GPL-3.0-only.txt out-of-sync with XML

[dorssel]

My project uses FSFE REUSE, which automatically downloads licenses in TXT format from https://github.com/spdx/license-list-data.

The GPL-3.0-only.txt file contains http URLs, which our security scanner (DevSkim) complains about.

The original XML was altered to use https in this commit: c92c09f. That was in May 2021. However, GPL-3.0-only.txt (and probably others) was never regenerated and predates that change.

[goneall]

@dorssel - This is an issue with the source license XML file which is maintained in the license-list-xml repo. I'll move this issue over to that repo.

Several files should be reviewed and possibly updated:

• GPL-3.0-only.xml
• GPL-3.0-or-later.xml
• GPL-3.0-only.txt
• GPL-3.0-or-later.txt

There are also some deprecated license texts that could be updated, but since they are deprecated IMO it isn't required.

I'll leave it up to the legal team maintainers of the license-list-xml repo to decide if they want to keep the original text or updated it with the revised text.

[dorssel]

I don't quite get it. The XML is correct and contains the https versions of the URLs. Or is the XML repo responsible for all formats?

[goneall]

@dorssel - check the test text files (links above) - the text files are copied to the text version of the file - that may be where the inconsistency exists.

[dorssel]

Ah, I see. Those txt files are from 4 years ago, whereas the XML (this should be authoritative, right?) has changed since then.

[goneall]

Those txt files are from 4 years ago, whereas the XML (this should be authoritative, right?) has changed since then.

Yes - the XML files "should be authoritative", however, to fix an issue raised where we are not formatting the text files exactly as found from the source, we use the text files at the source just for the license text.

If you could create a pull request to update the .txt files - that should fix the problems.

[jlovejoy]

just so I understand the origin of this: your security scanner is complaining b/c the license text file has "http:" instead of "https:" ?? (why?)

In any case, yes, our text files should be updated accordingly. @dorssel - could you make a PR to do so?

[dorssel]

just so I understand the origin of this: your security scanner is complaining b/c the license text file has "http:" instead of "https:" ?? (why?)

I added the DevSkim GitHub action to our build CI, and it gives a warning about using http instead of https. See: https://github.com/Microsoft/DevSkim/blob/main/guidance/DS137138.md

In any case, yes, our text files should be updated accordingly. @dorssel - could you make a PR to do so?

Will do.