[RFC] Check licenses of GCC libraries

[Maxim Kuvyrkov]

Hi,

Following license audit of libraries included with GCC [*] and fixes thereof, below are suggestions on how we can implement ongoing checks for license compliance of GCC sources.

My proposal is to have one of release managers run a script as part of release process for major version updates.  The script will output a list of file that potentially have wrong licenses.  The release manager then diffs the output against known license XFAILs and investigates (and fixes) any suspicious changes in licenses.  Then the license XFAILs are updated and stored until the next major release.  So to reiterate:

1. RM runs the script maintainer-scripts/gen-license-xfail,
2. RM waits for 5-10 minutes while script churns away,
3. RM runs git diff and reviews changes compared to previous release and fixes licenses,
4. RM commits updated maintainer-scripts/license.xfail.

Prototype script is attached.  It generates about 1300 xfails for libraries in GCC, a good chunk of which could be filtered out if required.

Interestingly, the attached script pointed out potential license problems in C6x libgcc files:

File libgcc/config/c6x/eqd.c contains license(s) LGPL-2.1+
File libgcc/config/c6x/eqf.c contains license(s) LGPL-2.1+
File libgcc/config/c6x/ged.c contains license(s) LGPL-2.1+
File libgcc/config/c6x/gef.c contains license(s) LGPL-2.1+
File libgcc/config/c6x/gtd.c contains license(s) LGPL-2.1+
File libgcc/config/c6x/gtf.c contains license(s) LGPL-2.1+
File libgcc/config/c6x/led.c contains license(s) LGPL-2.1+
File libgcc/config/c6x/lef.c contains license(s) LGPL-2.1+
File libgcc/config/c6x/ltd.c contains license(s) LGPL-2.1+
File libgcc/config/c6x/ltf.c contains license(s) LGPL-2.1+
File libgcc/config/c6x/sfp-machine.h contains license(s) LGPL-2.1+

These should be GPLv3+exception, right?

The attached script assumes a functional installation of FOSSology 2.2 or later (versions prior to 2.2 don't have GPLv3+exception license signature). The only part of FOSSology used is 'nomos' license scanner which can be used standalone without needing to properly configure other parts of FOSSology.  Nomos accepts a list of files on the command line and prints out licenses found in each file.

[*] http://www.kugelworks.com/blog/gcc-license-audit/

Thank you, and your comments are welcome,

--
Maxim Kuvyrkov
www.kugelworks.com


-------------- next part --------------
A non-text attachment was scrubbed...
Name: gen-license-xfail.patch
Type: application/octet-stream
Size: 102241 bytes
Desc: not available
URL: <https://gcc.gnu.org/pipermail/gcc/attachments/20130919/88a0c06e/attachment.obj>