merge #58 into cyphar/filepath-securejoin:main

cyphar · cyphar · commit 6fcfed1f010e · 2025-08-08T09:05:20.000+10:00
Aleksa Sarai (2): *: add SPDX-License-Identifier lines *: relicense libpathrs ports to MPLv2 Votes: https://web.archive.org/web/*/https://github.com/cyphar/filepath-securejoin/pull/58 LGTMs: cyphar kolyshkin skitt
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,11 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased] ##
 
+> **NOTE**: With this release, some parts of
+> `github.com/cyphar/filepath-securejoin` (notably the new APIs introduced
+> since the [0.3.0][] release) are now licensed under the Mozilla Public
+> License (version 2).
+
 ### Added ###
 - Some minimal parts of the safe `procfs` API have now been exposed. At the
   moment these include:
diff --git a/LICENSE.BSD b/LICENSE.BSD
diff --git a/LICENSE.MPL-2.0 b/LICENSE.MPL-2.0
diff --git a/README.md b/README.md
@@ -165,5 +165,18 @@ after `MkdirAll`).
 
 ### License ###
 
-The license of this project is the same as Go, which is a BSD 3-clause license
-available in the `LICENSE` file.
+Some of the code in this project is derived from Go, and is licensed under a
+BSD 3-clause license (available in `LICENSE.BSD`). At time of writing, these
+are:
+
+ * `gocompat_*.go` (backports to provide compatibility with older Go versions)
+ * `join*.go` (port of Docker's symlink expansion, originally based on the
+   stdlib `filepath.EvalSymlinks`)
+
+The rest of the files (many of which are derived from [libpathrs][libpathrs])
+are licensed under the Mozilla Public License version 2.0 (available in
+`LICENSE.MPL-2.0`).
+
+Every source file in this project has a copyright header describing its
+license. Please check the license headers of each file to see what license
+applies to it.
diff --git a/doc.go b/doc.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
 // Copyright (C) 2014-2015 Docker Inc & Go Authors. All rights reserved.
 // Copyright (C) 2017-2024 SUSE LLC. All rights reserved.
 // Use of this source code is governed by a BSD-style
diff --git a/gocompat_errors_go120.go b/gocompat_errors_go120.go
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: BSD-3-Clause
 //go:build linux && go1.20
 
 // Copyright (C) 2024 SUSE LLC. All rights reserved.
diff --git a/gocompat_errors_test.go b/gocompat_errors_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
 //go:build linux
 
 // Copyright (C) 2024 SUSE LLC. All rights reserved.
diff --git a/gocompat_errors_unsupported.go b/gocompat_errors_unsupported.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
 //go:build linux && !go1.20
 
 // Copyright (C) 2024 SUSE LLC. All rights reserved.
diff --git a/gocompat_generics_go121.go b/gocompat_generics_go121.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
 //go:build linux && go1.21
 
 // Copyright (C) 2024 SUSE LLC. All rights reserved.
diff --git a/gocompat_generics_unsupported.go b/gocompat_generics_unsupported.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
 //go:build linux && !go1.21
 
 // Copyright (C) 2024 SUSE LLC. All rights reserved.
diff --git a/hack/test.sh b/hack/test.sh
@@ -1,7 +1,12 @@
 #!/bin/bash
-# Copyright (C) 2024-2025 SUSE LLC. All rights reserved.
-# Use of this source code is governed by a BSD-style
-# license that can be found in the LICENSE file.
+# SPDX-License-Identifier: MPL-2.0
+
+# Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+# Copyright (C) 2024-2025 SUSE LLC
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 set -Eeuo pipefail
 
diff --git a/join.go b/join.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
 // Copyright (C) 2014-2015 Docker Inc & Go Authors. All rights reserved.
 // Copyright (C) 2017-2025 SUSE LLC. All rights reserved.
 // Use of this source code is governed by a BSD-style
diff --git a/join_test.go b/join_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
 // Copyright (C) 2017-2025 SUSE LLC. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
diff --git a/join_windows_test.go b/join_windows_test.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
 // Copyright (C) 2017-2025 SUSE LLC. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
diff --git a/lookup_linux.go b/lookup_linux.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/lookup_linux_test.go b/lookup_linux_test.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/mkdir_linux.go b/mkdir_linux.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/mkdir_linux_test.go b/mkdir_linux_test.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/open_linux.go b/open_linux.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/open_linux_test.go b/open_linux_test.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/openat2_linux.go b/openat2_linux.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/openat_linux.go b/openat_linux.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/procfs_linux.go b/procfs_linux.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024-2025 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/procfs_linux_test.go b/procfs_linux_test.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/procfs_lookup_linux.go b/procfs_lookup_linux.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024-2025 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 // This code is adapted to be a minimal version of the libpathrs proc resolver
 // <https://github.com/opensuse/libpathrs/blob/v0.1.3/src/resolvers/procfs.rs>.
diff --git a/procfs_lookup_linux_test.go b/procfs_lookup_linux_test.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024-2025 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/testing_mocks_linux_test.go b/testing_mocks_linux_test.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/util_linux_test.go b/util_linux_test.go
@@ -1,8 +1,13 @@
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build linux
 
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/util_test.go b/util_test.go
@@ -1,6 +1,11 @@
-// Copyright (C) 2024 SUSE LLC. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
+// SPDX-License-Identifier: MPL-2.0
+
+// Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 package securejoin
 
diff --git a/vfs.go b/vfs.go
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
 // Copyright (C) 2017-2024 SUSE LLC. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+// SPDX-License-Identifier: BSD-3-Clause`
	`2`	`+`
`1`	`3`	`// Copyright (C) 2014-2015 Docker Inc & Go Authors. All rights reserved.`
`2`	`4`	`// Copyright (C) 2017-2024 SUSE LLC. All rights reserved.`
`3`	`5`	`// Use of this source code is governed by a BSD-style`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+// SPDX-License-Identifier: BSD-3-Clause`
`1`	`2`	`//go:build linux && go1.20`
`2`	`3`
`3`	`4`	`// Copyright (C) 2024 SUSE LLC. All rights reserved.`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+// SPDX-License-Identifier: BSD-3-Clause`
	`2`	`+`
`1`	`3`	`//go:build linux`
`2`	`4`
`3`	`5`	`// Copyright (C) 2024 SUSE LLC. All rights reserved.`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+// SPDX-License-Identifier: BSD-3-Clause`
	`2`	`+`
`1`	`3`	`//go:build linux && !go1.20`
`2`	`4`
`3`	`5`	`// Copyright (C) 2024 SUSE LLC. All rights reserved.`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+// SPDX-License-Identifier: BSD-3-Clause`
	`2`	`+`
`1`	`3`	`//go:build linux && go1.21`
`2`	`4`
`3`	`5`	`// Copyright (C) 2024 SUSE LLC. All rights reserved.`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+// SPDX-License-Identifier: BSD-3-Clause`
	`2`	`+`
`1`	`3`	`//go:build linux && !go1.21`
`2`	`4`
`3`	`5`	`// Copyright (C) 2024 SUSE LLC. All rights reserved.`