileChecksum: SHA1: 83c9d68d2f83ca0af8af2a918533f21004aac238
LicenseConcluded: NOASSERTION
LicenseInfoInFile: LGPL-2.1-or-later
LicenseInfoInFile: LicenseRef-scancode-unlimited-linking-exception-lgpl
FileCopyrightText: <text>Copyright (c) 1995-2020 Free Software 
Foundation, Inc.
</text>


I play around with meta-spdxscanner and if you run e.g. scancode-toolkit 
it tells you:

FileName: ./spdx_temp/git/nscd/cache.c
FileChecksum: SHA1: ecec99d5427b03fe5c390f5fd78274a2a7c625e7
LicenseConcluded: NOASSERTION
LicenseInfoInFile: GPL-3.0-or-later
FileCopyrightText: <text>Copyright (c) 1998-2020 Free Software 
Foundation, Inc.
</text>

;)

Which comes from:

This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published
    by the Free Software Foundation; version 2 of the License, or
    (at your option) any later version.

So once someone determines what's the real license, I guess packages 
could be licensed accordingly ;)

LICENSE_glibc-xxx = "GPLv3+"

is it? Bring in the lawyers.

 > WARNING: glibc-2.32-r0 do_package: License for package sln is {'GPL-2.0
 > WITH Linux-syscall-note'} vs GPLv2 & LGPLv2.1
 > WARNING: glibc-2.32-r0 do_package: License for package ldconfig is
 > {'GPL-2.0 WITH Linux-syscall-note'} vs GPLv2 & LGPLv2.1
 > WARNING: glibc-2.32-r0 do_package: License for package glibc is
 > {'GPL-2.0 WITH Linux-syscall-note'} vs GPLv2 & LGPLv2.1
 > WARNING: glibc-2.32-r0 do_package: License for package glibc-staticdev
 > is {'GPL-2.0 WITH Linux-syscall-note'} vs GPLv2 & LGPLv2.1
 > WARNING: libcap-ng-0.8-r0 do_package: License for package libcap-ng is
 > {'GPL-2.0 WITH Linux-syscall-note'} vs GPLv2+ & LGPLv2.1+> WARNING: 
libtirpc-1.2.6-r0 do_package: License for package libtirpc is
 > {'GPL-2.0 WITH Linux-syscall-note'} vs BSD-3-Clause
 > WARNING: ptest-runner-2.4.0+gitAUTOINC+834670317b-r0 do_package: License
 > for package ptest-runner is {'GPL-2.0-or-later'} vs GPLv2+
I assume GPLv2+ is supposed to mean GPL-2.0-or-later.
One fix would be to put in the LICENSE field of ptest-runnner 
GPL-2.0-or-later instead of GPLv2+. Another fix could be to add the 
mapping between GPLv2+ and GPL-2.0-or-later.

 > WARNING: libcap-2.44-r0 do_package: License for package libcap is
 > {'GPL-2.0 WITH Linux-syscall-note'} vs BSD | GPLv2> WARNING: 
libcap-2.44-r0 do_package: License for package libcap-staticdev
 > is {'GPL-2.0 WITH Linux-syscall-note'} vs BSD | GPLv2
 > WARNING: openssl-1.1.1h-r0 do_package: License for package
 > openssl-engines is {'GPL-2.0 WITH Linux-syscall-note', 'GPL-2.0+ WITH
 > Linux-syscall-note'} vs openssl
 > > Any suggestions on improvements I can make to this functionality?
 >
 > Cheers,
 > Ida.
Regards,

Robert