Re: [edk2-devel] CodeQL and Apache Licensed Files

["Laszlo Ersek" <lersek@redhat.com>]

On 10/31/23 17:07, Michael Kubacki wrote:
> On 10/28/2023 7:51 AM, Laszlo Ersek wrote:
>> On 10/27/23 23:11, Michael Kubacki wrote:
>>> I'd like to bring attention to Apache License 2.0 code in the CodeQL
>>> series I sent to the mailing list for steward review.
>>>
>>> In particular, the files in the BaseTools/Plugin/CodeQL/analyze
>>> directory of this patch:
>>>
>>> https://edk2.groups.io/g/devel/message/109696
>>>
>>> Please let me know if any next steps are needed.
>>
>> (1) I don't know if edk2 accepts contributions under Apache License 2.0;
>> just want to point out that this license is acceptable in Fedora (and so
>> RHEL too), per
>> <https://docs.fedoraproject.org/en-US/legal/allowed-licenses/>. Assuming
>> we're talking about "Apache Software License 2.0".
>>
> A few submodules are using the Apache License 2.0.
> 
> For example, OpenSSL v3:
> 
> - https://www.openssl.org/source/license.html
> - https://git.openssl.org/?p=openssl.git;a=blob_plain;f=LICENSE.txt;hb=HEAD
> 
> And cmoocka:
> 
> - https://gitlab.com/cmocka/cmocka/-/blob/master/COPYING

Thanks for identifying those!

> 
> I'm unaware if there was precedent specific to submodules, but I'd
> expect terms like redistribution clauses to already apply regardless of
> tooling used to acquire the source code into the project.

I believe the same.

> 
>> (2) Should we extend "License Details" and "Code Contributions" in
>> "ReadMe.rst"?
>>
> My initial thought was to add the path (BaseTools\Plugin\CodeQL\analyze)
> to "License Details".
> 
> Was that all that you had in mind or to elaborate further in that
> section on the licenses used/allowed?

- Under "License Details", simply list BaseTools/Plugin/CodeQL/analyze
as one of the "components" (i.e., first list) that use a "additional
licenses".

- Under "Code Contributions", we should list "Apache Software License
2.0" as acceptable -- both for this new feature, and for the *already*
upstream stuff that you found above.

> 
>> (3) Should the new files (under Apache License 2.0) use an SPDX
>> identifier tag, for easy greppability?
>>
> I'd be happy to add that.

That's a relief, I didn't know whether you could touch up the license
blocks!

Thanks!
Laszlo

> 
>> (4) With the addition, downstream packages (such as RPMs in Fedora and
>> RHEL) might want to spell out the short SPDX identifier of the new
>> license too in their License: tags.
>>
>> Laszlo
>>
>>
>>
>> 
>>
> 



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#110437): https://edk2.groups.io/g/devel/message/110437
Mute This Topic: https://groups.io/mt/102230244/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/leave/12367111/7686176/1913456212/xyzzy [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-