From 95626abdd397a6e9ec667b04d22677d75ec5f0b0 Mon Sep 17 00:00:00 2001 From: Felix Fontein Date: Tue, 13 Sep 2022 21:13:04 +0200 Subject: [PATCH] Make mostly reuse conformant (#502) * Add .license files. * Update README. * Normalize licenses test. * Add reuse GHA. * Add blanket rule for changelog fragments. * Add .license file for vendored third-party certificates. * Fix workflow's permissions. * Revert "Add .license file for vendored third-party certificates." This reverts commit 35e106867c026393e144a2932239e5742bb3fb18. * Make reuse lint test optional. * Add exceptions. * Update README. * Improve reuse test. --- .github/workflows/reuse.yml | 34 ++++++++ .reuse/dep5 | 5 ++ CHANGELOG.rst.license | 3 + README.md | 2 +- changelogs/changelog.yaml.license | 3 + .../luks_device/files/keyfile1.license | 3 + .../luks_device/files/keyfile2.license | 3 + tests/sanity/extra/extra-docs.json.license | 3 + tests/sanity/extra/licenses.json.license | 3 + tests/sanity/extra/licenses.py | 80 +++++++++---------- tests/sanity/extra/licenses.py.license | 3 + .../extra/no-unwanted-files.json.license | 3 + tests/sanity/ignore-2.10.txt.license | 3 + tests/sanity/ignore-2.11.txt.license | 3 + tests/sanity/ignore-2.12.txt.license | 3 + tests/sanity/ignore-2.13.txt.license | 3 + tests/sanity/ignore-2.14.txt.license | 3 + tests/sanity/ignore-2.9.txt.license | 3 + .../acme/fixtures/cert_1.pem.license | 3 + .../acme/fixtures/csr_1.pem.license | 3 + .../acme/fixtures/csr_1.pem.old.license | 3 + .../acme/fixtures/csr_1.txt.license | 3 + .../acme/fixtures/csr_2.pem.license | 3 + .../acme/fixtures/csr_2.txt.license | 3 + .../acme/fixtures/privatekey_1.pem.license | 3 + .../acme/fixtures/privatekey_1.txt.license | 3 + 26 files changed, 142 insertions(+), 45 deletions(-) create mode 100644 .github/workflows/reuse.yml create mode 100644 .reuse/dep5 create mode 100644 CHANGELOG.rst.license create mode 100644 changelogs/changelog.yaml.license create mode 100644 tests/integration/targets/luks_device/files/keyfile1.license create mode 100644 tests/integration/targets/luks_device/files/keyfile2.license create mode 100644 tests/sanity/extra/extra-docs.json.license create mode 100644 tests/sanity/extra/licenses.json.license create mode 100644 tests/sanity/extra/licenses.py.license create mode 100644 tests/sanity/extra/no-unwanted-files.json.license create mode 100644 tests/sanity/ignore-2.10.txt.license create mode 100644 tests/sanity/ignore-2.11.txt.license create mode 100644 tests/sanity/ignore-2.12.txt.license create mode 100644 tests/sanity/ignore-2.13.txt.license create mode 100644 tests/sanity/ignore-2.14.txt.license create mode 100644 tests/sanity/ignore-2.9.txt.license create mode 100644 tests/unit/plugins/module_utils/acme/fixtures/cert_1.pem.license create mode 100644 tests/unit/plugins/module_utils/acme/fixtures/csr_1.pem.license create mode 100644 tests/unit/plugins/module_utils/acme/fixtures/csr_1.pem.old.license create mode 100644 tests/unit/plugins/module_utils/acme/fixtures/csr_1.txt.license create mode 100644 tests/unit/plugins/module_utils/acme/fixtures/csr_2.pem.license create mode 100644 tests/unit/plugins/module_utils/acme/fixtures/csr_2.txt.license create mode 100644 tests/unit/plugins/module_utils/acme/fixtures/privatekey_1.pem.license create mode 100644 tests/unit/plugins/module_utils/acme/fixtures/privatekey_1.txt.license diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml new file mode 100644 index 00000000..6d4111bd --- /dev/null +++ b/.github/workflows/reuse.yml @@ -0,0 +1,34 @@ +--- +# Copyright (c) Ansible Project +# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +# SPDX-License-Identifier: GPL-3.0-or-later + +name: Verify REUSE + +on: + push: + branches: [main] + pull_request: + branches: [main] + # Run CI once per day (at 04:45 UTC) + schedule: + - cron: '45 4 * * *' + +jobs: + check: + permissions: + contents: read + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v2 + + - name: Install dependencies + run: | + pip install reuse + + - name: Check REUSE compliance (except some PEM files) + run: | + rm -f tests/integration/targets/*/files/*.pem + rm -f tests/integration/targets/*/files/roots/*.pem + reuse lint diff --git a/.reuse/dep5 b/.reuse/dep5 new file mode 100644 index 00000000..0c3745eb --- /dev/null +++ b/.reuse/dep5 @@ -0,0 +1,5 @@ +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ + +Files: changelogs/fragments/* +Copyright: Ansible Project +License: GPL-3.0-or-later diff --git a/CHANGELOG.rst.license b/CHANGELOG.rst.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/CHANGELOG.rst.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/README.md b/README.md index 79345d9f..115c4f5e 100644 --- a/README.md +++ b/README.md @@ -120,4 +120,4 @@ See [LICENSES/GPL-3.0-or-later.txt](https://github.com/ansible-collections/commu Parts of the collection are licensed under the [Apache 2.0 license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/Apache-2.0.txt) (`plugins/module_utils/crypto/_obj2txt.py` and `plugins/module_utils/crypto/_objects_data.py`), the [BSD 2-Clause license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/BSD-2-Clause.txt) (`plugins/module_utils/ecs/api.py`), the [BSD 3-Clause license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/BSD-3-Clause.txt) (`plugins/module_utils/crypto/_obj2txt.py`), and the [PSF 2.0 license](https://github.com/ansible-collections/community.crypto/blob/main/LICENSES/PSF-2.0.txt) (`plugins/module_utils/_version.py`). This only applies to vendored files in ``plugins/module_utils/`` and to the ECS module utils. -Most files in the collection that are not automatically generated have a machine readable `SDPX-License-Identifier:` comment denoting its respective license(s). +Almost all files have a machine readable `SDPX-License-Identifier:` comment denoting its respective license(s) or an equivalent entry in an accompanying `.license` file. Only changelog fragments (which will not be part of a release) are covered by a blanket statement in `.reuse/dep5`. Right now a few vendored PEM files do not have licensing information as well. This conforms to the [REUSE specification](https://reuse.software/spec/) up to the aforementioned PEM files. diff --git a/changelogs/changelog.yaml.license b/changelogs/changelog.yaml.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/changelogs/changelog.yaml.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/integration/targets/luks_device/files/keyfile1.license b/tests/integration/targets/luks_device/files/keyfile1.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/integration/targets/luks_device/files/keyfile1.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/integration/targets/luks_device/files/keyfile2.license b/tests/integration/targets/luks_device/files/keyfile2.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/integration/targets/luks_device/files/keyfile2.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/sanity/extra/extra-docs.json.license b/tests/sanity/extra/extra-docs.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/sanity/extra/extra-docs.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/sanity/extra/licenses.json.license b/tests/sanity/extra/licenses.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/sanity/extra/licenses.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/sanity/extra/licenses.py b/tests/sanity/extra/licenses.py index c1e10e2e..63784025 100755 --- a/tests/sanity/extra/licenses.py +++ b/tests/sanity/extra/licenses.py @@ -21,30 +21,35 @@ def find_licenses(filename, relax=False): spdx_license_identifiers = [] other_license_identifiers = [] has_copyright = False - with open(filename, 'r', encoding='utf-8') as f: - for line in f: - line = line.rstrip() - if 'Copyright ' in line: - has_copyright = True - if 'Copyright: ' in line: - print('%s: found copyright line with "Copyright:". Please remove the colon.' % (filename, )) - idx = line.find('SPDX-License-Identifier: ') - if idx >= 0: - lic_id = line[idx + len('SPDX-License-Identifier: '):] - spdx_license_identifiers.extend(lic_id.split(' OR ')) - if 'GNU General Public License' in line: - if 'v3.0+' in line: - other_license_identifiers.append('GPL-3.0-or-later') - if 'version 3 or later' in line: - other_license_identifiers.append('GPL-3.0-or-later') - if 'Simplified BSD License' in line: - other_license_identifiers.append('BSD-2-Clause') - if 'Apache License 2.0' in line: - other_license_identifiers.append('Apache-2.0') - if 'PSF License' in line or 'Python-2.0' in line: - other_license_identifiers.append('PSF-2.0') - if 'MIT License' in line: - other_license_identifiers.append('MIT') + try: + with open(filename, 'r', encoding='utf-8') as f: + for line in f: + line = line.rstrip() + if 'Copyright ' in line: + has_copyright = True + if 'Copyright: ' in line: + print('%s: found copyright line with "Copyright:". Please remove the colon.' % (filename, )) + if 'SPDX-FileCopyrightText: ' in line: + has_copyright = True + idx = line.find('SPDX-License-Identifier: ') + if idx >= 0: + lic_id = line[idx + len('SPDX-License-Identifier: '):] + spdx_license_identifiers.extend(lic_id.split(' OR ')) + if 'GNU General Public License' in line: + if 'v3.0+' in line: + other_license_identifiers.append('GPL-3.0-or-later') + if 'version 3 or later' in line: + other_license_identifiers.append('GPL-3.0-or-later') + if 'Simplified BSD License' in line: + other_license_identifiers.append('BSD-2-Clause') + if 'Apache License 2.0' in line: + other_license_identifiers.append('Apache-2.0') + if 'PSF License' in line or 'Python-2.0' in line: + other_license_identifiers.append('PSF-2.0') + if 'MIT License' in line: + other_license_identifiers.append('MIT') + except Exception as exc: + print('%s: error while processing file: %s' % (filename, exc)) if len(set(spdx_license_identifiers)) < len(spdx_license_identifiers): print('%s: found identical SPDX-License-Identifier values' % (filename, )) if other_license_identifiers and set(other_license_identifiers) != set(spdx_license_identifiers): @@ -62,30 +67,16 @@ def main(): # The following paths are allowed to have no license identifier no_comments_allowed = [ 'changelogs/fragments/*.yml', - 'tests/sanity/extra/*.json', - 'tests/sanity/ignore-2.*.txt', - 'LICENSES/*.txt', - 'COPYING', - ] - - # Files of this name are allowed to be empty - empty_allowed = [ - '.keep', - '__init__.py', ] # These files are completely ignored ignore_paths = [ - 'CHANGELOG.rst', - 'changelogs/changelog.yaml', - 'tests/sanity/extra/licenses.py', # The strings in find_licenses() confuse this code :-) '.ansible-test-timeout.json', - 'tests/unit/plugins/module_utils/acme/fixtures/*.txt', - 'tests/unit/plugins/module_utils/acme/fixtures/*.pem', - 'tests/unit/plugins/module_utils/acme/fixtures/*.pem.old', + '.reuse/dep5', + 'LICENSES/*.txt', + 'COPYING', 'tests/integration/targets/*/files/*.pem', 'tests/integration/targets/*/files/roots/*.pem', - 'tests/integration/targets/luks_device/files/keyfile*', ] no_comments_allowed = [fn for pattern in no_comments_allowed for fn in glob.glob(pattern)] @@ -98,9 +89,10 @@ def main(): path = path[2:] if path in ignore_paths or path.startswith('tests/output/'): continue - if os.path.basename(path) in empty_allowed: - if os.stat(path).st_size == 0: - continue + if os.stat(path).st_size == 0: + continue + if not path.endswith('.license') and os.path.exists(path + '.license'): + path = path + '.license' valid_licenses_for_path = valid_licenses if path.startswith('plugins/') and not path.startswith(('plugins/modules/', 'plugins/module_utils/')): valid_licenses_for_path = [license for license in valid_licenses if license == 'GPL-3.0-or-later'] diff --git a/tests/sanity/extra/licenses.py.license b/tests/sanity/extra/licenses.py.license new file mode 100644 index 00000000..6c4958fe --- /dev/null +++ b/tests/sanity/extra/licenses.py.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: 2022, Felix Fontein diff --git a/tests/sanity/extra/no-unwanted-files.json.license b/tests/sanity/extra/no-unwanted-files.json.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/sanity/extra/no-unwanted-files.json.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/sanity/ignore-2.10.txt.license b/tests/sanity/ignore-2.10.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/sanity/ignore-2.10.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/sanity/ignore-2.11.txt.license b/tests/sanity/ignore-2.11.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/sanity/ignore-2.11.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/sanity/ignore-2.12.txt.license b/tests/sanity/ignore-2.12.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/sanity/ignore-2.12.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/sanity/ignore-2.13.txt.license b/tests/sanity/ignore-2.13.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/sanity/ignore-2.13.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/sanity/ignore-2.14.txt.license b/tests/sanity/ignore-2.14.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/sanity/ignore-2.14.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/sanity/ignore-2.9.txt.license b/tests/sanity/ignore-2.9.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/sanity/ignore-2.9.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/unit/plugins/module_utils/acme/fixtures/cert_1.pem.license b/tests/unit/plugins/module_utils/acme/fixtures/cert_1.pem.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/unit/plugins/module_utils/acme/fixtures/cert_1.pem.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/unit/plugins/module_utils/acme/fixtures/csr_1.pem.license b/tests/unit/plugins/module_utils/acme/fixtures/csr_1.pem.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/unit/plugins/module_utils/acme/fixtures/csr_1.pem.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/unit/plugins/module_utils/acme/fixtures/csr_1.pem.old.license b/tests/unit/plugins/module_utils/acme/fixtures/csr_1.pem.old.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/unit/plugins/module_utils/acme/fixtures/csr_1.pem.old.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/unit/plugins/module_utils/acme/fixtures/csr_1.txt.license b/tests/unit/plugins/module_utils/acme/fixtures/csr_1.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/unit/plugins/module_utils/acme/fixtures/csr_1.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/unit/plugins/module_utils/acme/fixtures/csr_2.pem.license b/tests/unit/plugins/module_utils/acme/fixtures/csr_2.pem.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/unit/plugins/module_utils/acme/fixtures/csr_2.pem.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/unit/plugins/module_utils/acme/fixtures/csr_2.txt.license b/tests/unit/plugins/module_utils/acme/fixtures/csr_2.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/unit/plugins/module_utils/acme/fixtures/csr_2.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/unit/plugins/module_utils/acme/fixtures/privatekey_1.pem.license b/tests/unit/plugins/module_utils/acme/fixtures/privatekey_1.pem.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/unit/plugins/module_utils/acme/fixtures/privatekey_1.pem.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project diff --git a/tests/unit/plugins/module_utils/acme/fixtures/privatekey_1.txt.license b/tests/unit/plugins/module_utils/acme/fixtures/privatekey_1.txt.license new file mode 100644 index 00000000..edff8c76 --- /dev/null +++ b/tests/unit/plugins/module_utils/acme/fixtures/privatekey_1.txt.license @@ -0,0 +1,3 @@ +GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt) +SPDX-License-Identifier: GPL-3.0-or-later +SPDX-FileCopyrightText: Ansible Project