Crab library license about ebpf-verifier

[dthaler]

Arie reports that Crab was derived from
https://github.com/NASA-SW-VnV/ikos

[caballa]

Sorry I join this a bit late. Do you still need my input?

[caballa]

I'm happy with the use of SPDX-License-Identifier. Just one thing to fix. The implementation of the zones domain is part of Crab (Not IKOS). So the file https://github.com/vbpf/ebpf-verifier/blob/master/src/crab/split_dbm.hpp is not NASA 1.3 and it should be Apache? The file https://github.com/vbpf/ebpf-verifier/blob/master/src/crab/split_dbm.cpp is MIT, shouldn't it be Apache?

[dthaler]

@caballa Can you generate a pull request with your proposed fixes? And also propose a resolution to the license points, especially point (b) above?

[dthaler]

@caballa there is still a remaining question for you on this issue. Specifically the Crab license (Apache 2.0) clause 4(b) says:

(b) You must cause any modified files to carry prominent notices
stating that You changed the files;

And currently the Preval code base contains modified versions of Crab files (the ones in Prevail that now have Apache-2.0 as the SPDX id at the top), so the Crab imposes the above requirement on Prevail. There are two approaches we know of that are common in the open source world.

One is to explicitly have a note in the comments at the top of each modified file.
Another is to agree that the git log is sufficient.

The second one is lighter weight, and if you (as the Crab author) agree that is sufficient, then I think we can now close this issue. This would be my preference if you agree. If you instead want to see comments at the top of each modified file, we would need another pull request to add such notices.

[caballa]

Git log is sufficient.

[dthaler]

Git log is sufficient.

Thanks for confirming. I believe that this issue can now be closed.