Re: [PATCH] treewide: Add SPDX identifier to IETF ASN.1 modules

Richard Fontana <[email protected]> Sat, 21 Oct 2023 09:23:55 -0400

Newsgroups	org.kernel.vger.linux-spdx,org.kernel.vger.keyrings,org.kernel.vger.linux-cifs,org.kernel.vger.linux-crypto,org.kernel.vger.netfilter-devel
Message-ID	<CAC1cPGx-cb+YZ9KgEFvSjtf+fp9Dhcn4sm9qHmFFDRDxb=7fHg@mail.gmail.com>

On Sat, Oct 21, 2023 at 7:25 AM Lukas Wunner <[email protected]> wrote:
>
> Per section 4.c. of the IETF Trust Legal Provisions, "Code Components"
> in IETF Documents are licensed on the terms of the BSD-3-Clause license:
>
> https://trustee.ietf.org/documents/trust-legal-provisions/tlp-5/
>
> The term "Code Components" specifically includes ASN.1 modules:
>
> https://trustee.ietf.org/documents/trust-legal-provisions/code-components-list-3/

Sorry if this seems super-pedantic but I am pretty sure the license
text in the IETF Trust Legal Provisions does not actually match SPDX
`BSD-3-Clause` because of one additional word in clause 3 ("specific"
before "contributors"), so IMO you should get SPDX to modify its
definition of `BSD-3-Clause` prior to applying this patch (or get IETF
to change its version of the license, but I imagine that would be more
difficult). This issue of a multitude of nonsubstantively different,
non-matching versions of clause 3 is a common issue that has been
coming up in the Fedora project's adoption of SPDX identifiers for
license metadata.

Richard