On Fri, May 24, 2019 at 04:24:25PM -0400, Allison Randal wrote: > Which seems to leave the options of generating a condensed list of > historical notices from the git history and either: > > - adding the generated file to the release tarball, or As the person who generates the release tarballs these days, this is going to be tough. It's an automated process that generates it directly from the git tree itself so that anyone else can also do the same thing and verify that what we released is identical to what the git tree has. Reproducable builds are good to have :) If I have to have the servers run some other script that magically injects it into the tarball, that's going to be a big problem as it makes verification of the tarball _much_ more difficult :( > - posting the generated file on some kernel.org domain (updated with > each release), and linking to it from some sensible doc file in the git > repo, possibly: Documentation/process/license-rules.rst We can do this, again, if it is something that is actually workable. Again, remember we have over 65 thousand files in the kernel source tree. Any single file that tries to reference them all, in any form, is going to be unworkable. As a simple experiment, has anyone tried to run something like 'reuse' on the kernel source tree today and seen what the output is? Good luck with that :) thanks, greg k-h > In my experience, Kernel teams for Linux distros tend to pull their > Kernel source from git rather than the tarballs anyway, so the second > method of posting the generated file is probably a more reliable way to > get the information passed through to the distros. Why would a distro kernel package suck in a random file off of the web that could change at any point in time and isn't obviously related to the kernel tree itself (i.e. part of it?) And wouldn't they really need to post their _OWN_ file as everyone who ships a kernel changes it in some way (for good reasons.) So individuals would need to be able to generate their own file somehow. Anyway, I'm trying to say that a "single file" is going to be a major pain in the rear with almost no benefit that I can see. Again, has anyone demanded such a thing from any other project that has switched to only SPDX tags (like uboot?) thanks, greg k-h
