NetBSD Problem Report #60308

From www@netbsd.org  Wed Jun  3 09:02:47 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "R13" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 341D61A9239
	for <gnats-bugs@gnats.NetBSD.org>; Wed,  3 Jun 2026 09:02:47 +0000 (UTC)
Message-Id: <20260603090245.2FDD21A923A@mollari.NetBSD.org>
Date: Wed,  3 Jun 2026 09:02:45 +0000 (UTC)
From: pasanen.tuukka@gmail.com
Reply-To: pasanen.tuukka@gmail.com
To: gnats-bugs@NetBSD.org
Subject: Make is missing SPDX license indetifiers
X-Send-Pr-Version: www-1.0
X-From4GNATS: "pasanen.tuukka@gmail.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60308
>Notify-List:    board@NetBSD.org
>Category:       standards
>Synopsis:       Make is missing SPDX license indetifiers
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    standards-manager
>State:          feedback
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Wed Jun 03 09:05:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Wed Jul 01 14:20:01 +0000 2026
>Originator:     Tuukka Pasanen
>Release:        Current
>Organization:
FreeBSD Foundation
>Environment:
>Description:
There is no SDPX license identifier information (SPDX-License-Identifier) tags in NetBSD usr.bin/make. Those tags are useful when creating SBOM or verifying licenses.
>How-To-Repeat:

>Fix:
diff --git a/usr.bin/make/arch.c b/usr.bin/make/arch.c
index 8eacd6d0628e..3a4985939b96 100644
--- a/usr.bin/make/arch.c
+++ b/usr.bin/make/arch.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: arch.c,v 1.224 2026/04/06 17:13:54 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
diff --git a/usr.bin/make/buf.c b/usr.bin/make/buf.c
index 8f4de0c3e2bc..cca54e48d7ec 100644
--- a/usr.bin/make/buf.c
+++ b/usr.bin/make/buf.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: buf.c,v 1.58 2024/04/28 15:10:19 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  * All rights reserved.
  *
diff --git a/usr.bin/make/buf.h b/usr.bin/make/buf.h
index fad36e932616..dbf207646fcf 100644
--- a/usr.bin/make/buf.h
+++ b/usr.bin/make/buf.h
@@ -1,6 +1,8 @@
 /*	$NetBSD: buf.h,v 1.50 2024/04/28 15:10:19 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  *
  * This code is derived from software contributed to Berkeley by
diff --git a/usr.bin/make/compat.c b/usr.bin/make/compat.c
index 69139b963d72..443ead455586 100644
--- a/usr.bin/make/compat.c
+++ b/usr.bin/make/compat.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: compat.c,v 1.268 2025/07/06 07:11:31 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  * All rights reserved.
  *
diff --git a/usr.bin/make/cond.c b/usr.bin/make/cond.c
index aace522dd477..eb6a84de963c 100644
--- a/usr.bin/make/cond.c
+++ b/usr.bin/make/cond.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: cond.c,v 1.379 2026/04/06 17:13:54 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  * All rights reserved.
  *
diff --git a/usr.bin/make/config.h b/usr.bin/make/config.h
index 4bba07a405e4..2f928667f9e3 100644
--- a/usr.bin/make/config.h
+++ b/usr.bin/make/config.h
@@ -1,6 +1,8 @@
 /*	$NetBSD: config.h,v 1.29 2024/02/07 06:43:02 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  *
  * This code is derived from software contributed to Berkeley by
diff --git a/usr.bin/make/dir.c b/usr.bin/make/dir.c
index df30038f3edd..0e81f00abd9f 100644
--- a/usr.bin/make/dir.c
+++ b/usr.bin/make/dir.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: dir.c,v 1.298 2026/04/06 17:13:54 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  * All rights reserved.
  *
diff --git a/usr.bin/make/dir.h b/usr.bin/make/dir.h
index 79c75598f68b..031499b97f51 100644
--- a/usr.bin/make/dir.h
+++ b/usr.bin/make/dir.h
@@ -1,6 +1,8 @@
 /*	$NetBSD: dir.h,v 1.49 2024/07/07 07:50:57 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  *
  * This code is derived from software contributed to Berkeley by
diff --git a/usr.bin/make/for.c b/usr.bin/make/for.c
index 0e3894428377..57e1872b5d5f 100644
--- a/usr.bin/make/for.c
+++ b/usr.bin/make/for.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: for.c,v 1.187 2026/04/06 17:13:54 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
  * Copyright (c) 1992, The Regents of the University of California.
  * All rights reserved.
  *
diff --git a/usr.bin/make/hash.c b/usr.bin/make/hash.c
index 663378626b89..a476c2e62909 100644
--- a/usr.bin/make/hash.c
+++ b/usr.bin/make/hash.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: hash.c,v 1.80 2025/04/22 19:28:50 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  * All rights reserved.
  *
diff --git a/usr.bin/make/hash.h b/usr.bin/make/hash.h
index d9cf708dbd91..4fc7085e5d6f 100644
--- a/usr.bin/make/hash.h
+++ b/usr.bin/make/hash.h
@@ -1,6 +1,7 @@
 /*	$NetBSD: hash.h,v 1.52 2025/04/22 19:28:50 rillig Exp $	*/
-
 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  *
  * This code is derived from software contributed to Berkeley by
diff --git a/usr.bin/make/job.c b/usr.bin/make/job.c
index 18fba6c71d90..6cc9510a236c 100644
--- a/usr.bin/make/job.c
+++ b/usr.bin/make/job.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: job.c,v 1.529 2026/04/06 17:13:54 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  * All rights reserved.
  *
diff --git a/usr.bin/make/job.h b/usr.bin/make/job.h
index d69aa3ae5a64..abe4694e69c0 100644
--- a/usr.bin/make/job.h
+++ b/usr.bin/make/job.h
@@ -1,6 +1,8 @@
 /*	$NetBSD: job.h,v 1.86 2026/02/10 18:53:34 sjg Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  * All rights reserved.
  *
diff --git a/usr.bin/make/lst.c b/usr.bin/make/lst.c
index ae57ba101845..2e1df1e0e975 100644
--- a/usr.bin/make/lst.c
+++ b/usr.bin/make/lst.c
@@ -1,6 +1,8 @@
 /* $NetBSD: lst.c,v 1.108 2024/04/27 17:33:46 rillig Exp $ */

 /*
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
diff --git a/usr.bin/make/lst.h b/usr.bin/make/lst.h
index a8cd5acd4e2c..b14fb85e0a98 100644
--- a/usr.bin/make/lst.h
+++ b/usr.bin/make/lst.h
@@ -1,6 +1,8 @@
 /*	$NetBSD: lst.h,v 1.105 2024/04/27 17:33:46 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
  * All rights reserved.
  *
diff --git a/usr.bin/make/main.c b/usr.bin/make/main.c
index e8c335832564..ddbab5520688 100644
--- a/usr.bin/make/main.c
+++ b/usr.bin/make/main.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: main.c,v 1.669 2026/04/06 17:13:54 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
diff --git a/usr.bin/make/make.c b/usr.bin/make/make.c
index 2494e3621ff9..7dd058abcb2a 100644
--- a/usr.bin/make/make.c
+++ b/usr.bin/make/make.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: make.c,v 1.275 2026/04/06 17:13:54 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
diff --git a/usr.bin/make/make.h b/usr.bin/make/make.h
index 25f2db374cf3..15aa68550775 100644
--- a/usr.bin/make/make.h
+++ b/usr.bin/make/make.h
@@ -1,6 +1,8 @@
 /*	$NetBSD: make.h,v 1.366 2026/04/06 17:13:54 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
diff --git a/usr.bin/make/make_malloc.c b/usr.bin/make/make_malloc.c
index 86e339de5dd2..99e8c3839cf1 100644
--- a/usr.bin/make/make_malloc.c
+++ b/usr.bin/make/make_malloc.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: make_malloc.c,v 1.28 2025/06/29 09:37:58 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
  * Copyright (c) 2009 The NetBSD Foundation, Inc.
  * All rights reserved.
  *
diff --git a/usr.bin/make/make_malloc.h b/usr.bin/make/make_malloc.h
index b1cfe8487837..789ae2105392 100644
--- a/usr.bin/make/make_malloc.h
+++ b/usr.bin/make/make_malloc.h
@@ -1,6 +1,8 @@
 /*	$NetBSD: make_malloc.h,v 1.18 2021/12/15 11:01:39 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
  * Copyright (c) 2009 The NetBSD Foundation, Inc.
  * All rights reserved.
  *
diff --git a/usr.bin/make/meta.c b/usr.bin/make/meta.c
index 048af06457a1..d5a8787f795c 100644
--- a/usr.bin/make/meta.c
+++ b/usr.bin/make/meta.c
@@ -6,6 +6,8 @@
  * --sjg
  */
 /*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
  * Copyright (c) 2009-2016, Juniper Networks, Inc.
  * Portions Copyright (c) 2009, John Birrell.
  *
diff --git a/usr.bin/make/meta.h b/usr.bin/make/meta.h
index 4796cdeb3c01..78a9bb2ca6a4 100644
--- a/usr.bin/make/meta.h
+++ b/usr.bin/make/meta.h
@@ -4,6 +4,8 @@
  * Things needed for 'meta' mode.
  */
 /*
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
  * Copyright (c) 2009-2010, Juniper Networks, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/usr.bin/make/metachar.c b/usr.bin/make/metachar.c
index e99630602e3d..9934e1d99bf1 100644
--- a/usr.bin/make/metachar.c
+++ b/usr.bin/make/metachar.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: metachar.c,v 1.10 2021/06/21 18:54:41 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
  * All rights reserved.
  *
diff --git a/usr.bin/make/metachar.h b/usr.bin/make/metachar.h
index 11711e876017..4ca08f02a71f 100644
--- a/usr.bin/make/metachar.h
+++ b/usr.bin/make/metachar.h
@@ -1,6 +1,8 @@
 /*	$NetBSD: metachar.h,v 1.20 2022/01/08 11:04:13 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
  * Copyright (c) 2015 The NetBSD Foundation, Inc.
  * All rights reserved.
  *
diff --git a/usr.bin/make/parse.c b/usr.bin/make/parse.c
index 9807fc46b1b4..b06599336a1c 100644
--- a/usr.bin/make/parse.c
+++ b/usr.bin/make/parse.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: parse.c,v 1.756 2026/04/06 17:13:55 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
diff --git a/usr.bin/make/pathnames.h b/usr.bin/make/pathnames.h
index 3c7000ca1030..e302afec8d1a 100644
--- a/usr.bin/make/pathnames.h
+++ b/usr.bin/make/pathnames.h
@@ -1,6 +1,8 @@
 /*	$NetBSD: pathnames.h,v 1.18 2020/11/29 09:27:40 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
  * Copyright (c) 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
diff --git a/usr.bin/make/str.c b/usr.bin/make/str.c
index e66cdbc8682e..6e46d622b013 100644
--- a/usr.bin/make/str.c
+++ b/usr.bin/make/str.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: str.c,v 1.106 2025/06/28 21:09:43 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
diff --git a/usr.bin/make/str.h b/usr.bin/make/str.h
index 1122fc727f77..6687b8261253 100644
--- a/usr.bin/make/str.h
+++ b/usr.bin/make/str.h
@@ -1,6 +1,8 @@
 /*	$NetBSD: str.h,v 1.21 2026/01/03 19:57:38 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
  * Copyright (c) 2021 The NetBSD Foundation, Inc.
  * All rights reserved.
  *
diff --git a/usr.bin/make/suff.c b/usr.bin/make/suff.c
index a34fa4296041..6b5121f739e2 100644
--- a/usr.bin/make/suff.c
+++ b/usr.bin/make/suff.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: suff.c,v 1.385 2026/01/03 19:57:38 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
diff --git a/usr.bin/make/targ.c b/usr.bin/make/targ.c
index 576d7dda8eed..c4a4906d2e22 100644
--- a/usr.bin/make/targ.c
+++ b/usr.bin/make/targ.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: targ.c,v 1.185 2025/05/07 19:49:00 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *
diff --git a/usr.bin/make/trace.c b/usr.bin/make/trace.c
index a85053f62ce8..ba5af8d4d351 100644
--- a/usr.bin/make/trace.c
+++ b/usr.bin/make/trace.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: trace.c,v 1.35 2025/05/09 18:42:56 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
  * Copyright (c) 2000 The NetBSD Foundation, Inc.
  * All rights reserved.
  *
diff --git a/usr.bin/make/trace.h b/usr.bin/make/trace.h
index 063fb26ab08c..ea8fc48b2961 100644
--- a/usr.bin/make/trace.h
+++ b/usr.bin/make/trace.h
@@ -1,6 +1,8 @@
 /*	$NetBSD: trace.h,v 1.6 2021/01/19 20:51:46 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
  * Copyright (c) 2000 The NetBSD Foundation, Inc.
  * All rights reserved.
  *
diff --git a/usr.bin/make/var.c b/usr.bin/make/var.c
index 4bb52f0aa0b7..19c18b79ebfc 100644
--- a/usr.bin/make/var.c
+++ b/usr.bin/make/var.c
@@ -1,6 +1,8 @@
 /*	$NetBSD: var.c,v 1.1180 2026/04/06 17:13:55 rillig Exp $	*/

 /*
+ * SPDX-License-Identifier: BSD-4-Clause-UC AND BSD-3-Clause
+ *
  * Copyright (c) 1988, 1989, 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
  *

>Release-Note:

>Audit-Trail:
From: Leonardo Taccari <leot@NetBSD.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: standards/60308: Make is missing SPDX license indetifiers
Date: Wed, 03 Jun 2026 11:18:33 +0200

 Please also see PR toolchain/60287.

 (Leaving it as cross-reference.)

State-Changed-From-To: open->feedback
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Tue, 09 Jun 2026 15:48:41 +0000
State-Changed-Why:
Thanks for the patch.  I'm a little confused about the goal, though.
You filed this under `standards/'.  Can you cite the current standard
that is applicable here?

I went looking at what I thought was the current applicable standard,
the SPDX spec at https://spdx.dev, but the latest version 3.0.1 has
completely removed all references to the `SPDX-License-Identifier' tags
in source code.  No syntax defined, no recommendations to use them in
source code.  It was all removed in this commit two years ago:

> commit 2acae715e971f8b84da8ea85f93849bdcf89c5ab
> Author: Alexios Zavras <github@zvr.gr>
> Date:   Sun Aug 11 17:59:07 2024 +0200
> 
>     Fixes the annexes
> 
>     Signed-off-by: Alexios Zavras <github@zvr.gr>
> ...
>  ...using-SPDX-short-identifiers-in-source-files.md |  73 --

https://github.com/spdx/spdx-spec/commit/2acae715e971f8b84da8ea85f93849bdcf89c5ab

I can't tell from the very terse commit message whether that was just
an editorial mistake or a deliberate decision to remove all that (no
idea where to find minutes of any deliberation), but since nobody's put
it back in two years I have to assume it was deliberate.

There's an ISO standard, ISO/IEC 5962:2021, based on SPDX spec 2.2(?),
which still has Annex E `Using SPDX license list short identifiers in
source files' defining the `SPDX-License-Identifier' syntax.  But it's
apparently being updated to SPDX spec 3.0, according to
<https://www.iso.org/standard/81870.html>, so presumably it too will
remove that.

Also the web site at https://spdx.dev is full of 404 links, including
links that were baked into the ISO standard document itself, like
<https://spdx.org/spdx-license-list/matching-guidelines>,
<https://spdx.org/spdx-license-list/license-list-overview>, and
<https://spdx.dev/ids-where>.

So I'm not at all confident in the long-term value or seriousness of
this SPDX business.  And I have had plenty of personal experience
already wasting time based on wrong SPDX-License-Identifier tags that
were automatically applied across Linux.  We're open to the proposition
of adding these tags if they are actually reliable and useful, but the
track record of SPDX as a standard is not very convincing right now,
and we may need more convincing than just the offer of patches.


From: Tuukka Pasanen <pasanen.tuukka@gmail.com>
To: gnats-bugs@netbsd.org, standards-manager@netbsd.org,
 netbsd-bugs@netbsd.org, gnats-admin@netbsd.org, riastradh@NetBSD.org
Cc: board@NetBSD.org
Subject: Re: standards/60308 (Make is missing SPDX license indetifiers)
Date: Wed, 1 Jul 2026 15:55:32 +0300

 > I went looking at what I thought was the current applicable standard,
 > the SPDX spec athttps://spdx.dev, but the latest version 3.0.1 has
 > completely removed all references to the `SPDX-License-Identifier' tags
 > in source code.
 It seems there have been many questions about removing the
 SPDX-License-Identifier from the specifications in Annex H.

 As mentioned here https://github.com/spdx/spdx-spec/issues/1393,
 it was not part of the official specification. Identifiers were
 previously in the appendix, and efforts are underway to potentially
 reinstate them in some form. However, the specific details of how
 they may be reintegrated into the spec remain unclear.

 Another relevant discussion https://github.com/spdx/spdx-spec/issues/1261
 provides additional context on the removal of these tags.

 The current usage documentation can be found here
 https://github.com/spdx/using/blob/main/docs/license-id-in-source.md.

 Moreover, the REUSE Software project (https://reuse.software/spec-3.3/)
 actively endorses the use of these tags, offering a detailed rationale
 for their adoption. REUSE is an initiative by the Free Software
 Foundation Europe (FSFE).

 Additionally, CycloneDX SBOM also incorporates SPDX license IDs,
 suggesting that they will remain a widely adopted industry standard
 both now and in the future.
 > So I'm not at all confident in the long-term value or seriousness of
 > this SPDX business.  And I have had plenty of personal experience
 > already wasting time based on wrong SPDX-License-Identifier tags that
 > were automatically applied across Linux.  We're open to the proposition
 > of adding these tags if they are actually reliable and useful, but the
 > track record of SPDX as a standard is not very convincing right now,
 > and we may need more convincing than just the offer of patches.
 >
 It is true that in my path I have encountered several incorrect tags,
 but most have been  them are correct. When they are correct and
 maintained as part of the licensing workflow, they are very useful.

 One can check against them to ensure that the wording in the license
 is correct and consistent with, for example, the BSD-2-Clause license.

 Having read too many licenses during this year. I can confidently say 
 that it
 makes a significant difference whether only the license text is provided
 or whether an SPDX identifier is also included. Even with a license
 text provided, you still need to use a tool to parse it to ensure it
 does not contain any unexpected wording or deviations from the standard.
 With an SPDX-License-Identifier, you can quickly verify that the license
 text matches the expected wording (e.g., BSD-2-Clause). If it does not
 match, as in this example: 
 https://github.com/spdx/license-list-XML/issues/3007
 I need to start figuring from the scratch

 Additionally, there are many licenses with nearly identical wording but
 minor variations. These can also be identified with the right tools
 and a bit of reading. However, having an extra line for the
 SPDX-License-Identifier in the source file does not seem like a burden,
 especially since license can take up most of the file's content in some
 cases.

 Given that NetBSD has been around for a long time and includes a lot
 of third-party software (which is already well-aligned with licensing),
 it would be easier to maintain these licenses if all projects provided
 SPDX-License-Identifier data?

 My humble opinion—though it is only mine and not necessarily shared
 by others—is that SPDX-License-Identifiers are not going away. There
 is no downside to having them; downstream projects can easily check
 NetBSD's licensing and maintain SBOM if the like.

 If the NetBSD community decides to ignore them, that is also a valid and
 correct decision. I have a different perspective and experience with these
 tags, but I respect that others may see things differently.

 You are free to close this issue if you choose not to implement them.

From: Taylor R Campbell <riastradh@NetBSD.org>
To: Tuukka Pasanen <pasanen.tuukka@gmail.com>
Cc: gnats-bugs@netbsd.org, standards-manager@netbsd.org,
	netbsd-bugs@netbsd.org, gnats-admin@netbsd.org, board@NetBSD.org
Subject: Re: standards/60308 (Make is missing SPDX license indetifiers)
Date: Wed, 1 Jul 2026 14:17:44 +0000

 This is a multi-part message in MIME format.
 --=_3GH/d8a4GiEuk6sY511/abKYWvHzDwXu

 > Date: Wed, 1 Jul 2026 15:55:32 +0300
 > From: Tuukka Pasanen <pasanen.tuukka@gmail.com>
 > 
 > It seems there have been many questions about removing the
 > SPDX-License-Identifier from the specifications in Annex H.
 > 
 > As mentioned here https://github.com/spdx/spdx-spec/issues/1393,
 > it was not part of the official specification. Identifiers were
 > previously in the appendix, and efforts are underway to potentially
 > reinstate them in some form. However, the specific details of how
 > they may be reintegrated into the spec remain unclear.
 > 
 > Another relevant discussion https://github.com/spdx/spdx-spec/issues/1261
 > provides additional context on the removal of these tags.

 Thanks, but I'm afraid this is adding confusion rather than context.
 For example, someone who appears to be an editor of the SPDX
 specification, github.com/bact, said:

 	It is an interesting question if we can use the license short
 	identifier as an spdxId of a license object and expect the
 	SPDX 3 consumer to interpret it the way SPDX 2 does.

 Such doubts _from among the SPDX editors_ are really not helping to
 inspire confidence in the reliability of the standard!

 > The current usage documentation can be found here
 > https://github.com/spdx/using/blob/main/docs/license-id-in-source.md.
 > 
 > Moreover, the REUSE Software project (https://reuse.software/spec-3.3/)
 > actively endorses the use of these tags, offering a detailed rationale
 > for their adoption. REUSE is an initiative by the Free Software
 > Foundation Europe (FSFE).

 I checked the REUSE Spec 3.3 and it is defined in terms of the
 now-deleted part of the SPDX 2.3 spec, Annex H.  So I would guess that
 REUSE Spec 3.4 or whatever will have to do something different.

 Does FSFE intend to become the normative authority for this syntax?

 Given that there's been an open question about this since October,
 with zero responses from anyone at FSFE, I'm not even sure this is on
 the radar of anyone responsible:

 https://github.com/fsfe/reuse-website/issues/120

 I'm just not at all confident in the viability of the SPDX
 organization (Linux Foundation? working group?) as a standards body --
 they've taken the specific thing you're asking for out of the
 standard, published an ISO standard full of 404 broken links to their
 own web site, and told people asking how to update from 2.x to 3.x
 that the same artefacts might not be interpreted the same way.

 > Having read too many licenses during this year. I can confidently say 
 > that it
 > makes a significant difference whether only the license text is provided
 > or whether an SPDX identifier is also included. Even with a license
 > text provided, you still need to use a tool to parse it to ensure it
 > does not contain any unexpected wording or deviations from the standard.
 > 
 > With an SPDX-License-Identifier, you can quickly verify that the license
 > text matches the expected wording (e.g., BSD-2-Clause). If it does not
 > match, as in this example: 
 > https://github.com/spdx/license-list-XML/issues/3007
 > I need to start figuring from the scratch

 Sure, I understand the appeal of quickly summarizing this stuff, which
 is why we have, e.g., LICENSE= tags in pkgsrc which, if specified,
 have to match the exact text -- modulo naming of copyright holders --
 of what is recorded in pkgsrc/licenses/.  (This system predated SPDX.)

 I also understand that bespoke systems like pkgsrc's are less
 appealing than industry-wide standards bodies.  If there were a
 _reliable_ standards body here, that might be an improvement.

 But the key point is that the standards body has to inspire confidence
 that it will be reliable, and the SPDX organization is not doing that.

 > Additionally, there are many licenses with nearly identical wording but
 > minor variations. These can also be identified with the right tools
 > and a bit of reading. However, having an extra line for the
 > SPDX-License-Identifier in the source file does not seem like a burden,
 > especially since license can take up most of the file's content in some
 > cases.

 My concern is that if we add these, we'll have two sources of truth
 that might get out of sync, and while one of them is the plain
 language, the other is reference to an outside standard by an
 unreliable standards body.  So it will be necessary to use wdiff
 anyway to work around the unreliability.


 I went to draft a policy last month but I stopped because the
 authority I wanted to cite for the whole point of the policy --
 SPDX-License-Identifier tags in source code -- seems to be unreliable.
 I'm open to the proposition that SPDX will clean up their act and
 become a useful citation in the future, but that has to be
 demonstrated; until then, a sloppy standard doesn't strike me as much
 better than checking wdiff.

 --=_3GH/d8a4GiEuk6sY511/abKYWvHzDwXu
 Content-Type: text/plain; charset="ISO-8859-1"; name="spdx-tags"
 Content-Transfer-Encoding: quoted-printable
 Content-Disposition: attachment; filename="spdx-tags"

 # [DRAFT] Policy on SPDX-License-Identifier tags

 XXX Apparently SPDX-License-Identifier tags have been removed from SPDX
 XXX 3.0.1 and I have no idea why.  For now this document cites SPDX 2.2
 XXX since that is the one that was codified as ISO/IEC 5962:2021.
 XXX
 XXX The spdx.dev web site is also currently full of 404 links, which is
 XXX why I added a requirement to provide Internet Archive links too.

 https://rt.netbsd.org/Ticket/Display.html?id=3D414980

 1. SPDX-License-Identifier tags MAY be added following the syntax of
    [SPDX-2.2], Appendix V "Using SPDX short identifiers in Source
    Files", and SHOULD go in the same comment block as the license text.

 2. Anyone adding SPDX-License-Identifier tags MUST NOT remove existing
    copyright notice (e.g., "Copyright (c) 2026 The NetBSD Foundation,
    Inc.") or the copying terms (e.g., "Redistriution and use in source
    code and binary forms, with or without modification, are permitted
    provided...").  (Removing the text would violate the copying terms.)

 3. SPDX-License-Identifier tags may be added ONLY where they are
    unambiguously correct.  Anyone who adds them MUST link to the
    canonical SPDX text at [SPDX-LIST] together with an Internet Archive
    link (https://web.archive.org/) and put evidence in the commit
    message that they have personally verified the full text matches the
    canonical SPDX text with wdiff(1) from pkgsrc textproc/wdiff or an
    equivalent word diff tool.  If there is any question, don't do it.

 4. If any discrepancy arises, the existing text overrides, and
    SPDX-License-Identifier tags MAY be removed by anyone with a commit
    message explaining the discrepancy.  The removal MUST NOT be then
    reverted without further public discussion or appeal to board@.

 5. Except for code imported from external sources (such as external/ or
    code outside external/ shared with other BSDs), new code MUST still
    have license text, not just an SPDX-License-Identifier tag.  New
    code SHOULD use localsrc/admin/copyright/templates/*.

 References:

 [SPDX-2.2] _Software Data Package Exchange (SPDX)_, The Linux
 Foundation, Specification Version 2.2.
 https://spdx.dev/wp-content/uploads/sites/31/2023/09/SPDX-specification-2-2=
 .pdf
 https://web.archive.org/web/20260418031142/https://spdx.dev/wp-content/uplo=
 ads/sites/31/2023/09/SPDX-specification-2-2.pdf

 [SPDX-LIST] _SPDX License List_, The Linux Foundation
 https://spdx.org/licenses/

 --=_3GH/d8a4GiEuk6sY511/abKYWvHzDwXu--

>Unformatted:

Home	PR Database Search