This commit fixes two issues:
1. A Fedora downstream one, since 11.6
(https://jira.mariadb.org/browse/MDEV-19210), MariaDB upstream use
environment files in their systemd service files to load environment
variables and pass the arguments '--wsrep-new-cluster' and
'--wsrep_start_position' when starting the daemon. The Fedora downstream
service file has been missing the variable for '--wsrep_start_position' since
it was added into MariaDB upstream in 10.1.15
(a6816995ee).
And this Fedora downstream commit adds those missing environment
variables and their arguments into the service files. After I tested
it, the recovery of failed nodes works.
2. A MariaDB upstream one, where the temporary 'wsrep' files have
incorrect SELinux policies set ('mysqld-db-t' instead of
'mysqld-run-t') because of their parent directories. This occurs
because their location is tied to the location of 'mysql.sock' in the
CMake files. As RPMs get built to have 'mysql.sock' in
'/var/lib/mysql' as opposed to inside '/run' like Debian or Arch, the
temporary files for the service could not actually be read by the
service during start-up, resulting in failure as no primary node was
ever created. Discussion with the MariaDB upstream
(https://jira.mariadb.org/browse/MDEV-37726) resulted in a patch that
separates the location of the socket file and the temporary
environment files into two CMake flags and allows for more flexible
building of the package.
Resolves: RHEL-142554
MariaDB upstream bundles pcre2 version 10.45 in 10.11.14 and .15,
which is not in RHEL9 (has pcre2 10.40) or RHEL10 (has pcre2 10.44).
Therefore, we need to bundle it in mariadb. Unfortunately, 10.45 has
CVE-2025-58050 (critical), so I bumped it to 10.46 which should only
contain the fix and no extra features.
In downstream commit 1926e2685d884ba468783417f77b0c4b57882f84,
we reverted from using unenforced UID/GIDs to enforced ones to 27.
In order to do this, I need to install the sysusers.d config
file instead of the upstream MariaDB one. This was already added
in Fedora commit ee5c679bb34335cab8b9878696f0d8604223f91f
that never got into RHEL.
After switching to a container image with bootc switch, systemd failed to start
MariaDB because required runtime directories were missing or had wrong permissions.
Adding tmpfiles entries with correct ownership ensures systemd creates the
necessary directories at boot and gives them correct permissions, allowing the
MariaDB daemon to start.
"In a container build, you can write to '/var'. However, this will have a semantic
similar to a Dockerfile VOLUME instruction; the content from the container image
is only copied at initial install time. Any subsequent system updates will not
by default see new changes.
It's recommended instead to use e.g. systemd tmpfiles.d as a way to ensure that
newly added state "reconciles" across upgrades as desired."
https://docs.fedoraproject.org/en-US/bootc/filesystem/#_filesystem_bind_mount_var
This covers all the files in /var sicne we only ship these as can be seen here:
find | grep /var/
./mariadb11.8-server-11.8.2-3.fc43.x86_64.rpm/var/lib
./mariadb11.8-server-11.8.2-3.fc43.x86_64.rpm/var/lib/mysql
./mariadb11.8-server-11.8.2-3.fc43.x86_64.rpm/var/log
./mariadb11.8-server-11.8.2-3.fc43.x86_64.rpm/var/log/mariadb
The '/usr' directory is not persistent therefore this change does not affect it
and the '/etc' directory is merged in a different way and also not under the
'mysql:mysql' user.
Resolves: RHEL-119790
Related PR for `setup` RPM: https://src.fedoraproject.org/rpms/setup/pull-request/30
Reverts commit: 3577147
The MariaDB and MySQL sysusers.d files has to use soft static allocation in order to correctly handle the MariaDB PAM v2 plugin which utilizes setuid-to-root binary "/usr/lib64/mariadb/plugin/auth_pam_tool_dir/auth_pam_tool".
The package conflicts between MariaDB and MySQL packages are only set against the un-versioned names.
(the un-versioned names are only provided by the distribution default version)
The conflicts has to be extended to cover the '-any' virtually provided names,
which are provided by all versions of the versioned packages.
rpmdeplint error:
mariadb-rocksdb-engine-3:10.11.13-8.fc43.x86_64 provides /usr/bin/sst_dump
which is also provided by rocksdb-tools-10.1.3-1.fc43.x86_64
I discovered that the second call of "cmake -LAH" further changes the cache.
That was definitelly unintended. Applying "-N" to operate in "cache read-only" mode.
That however broke the build, since the compilation flags are set up during the "cmake" call.
Up until now, the code flow was:
1) %cmake ...
2) <adjusting compilation flags>
3) cmake -LAH
And since the "cmake -LAH" without the "-N" argument changed the cache, it actually applied all the
adjustements in the second step. When switched to "-N" mode, the flags failed to be applied, and the build broke.
What we actually need to do is to:
1) initialize the compilation flags with the distribution default values
2) adjust the compilation flags
3) %cmake ...
3) cmake -N -LAH
This way the compilation flags are correctly applied during the first CMake call,
and the CMake cache remains unchanged during the second CMake call.
--
The '%cmake' macro contains the '%{set_build_flags}' macro at it's beginning
https://src.fedoraproject.org/rpms/cmake/blob/b3bf0e/f/macros.cmake.in#_20
and the '%{set_build_flags}' macro is constructed with the:
CFLAGS="${CFLAGS:-...}
syntax, which translates to "Use the content of the $CFLAGS variable. If empty, use the following default value: '...' ".
So we first need to call the '%{set_build_flags}' macro separately, so we apply the default values. Then we append to them.
And then the '%cmake' macro calls the '%{set_build_flags}' macro that finds the existing values, and uses them, instead of the default ones.
Resolves: RHEL-93751
- we were missing the CMake control variable
- I also discovered that the build of the gssapi client plugin -
which we remove, since it is shipped as a part of the
'mariadb-connector-c' package in Fedora,
is somehow also controlled bz the build of the hashicorp plugin.
Need further examination.
so that the user can access it using the 'mysql.service' and 'mysqld.service'
names even before the first call of 'systemctl enable mariadb.service' which
creates the symlinks.
This has been consulted with the systemd team and approved by them.
The update is acutally a mirror of what MariaDB upstream is doing in their RPMs.
Lately I experienced a great problem with the MTR port calculations.
Most (but not all) of the testsuite runs ended immediatelly with:
| mysql-test-run: *** ERROR: MTR_BUILD_THREAD number results in a port outside 5001 - 32767 (*****)
where the:
| (*****)
at the end is a string that contains the numbers used for the calculations.
The numbers were totally off, without any good reason why the calculation work that way.
I've reached MariaDB upstream and this patch was proposed in the ZULIP thread:
https://mariadb.zulipchat.com/#narrow/stream/118759-general/topic/MTR.20--port-base
The upstream is hesitatnt to merge it righ away, but as far as I've tested,
it works well for me and what's most important, it unblocks the package builds.
--
Related: RHEL-78302
Here follow the records of my deeds regarding the switch to the SPDX:
\# Clone the correct package
fedpkg clone mariadb10.11
\# Expand the sources and apply the SPECfile %prep section (in which e.g. unused bundled code is removed)
fedpkg prep
Now I used the 'askalono' tool on top of the resulting directory
\# I began by analyzing only the errors
askalono crawl mariadb-10.11.8/ 1>/dev/null
=========== =========== ===========
=========== =========== ===========
| mariadb-10.11.8/storage/rocksdb/rocksdb/java/jmh/LICENSE-HEADER.txt
| Error: Confidence threshold not high enough for any known license
The text says the code is licensed under both 'GPL-2.0-only' and 'Apache-2.0'
and points to the specific files in the directory tree with the full text of these licenses.
There is also file:
| mariadb-10.11.8/storage/rocksdb/rocksdb/README.md
which says:
"RocksDB is dual-licensed under both the GPLv2 (found in the COPYING file in the root directory) and Apache 2.0 License (found in the LICENSE.Apache file in the root directory).
You may select, at your option, one of the above-listed licenses."
So the correct SPDX identifier should be: '( GPL-2.0-only OR Apache-2.0 )'
There are about 1200 files licensed this way, as can bee seen with this command:
grep -i apache -r mariadb-10.11.8
All of them are from RocksDB SE, but 3:
mariadb-10.11.8/mysys/crc32/crc32c.cc:// COPYING file in the root directory) and Apache 2.0 License
mariadb-10.11.8/mysys/crc32/crc32c.cc:// (found in the LICENSE.Apache file in the root directory).
mariadb-10.11.8/mysys/crc32/crc_ppc64.h: * b) the Apache License, Version 2.0
mariadb-10.11.8/mysys/crc32/crc32c_ppc.h:// COPYING file in the root directory) and Apache 2.0 License
mariadb-10.11.8/mysys/crc32/crc32c_ppc.h:// (found in the LICENSE.Apache file in the root directory).
All of the files says:
// This source code is licensed under both the GPLv2 (found in the
// COPYING file in the root directory) and Apache 2.0 License
// (found in the LICENSE.Apache file in the root directory).
But the "mariadb-10.11.8/mysys/crc32/crc_ppc64.h"
* This program is free software; you can redistribute it and/or
* modify it under the terms of either:
*
* a) the GNU General Public License as published by the Free Software
* Foundation; either version 2 of the License, or (at your option)
* any later version, or
* b) the Apache License, Version 2.0
So the SPDX identified for this one particular file is '( GPL-2.0-or-later OR Apache-2.0 )'
Making the final SPDX identifier regarding the Apache licenses as follows: '( GPL-2.0-only OR Apache-2.0 ) AND ( GPL-2.0-or-later OR Apache-2.0 )'
=========== =========== ===========
=========== =========== ===========
\# Then I by analyzed everything but errors:
askalono crawl mariadb-10.11.8/ 2>/dev/null
| mariadb-10.11.8/vio/docs/COPYING.openssl
| License: OpenSSL (original text)
| Score: 0.913
Correct.
Note: the 'OpenSSL' license is actually a combination of 'OpenSSL-standalone' and 'SSLeay-standalone'
so the shorter texts would match to, but in this case, this is a full 'OpenSSL' license:
https://spdx.org/licenses/OpenSSL.html
=========== =========== ===========
=========== =========== ===========
GPL & LGPL
There is a difference between "GPL-2.0-only" and "GPL-2.0-or-later"
https://spdx.org/licenses/GPL-2.0-only.htmlhttps://spdx.org/licenses/GPL-2.0-or-later.html
I understood that the license text is identical (I've ran 'diff' on top of them to verify)
and the difference is decided by the license header present in the files containing the code itself.
This "*-only" and "*-or-later" differenciation simmilar in other versions of GPL and LGLP
Now meet this little cute monstrosity:
\# This command is supposed to:
\# - find all occurrences of the string "Public License"
\# - prefixed by "GNU", "Lesser", "Library", "General", each word is optional (to match both GPL and LGPL and all variants of how people write them)
\# - while every word can have any number of any white characters - including newlines - between them (to match text wrapped between lines)
\# - all of that followed by string "version" (to only match text mentioning the specific version)
\# - with any characters between the first part and the "version" string
\# - followed by a digit (to exclude any result not talking about a concrete version specifically, e.g. text around string "from time to time" in the GPL licenses)
\# - match 3 more characters (so we catch the whole version number)
\# - but the "version" string and number must occur no later than any dot "." or double newline (to only match text inside the license texts or license headers, but not code)
\# Once found,
\# - and match everything until dot or double newline (for further parsing of the strings "or later" etc)
\# - replace any newline with space (" "), so the whole above match (as well s everything else) is put on a single line
\# - replace string "mariadb-10.11.8/" with "NEWLINEmariadb-10.11.8/", so each result is on a separate line
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g'
This command gives 3685 results (I'll be measuring the number of results with | wc -l through this whole text),
and I hope it matches all possible variants of GPL and LGPL.
We are going to further parse it to divide the results for the separate licenses.
=========== =========== ===========
=========== =========== ===========
The 'askalono crawl' tool found number of occurrences of GPL and LGPL licenses, but it does not differentiate between "*-only" and "*-or-later" variants.
| mariadb-10.11.8/wsrep-lib/COPYING
| License: GPL-3.0-only (license header)
| Score: 0.825
This file actually talks about GPLv2, not v3.
| mariadb-10.11.8/wsrep-lib/LICENSE
| License: GPL-2.0-only (original text)
| Score: 0.988
| mariadb-10.11.8/scripts/sys_schema/COPYING
| License: GPL-2.0-only (original text)
| Score: 0.988
| mariadb-10.11.8/scripts/sys_schema/LICENSE
| License: GPL-2.0-only (license header)
| Score: 0.957
| mariadb-10.11.8/plugin/server_audit/COPYING
| License: GPL-2.0-only (original text)
| Score: 0.986
| mariadb-10.11.8/plugin/test_sql_service/COPYING
| License: GPL-2.0-only (original text)
| Score: 0.986
| mariadb-10.11.8/extra/readline/COPYING
| License: GPL-2.0-only (original text)
| Score: 0.984
| mariadb-10.11.8/storage/rocksdb/rocksdb/COPYING
| License: GPL-2.0-only (original text)
| Score: 0.988
| mariadb-10.11.8/COPYING
| License: GPL-2.0-only (original text)
| Score: 0.986
These are all GPLv2.
| mariadb-10.11.8/libmariadb/COPYING.LIB
| License: LGPL-2.1-only (original text)
| Score: 0.998
| mariadb-10.11.8/storage/mroonga/vendor/groonga/vendor/plugins/groonga-normalizer-mysql/doc/text/lgpl-2.0.txt
| License: LGPL-2.0-only (original text)
| Score: 0.996
| mariadb-10.11.8/storage/mroonga/vendor/groonga/COPYING
| License: LGPL-2.1-only (original text)
| Score: 0.997
| mariadb-10.11.8/storage/mroonga/COPYING
| License: LGPL-2.1-only (original text)
| Score: 0.997
| mariadb-10.11.8/storage/maria/libmarias3/docs/introduction/license.rst
| License: LGPL-2.1-only (original text)
| Score: 0.980
| mariadb-10.11.8/storage/maria/libmarias3/LICENSE
| License: LGPL-2.1-only (original text)
| Score: 0.998
=========== =========== ===========
=========== =========== ===========
However to make sure which licenses appears in the source code tree, we have to GREP each variant:
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 3"
retuns 16 results, from which:
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 3" | grep -i --binary-files=text -e " lesser" -e " library"
0 is LGPL
and
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 3" | grep -v -i --binary-files=text -e " lesser" -e " library"
16 is GPL
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 3" | grep -i --binary-files=text -e "later" -e " or"
16 results "GPL-3.0-or-later"
and
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 3" | grep -v -i --binary-files=text -e "later" -e " or"
0 results "GPL-3.0-only"
=========== =========== ===========
=========== =========== ===========
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2"
retuns 3669 results, from which:
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library"
577 is LGPL
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2" | grep -v -i --binary-files=text -e " lesser" -e " library"
3092 is GPL
=========== =========== ===========
=========== =========== ===========
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text -e "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.0"
120 is LGPL 2.0
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.0" | grep -i --binary-files=text -e "later" -e " or "
77 is "LGPL-2.0-or-later"
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.0" | grep -v -i --binary-files=text -e "later" -e " or "
43 is "LGPL-2.0-only"
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2\.[^0]"
457 is LGPL 2.1
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2\.[^0]" | grep -i --binary-files=text -e "later" -e " or "
132 is "LGPL-2.1-or-later"
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2" | grep -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2\.[^0]" | grep -v -i --binary-files=text -e "later" -e " or "
325 is "LGPL-2.1-only"
=========== =========== ===========
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2" | grep -v -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.[0\s]" -e "version 2.\s"
3091 is GPL 2.0
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2" | grep -v -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.[0\s]" -e "version 2.\s" | grep -i --binary-files=text -e "later" -e " or "
229 is "GPL-2.0-or-later"
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2" | grep -v -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2[ ,;\<]" -e "version 2.[0\s]" -e "version 2.\s" | grep -v -i --binary-files=text -e "later" -e " or "
2862 is "GPL-2.0-only"
grep -Pzoi '(?s)((GNU\s*)?(Lesser\s*)?(Library\s*)?(General\s*)?Public\s*License)(?:(?!\.\n|\n\n).)*?version\s*\d[\s\S]{0,3}(?:(?!\.\n|\n\n).)*' -r mariadb-10.11.8/ \
| sed ':a;N;$!ba;s/\n/ /g' | sed 's|mariadb-10.11.8/|\nmariadb-10.11.8/|g' \
| grep -i --binary-files=text "version 2" | grep -v -i --binary-files=text -e " lesser" -e " library" | grep -i --binary-files=text -e "version 2\.[123456789]"
1 GPL 2.1
weird ... GPL 2.1 doesn't exists, only LGPL 2.1 does
and by examining the file, it's a false positive, as the writer switched the words in way unexpected to me: "Lesser GNU General Public License, Version 2.1"
=========== =========== ===========
=========== =========== ===========
| mariadb-10.11.8/plugin/handler_socket/libhsclient/COPYRIGHT.txt
| License: BSD-3-Clause-HP (original text)
| Score: 0.919
| mariadb-10.11.8/plugin/handler_socket/perl-Net-HandlerSocket/COPYRIGHT.txt
| License: BSD-3-Clause-HP (original text)
| Score: 0.919
| mariadb-10.11.8/plugin/handler_socket/handlersocket/COPYRIGHT.txt
| License: BSD-3-Clause-HP (original text)
| Score: 0.919
| mariadb-10.11.8/libmariadb/cmake/COPYING-CMAKE-SCRIPTS
| License: BSD-3-Clause-HP (original text)
| Score: 0.937
| mariadb-10.11.8/storage/innobase/COPYING.Google
| License: BSD-3-Clause (original text)
| Score: 0.917
| mariadb-10.11.8/storage/innobase/COPYING.Percona
| License: BSD-3-Clause (original text)
| Score: 0.917
| mariadb-10.11.8/storage/rocksdb/rocksdb/LICENSE.leveldb
| License: BSD-3-Clause (original text)
| Score: 0.953
BSD-3-Clause-HP:
https://spdx.org/licenses/BSD-3-Clause-HP.html
This license is almost identical to BSD-3-Clause, but adds "patent infringement" to the disclaimer.
However after manual review, none of the licenses listed above contains the word "patent" (case insensitive)
and all seems to be just the basic "BSD-3-Clause"
=========== =========== ===========
=========== =========== ===========
| mariadb-10.11.8/storage/rocksdb/rocksdb/LICENSE.Apache
| License: Apache-2.0 (original text)
| Score: 1.000
OK
=========== =========== ===========
=========== =========== ===========
| mariadb-10.11.8/storage/rocksdb/rocksdb/docs/LICENSE-DOCUMENTATION
| License: CC-BY-4.0 (original text)
| Score: 0.995
OK
=========== =========== ===========
=========== =========== ===========
Furthermore, there are several occurrences of the BISON exception.
Please note that the SPDX upstream does not have a specific indentifier for it,
so we are using identifiers defined by Fedora project:
https://docs.fedoraproject.org/en-US/legal/allowed-licenses/
grep -i -e "of Bison" -r mariadb-10.11.9
All occurences are tied to GPL-3.0-or-later, so the correct resulting identifier is:
( GPL-3.0-or-later WITH Bison-exception-2.2 )
=========== =========== ===========
=========== =========== ===========
At this moment I finished going through results of 'askalono' tool.
Now I used
grep -i -e "licens" -r mariadb-10.11.8/
which yields roughly 24000 results, and go through them manually.
After first go-through, I've refined the search a bit, ignoring common occurences:
grep -i licens -r mariadb-10.11.8/ | \
grep -v \
-e "// This source code is licensed under both the GPLv2 (found in the" \
-e "// COPYING file in the root directory) and Apache 2.0 License" \
-e "// (found in the LICENSE.Apache file in the root directory)." \
-e "// Use of this source code is governed by a BSD-style license that can be" \
-e "// found in the LICENSE file. See the AUTHORS file for names of contributors." \
-e "it under the terms of the GNU General Public License as published by" \
-e "the Free Software Foundation; version 2 of the License." \
-e "GNU General Public License for more details." \
-e "You should have received a copy of the GNU General Public License" \
-e "it under the terms of the GNU General Public License, version 2.0," \
-e "but not limited to OpenSSL) that is licensed under separate terms," \
-e "as designated in a particular file or component or in included license" \
-e "separately licensed software that they have included with MySQL." \
-e "GNU General Public License, version 2.0, for more details." \
-e "License as published by the Free Software Foundation; either" \
-e "version 2.1 of the License, or (at your option) any later version." \
-e "Lesser General Public License for more details." \
-e "License along with this library; if not, write to the Free Software" \
-e "License version 2.1 as published by the Free Software Foundation." \
-e "the terms of the GNU General Public License as published by the Free Software" \
-e "License along with this library; if not, write to the Free" \
-e "version 2 of the License, or (at your option) any later version." \
-e "Library General Public License for more details." \
-e "License along with this library; if not see <http://www.gnu.org/licenses>" \
| grep -i licens
squeezing the results to roughly 3400 lines, for the second go through.
Even then, it is tremendously attention demanding, and likely place for oversights.
I've managed to discover the following:
=========== =========== ===========
=========== =========== ===========
grep -i -e "under the GPL 1, 2 or 3 license" -r mariadb-10.11.8/
Files:
mariadb-10.11.8/extra/mariabackup/quicklz/quicklz.c
mariadb-10.11.8/extra/mariabackup/quicklz/quicklz.h
states:
"QuickLZ can be used for free under the GPL 1, 2 or 3 license"
which makes it " ( GPL-1.0-only OR GPL-2.0-only GPL-3.0-only ) ", since the word "later" is not used.
=========== =========== ===========
=========== =========== ===========
grep -i -e "BSD 2-Clause" -r mariadb-10.11.8/
Files:
mariadb-10.11.8/storage/rocksdb/rocksdb/util/xxhash.cc
mariadb-10.11.8/storage/rocksdb/rocksdb/util/xxhash.h
mariadb-10.11.8/storage/rocksdb/rocksdb/util/xxh3p.h
has the BSD 2-Clause License, which SPDX identifier is 'BSD-2-Clause'
=========== =========== ===========
=========== =========== ===========
grep -w -e "MIT" -r mariadb-10.11.8/
File:
mariadb-10.11.8/libmariadb/external/zlib/ucm.cmake
is licesned under MIT, which SPDX identifier is also 'MIT'.
Also text in:
mariadb-10.11.8/storage/mroonga/vendor/groonga/README.md
specifically:
"* License: The MIT license. See vendor/mruby-source/MITL for details."
*SUGGESTS* that all files under
mariadb-10.11.8/storage/mroonga/vendor/groonga/vendor/mruby/*
are also licensed under MIT,
however the directory is actually named "vendor/mruby", not "vendor/mruby-source", and the "MITL" file is missing,
and the single file
mariadb-10.11.8/storage/mroonga/vendor/groonga/vendor/mruby/CMakeLists.txt
is licensed undel LGPL 2.1,
so it would be best to ask MariaDB upstream to clarify the license.
Moreover file:
mariadb-10.11.8/storage/maria/libmarias3/docs/_themes/sphinx_rtd_theme/static/css/theme.css
states:
"* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)"
which makes it 'OFL-1.1 AND MIT'
without parenthesis, as they are licenses of two distinct files.
Files:
mariadb-10.11.8/storage/rocksdb/rocksdb/util/murmurhash.cc
mariadb-10.11.8/storage/rocksdb/rocksdb/util/murmurhash.h
states, after the license header of '( GPL-2.0-only OR Apache-2.0 )':
"All code is released to the public domain. For business purposes, Murmurhash is under the MIT license."
The original website no longer exists, and "public domain" is too vague for SPDX.
However we should mark the 'MIT' license, since it's NOT up to us - package maintainer - to guess the effective license (whether the package user will use the code for business purposes or not).
=========== =========== ===========
=========== =========== ===========
grep -w -e "CC0" -r mariadb-10.11.8/
Files:
mariadb-10.11.8/unittest/mysys/crc32-t.c
mariadb-10.11.8/storage/rocksdb/rocksdb/util/timer_queue_test.cc
mariadb-10.11.8/storage/rocksdb/rocksdb/util/timer_queue.h
mariadb-10.11.8/mysql-test/suite/innodb/include/crc32.pl
mention the CC0 license, which makes it 'CC0-1.0'
=========== =========== ===========
=========== =========== ===========
grep -i -e "PHP license" -r mariadb-10.11.8/
Files:
mariadb-10.11.8/libmariadb/libmariadb/ma_stmt_codec.c
mariadb-10.11.8/libmariadb/libmariadb/ma_charset.c
mariadb-10.11.8/libmariadb/libmariadb/mariadb_stmt.c
mariadb-10.11.8/libmariadb/libmariadb/ma_password.c
mariadb-10.11.8/libmariadb/libmariadb/ma_loaddata.c
mention the PHP 3.0 and PHP 3.01 licenses, which makes it 'PHP-3.0 AND PHP-3.01'
=========== =========== ===========
=========== =========== ===========
grep -i -e "The authors of MySQL hereby grant" -r mariadb-10.11.8/
279 files from the command above states:
The authors of MySQL hereby grant you an additional
permission to link the program and your derivative works with the
separately licensed software that they have included with MySQL.
which I have no idea how to process.
=========== =========== ===========
=========== =========== ===========
File 'storage/archive/azlib.h'
is licensed under zlib license.
=========== =========== ===========
=========== =========== ===========
Files:
strings/dtoa.c
libmariadb/libmariadb/ma_dtoa.c
are licensed under 'dtoa' license:
https://spdx.org/licenses/dtoa.html
=========== =========== ===========
=========== =========== ===========
These files are licensed under FSFAP:
| grep -i -e "medium without royalty" -r .
https://spdx.org/licenses/FSFAP.html
=========== =========== ===========
=========== =========== ===========
File 'storage/mroonga/vendor/groonga/lib/grn_ecmascript.c'
is licensed under 'blessing' license:
https://spdx.org/licenses/blessing.html
=========== =========== ===========
=========== =========== ===========
File 'storage/connect/unzip.c'
is licensed under 'Info-ZIP' license:
https://spdx.org/licenses/Info-ZIP.html
=========== =========== ===========
=========== =========== ===========
File 'libmysqld/lib_sql.cc'
is licensed under 'Boehm-GC' license:
https://spdx.org/licenses/Boehm-GC.html
=========== =========== ===========
=========== =========== ===========
Files:
mariadb-10.11.8/mysys/psi_noop.c
mariadb-10.11.8/include/mysql/psi/psi_base.h
mariadb-10.11.8/include/mysql/psi/psi_memory.h
States:
Without limiting anything contained in the foregoing, this file,
which is part of C Driver for MySQL (Connector/C), is also subject to the
Universal FOSS Exception, version 1.0, a copy of which can be found at
http://oss.oracle.com/licenses/universal-foss-exception.
which is IMO something that needs to be added to SPDX database.
=========== =========== ===========
=========== =========== ===========
Files like these:
mariadb-10.11.8/storage/maria/libmarias3/tests/include.am
mariadb-10.11.8/storage/maria/libmarias3/docs/_themes/sphinx_rtd_theme/search.html
states that they are licensed under BSD license, which text should be attached,
but the closest license file I found was GPL or LGPL.
Someone with better search-fu, or clarification from MariaDB upstream, would be welcomed.
There are other files under various types of BSD, GPL and LGPL licenses, so even if they would switch the license, we likely should have it already covered.
=========== =========== ===========
=========== =========== ===========
So the resulting "License:" field should be:
( GPL-2.0-only OR Apache-2.0 ) AND ( GPL-2.0-or-later OR Apache-2.0 ) AND BSD-2-Clause AND BSD-3-Clause AND CC-BY-4.0 AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND ( GPL-3.0-or-later WITH Bison-exception-2.2 ) AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND OpenSSL AND MIT AND OFL-1.1 AND CC0-1.0 AND PHP-3.0 AND PHP-3.01 AND zlib AND dtoa AND FSFAP AND blessing AND Info-ZIP AND Boehm-GC
=========== =========== ===========
=========== =========== ===========
I hope I caught all of the licenses.
If that's not the case, please contribute a fix or at least report a bug against this package so we can correct it.
A detailed examination of chaotic, and on many places (at least) seemingly outdated,
file "THIRDPARTY" might be good place to start review of my work.
UPDATE:
Results of thorough review from Ales Nezbeda <anezbeda@redhat.com> were incorporated into this commit.
