[PATCH 3/3] scripts: forbid use of arbitrary SPDX tags besides license identifiers

Daniel P. Berrangé posted 3 patches 1 month, 2 weeks ago
There is a newer version of this series
[PATCH 3/3] scripts: forbid use of arbitrary SPDX tags besides license identifiers
Posted by Daniel P. Berrangé 1 month, 2 weeks ago
While SPDX-License-Identifier is a well known SPDX tag, there are a
great many more besides that[1]. This are around making machine readable
metadata available to the 'reuse' tool and similar for things like
author names, copyright owners, and much more. It is even possible to
define source file line groups and apply different SPDX tags to just
that region of code.

At this time we're only interested in adopting SPDX for recording the
licensing info, so detect & reject any other SPDX metadata. If we want
to explicitly collect extra data in SPDX format, we can evaluate each
case on its merits.

[1] https://spdx.github.io/spdx-spec/v2.2.2/file-tags/
    https://spdx.github.io/spdx-spec/v2.2.2/file-information/

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 scripts/checkpatch.pl | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index cd1ed90f4c..5ad2d4ca2e 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1707,6 +1707,18 @@ sub process {
 		    &checkspdx($realfile, $1);
 		}
 
+		if ($rawline =~ m,(SPDX-[a-zA-Z0-9-_]+):,) {
+		    my $tag = $1;
+		    my @permitted = qw(
+			SPDX-License-Identifier
+		    );
+
+		    unless (grep { /^$tag$/ } @permitted) {
+			ERROR("Tag $tag not permitted in QEMU code, valid " .
+			      "choices are: " . join(", ", @permitted));
+		    }
+		}
+
 # Check for wrappage within a valid hunk of the file
 		if ($realcnt != 0 && $line !~ m{^(?:\+|-| |\\ No newline|$)}) {
 			ERROR("patch seems to be corrupt (line wrapped?)\n" .
-- 
2.46.0


Re: [PATCH 3/3] scripts: forbid use of arbitrary SPDX tags besides license identifiers
Posted by Philippe Mathieu-Daudé 1 month, 2 weeks ago
On 7/10/24 12:45, Daniel P. Berrangé wrote:
> While SPDX-License-Identifier is a well known SPDX tag, there are a
> great many more besides that[1]. This are around making machine readable
> metadata available to the 'reuse' tool and similar for things like
> author names, copyright owners, and much more. It is even possible to
> define source file line groups and apply different SPDX tags to just
> that region of code.
> 
> At this time we're only interested in adopting SPDX for recording the
> licensing info, so detect & reject any other SPDX metadata. If we want
> to explicitly collect extra data in SPDX format, we can evaluate each
> case on its merits.

50 uses, a third of them are mine, 10 different contributors.
Can be cleaned.

> 
> [1] https://spdx.github.io/spdx-spec/v2.2.2/file-tags/
>      https://spdx.github.io/spdx-spec/v2.2.2/file-information/
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   scripts/checkpatch.pl | 12 ++++++++++++
>   1 file changed, 12 insertions(+)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>