directives: add checked_by field to license(), add some license checks

Add a "checked_by" field to the `license()` directive so that we can track who verified
the license for a project. also check the license of 18 or so projects and mark them
checked.

lib/spack/spack/directives.py

@@ -912,14 +912,21 @@ def _execute_license(pkg, license_identifier: str, when):
 
 
 @directive("licenses")
-def license(license_identifier: str, when=None):
+def license(
+    license_identifier: str,
+    checked_by: Optional[Union[str, List[str]]] = None,
+    when: Optional[Union[str, bool]] = None,
+):
     """Add a new license directive, to specify the SPDX identifier the software is
     distributed under.
 
     Args:
-        license_identifiers: A list of SPDX identifiers specifying the licenses
+        license_identifiers: SPDX identifier specifying the license(s) the software
-            the software is distributed under.
+            is distributed under.
+        checked_by: string or list of strings indicating which github user checked the
+            license (if any).
         when: A spec specifying when the license applies.
+            when: A spec specifying when the license applies.
     """
 
     return lambda pkg: _execute_license(pkg, license_identifier, when)

var/spack/repos/builtin/packages/acl/package.py

@@ -12,7 +12,7 @@ class Acl(AutotoolsPackage):
     homepage = "https://savannah.nongnu.org/projects/acl"
     url = "https://git.savannah.nongnu.org/cgit/acl.git/snapshot/acl-2.2.53.tar.gz"
 
-    license("LGPL-2.1-or-later AND GPL-2.0-or-later")
+    license("LGPL-2.1-or-later AND GPL-2.0-or-later", checked_by="tgamblin")
 
     version("2.2.53", sha256="9e905397ac10d06768c63edd0579c34b8431555f2ea8e8f2cee337b31f856805")
     version("2.2.52", sha256="f3f31d2229c903184ff877aa0ee658b87ec20fec8aebb51e65eaa68d7b24e629")

var/spack/repos/builtin/packages/aom/package.py

@@ -12,7 +12,7 @@ class Aom(CMakePackage):
     homepage = "https://aomedia.googlesource.com/aom"
     git = "https://aomedia.googlesource.com/aom"
 
-    license("BSD-2-Clause AND custom")
+    license("BSD-2-Clause AND AOM-Patent-License-1.0", checked_by="tgamblin")
 
     version("v1.0.0-errata1", commit="29d8ce4836630df5cc7ab58f1afc4836765fc212")
     depends_on("yasm")

var/spack/repos/builtin/packages/apptainer/package.py

@@ -26,7 +26,11 @@ class Apptainer(SingularityBase):
     url = "https://github.com/apptainer/apptainer/releases/download/v1.0.2/apptainer-1.0.2.tar.gz"
     git = "https://github.com/apptainer/apptainer.git"
 
-    license("BSD-3-Clause AND BSD-3-Clause-LBNL")
+    license(
+        "BSD-3-Clause AND BSD-3-Clause-LBNL"
+        " AND BSD-2-Clause AND Apache-2.0 AND MIT AND MPL-2.0 AND Unlicense",
+        checked_by="tgamblin",
+    )
 
     version("main", branch="main")
     version("1.1.9", sha256="c615777539154288542cf393d3fd44c04ccb3260bc6330dc324d4e4ebe902bfa")

var/spack/repos/builtin/packages/asciidoc/package.py

@@ -10,12 +10,12 @@ class Asciidoc(AutotoolsPackage):
     """A presentable text document format for writing articles, UNIX man
     pages and other small to medium sized documents."""
 
-    homepage = "https://asciidoc.org/"
+    homepage = "https://asciidoc-py.org/"
     # Always working URL but strangely with another checksum
     url = "https://github.com/asciidoc-py/asciidoc-py/archive/8.6.10.tar.gz"
     git = "https://github.com/asciidoc-py/asciidoc-py.git"
 
-    license("GPL-2.0-or-later AND MIT")
+    license("GPL-2.0-only", checked_by="tgamblin")
 
     version("master", branch="master")
     version("9.1.0", sha256="5056c20157349f8dc74f005b6e88ccbf1078c4e26068876f13ca3d1d7d045fe7")

var/spack/repos/builtin/packages/atf/package.py

@@ -13,7 +13,7 @@ class Atf(AutotoolsPackage):
     homepage = "https://github.com/jmmv/atf"
     url = "https://github.com/jmmv/atf/archive/atf-0.21.tar.gz"
 
-    license("BSD-2-Clause AND BSD-3-Clause")
+    license("BSD-2-Clause AND BSD-3-Clause", checked_by="tgamblin")
 
     version("0.21", sha256="da6b02d6e7242f768a7aaa7b7e52378680456e4bd9a913b6636187079c98f3cd")
     version("0.20", sha256="3677cf957d7f574835b8bdd385984ba928d5695b3ff28f958e4227f810483ab7")

var/spack/repos/builtin/packages/audacious/package.py

@@ -11,7 +11,7 @@ class Audacious(AutotoolsPackage):
     homepage = "https://audacious-media-player.org/"
     url = "https://github.com/audacious-media-player/audacious/archive/audacious-4.0.2.tar.gz"
 
-    license("BSD-2-Clause AND ISC")
+    license("BSD-2-Clause AND BSD-3-Clause", checked_by="tgamblin")
 
     version("4.0.2", sha256="92f30a78353c50f99b536061b9d94b6b9128760d546fddbf863e3591c4ac5a8d")
     version("4.0.1", sha256="203195cf0d3c2e40d23c9895269ca0ace639c4a2b4dceb624169d75337059985")

var/spack/repos/builtin/packages/autoconf/package.py

@@ -14,7 +14,8 @@ class Autoconf(AutotoolsPackage, GNUMirrorPackage):
     homepage = "https://www.gnu.org/software/autoconf/"
     gnu_mirror_path = "autoconf/autoconf-2.69.tar.gz"
 
-    license("GPL-2.0-or-later")
+    license("GPL-3.0-or-later WITH Autoconf-exception-3.0", when="@2.62:", checked_by="tgamblin")
+    license("GPL-2.0-or-later WITH Autoconf-exception-2.0", when="@:2.59", checked_by="tgamblin")
 
     version("2.72", sha256="afb181a76e1ee72832f6581c0eddf8df032b83e2e0239ef79ebedc4467d92d6e")
     version("2.71", sha256="431075ad0bf529ef13cb41e9042c542381103e80015686222b8a9d4abef42a1c")

var/spack/repos/builtin/packages/batctl/package.py

@@ -12,7 +12,7 @@ class Batctl(MakefilePackage):
     homepage = "https://github.com/open-mesh-mirror/batctl"
     url = "https://github.com/open-mesh-mirror/batctl/archive/v2019.5.tar.gz"
 
-    license("GPL-2.0-only AND MIT")
+    license("GPL-2.0-only AND MIT AND ISC", checked_by="tgamblin")
 
     version("2019.5", sha256="ffe5857a33068ec174140c154610d76d833524d840a2fc2d1a15e16686213cad")
     version("2019.4", sha256="a3564eb9727335352dc0cfa2f2b29474c2c837384689ac5fcb387784a56e7685")

var/spack/repos/builtin/packages/binutils/package.py

@@ -21,7 +21,10 @@ class Binutils(AutotoolsPackage, GNUMirrorPackage):
 
     executables = ["^nm$", "^readelf$"]
 
-    license("GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause")
+    license(
+        "GPL-2.0-or-later AND LGPL-2.1-or-later AND GPL-3.0-or-later AND LGPL-3.0-or-later",
+        checked_by="tgamblin",
+    )
 
     version("2.41", sha256="a4c4bec052f7b8370024e60389e194377f3f48b56618418ea51067f67aaab30b")
     version("2.40", sha256="f8298eb153a4b37d112e945aa5cb2850040bcf26a3ea65b5a715c83afe05e48a")

var/spack/repos/builtin/packages/lz4/package.py

@@ -22,7 +22,8 @@ class Lz4(CMakePackage, MakefilePackage):
 
     maintainers("AlexanderRichert-NOAA")
 
-    license("BSD-2-Clause AND GPL-2.0-only")
+    # liblz4 is BSD-2-clause; programs, manpages, and everything else are GPL2
+    license("BSD-2-Clause AND GPL-2.0-only", checked_by="tgamblin")
 
     version("1.9.4", sha256="0b0e3aa07c8c063ddf40b082bdf7e37a1562bda40a0ff5272957f3e987e0e54b")
     version("1.9.3", sha256="030644df4611007ff7dc962d981f390361e6c97a34e5cbc393ddfbe019ffe2c1")

var/spack/repos/builtin/packages/procps-ng/package.py

@@ -12,7 +12,7 @@ class ProcpsNg(AutotoolsPackage):
     homepage = "https://sourceforge.net/projects/procps-ng"
     url = "https://udomain.dl.sourceforge.net/project/procps-ng/Production/procps-ng-3.3.16.tar.xz"
 
-    license("GPL-2.0-or-later AND LGPL-2.1-or-later")
+    license("GPL-2.0-or-later AND LGPL-2.1-or-later", checked_by="tgamblin")
 
     version("3.3.16", sha256="925eacd65dedcf9c98eb94e8978bbfb63f5de37294cc1047d81462ed477a20af")
 

var/spack/repos/builtin/packages/py-black/package.py

@@ -17,7 +17,7 @@ class PyBlack(PythonPackage):
 
     maintainers("adamjstewart")
 
-    license("MIT")
+    license("MIT", checked_by="tgamblin")
 
     version("23.12.1", sha256="4ce3ef14ebe8d9509188014d96af1c456a910d5b5cbf434a09fef7e024b3d0d5")
     version("23.12.0", sha256="330a327b422aca0634ecd115985c1c7fd7bdb5b5a2ef8aa9888a82e2ebe9437a")

var/spack/repos/builtin/packages/py-greenlet/package.py

@@ -15,7 +15,7 @@ class PyGreenlet(PythonPackage):
     # Requires objgraph
     skip_modules = ["greenlet.tests"]
 
-    license("PSF-2.0")
+    license("MIT AND PSF-2.0", checked_by="tgamblin")
 
     version("3.0.0a1", sha256="1bd4ea36f0aeb14ca335e0c9594a5aaefa1ac4e2db7d86ba38f0be96166b3102")
     version(

var/spack/repos/builtin/packages/py-hatchling/package.py

@@ -13,7 +13,7 @@ class PyHatchling(PythonPackage):
     pypi = "hatchling/hatchling-1.4.1.tar.gz"
     git = "https://github.com/pypa/hatch"
 
-    license("MIT")
+    license("MIT", checked_by="tgamblin")
 
     version("1.21.0", sha256="5c086772357a50723b825fd5da5278ac7e3697cdf7797d07541a6c90b6ff754c")
     version("1.18.0", sha256="50e99c3110ce0afc3f7bdbadff1c71c17758e476731c27607940cfa6686489ca")

var/spack/repos/builtin/packages/py-mypy/package.py

@@ -15,7 +15,7 @@ class PyMypy(PythonPackage):
 
     maintainers("adamjstewart")
 
-    license("MIT AND PSF-2.0")
+    license("MIT AND PSF-2.0", checked_by="tgamblin")
 
     version("1.8.0", sha256="6ff8b244d7085a0b425b56d327b480c3b29cafbd2eff27316a004f9a7391ae07")
     version("1.7.1", sha256="fcb6d9afb1b6208b4c712af0dafdc650f518836065df0d4fb1d800f5d6773db2")

var/spack/repos/builtin/packages/qemu/package.py

@@ -15,7 +15,8 @@ class Qemu(AutotoolsPackage):
 
     maintainers("anderbubble")
 
-    license("GPL-2.0-only AND LGPL-2.1-only")
+    # Docs say TCG is "under a BSD license" but all the headers for TCG have the MIT license.
+    license("GPL-2.0-only AND LGPL-2.1-only AND MIT", checked_by="tgamblin")
 
     version("4.1.1", sha256="ed6fdbbdd272611446ff8036991e9b9f04a2ab2e3ffa9e79f3bab0eb9a95a1d2")
     version("4.1.0", sha256="656e60218689bdeec69903087fd7582d5d3e72238d02f4481d8dc6d79fd909c6")

var/spack/repos/builtin/packages/rsyslog/package.py

@@ -12,7 +12,7 @@ class Rsyslog(AutotoolsPackage):
     homepage = "https://www.rsyslog.com/"
     url = "https://github.com/rsyslog/rsyslog/archive/v8.2006.0.tar.gz"
 
-    license("Apache-2.0 AND GPL-3.0-or-later AND LGPL-3.0-or-later")
+    license("Apache-2.0 AND GPL-3.0-or-later AND LGPL-3.0-or-later", checked_by="tgamblin")
 
     version("8.2006.0", sha256="dc30a2ec02d5fac91d3a4f15a00641e0987941313483ced46592ab0b0d68f324")
     version("8.2004.0", sha256="b56b985fec076a22160471d389b7ff271909dfd86513dad31e401a775a6dfdc2")

var/spack/repos/builtin/packages/ruby/package.py

@@ -22,7 +22,7 @@ class Ruby(AutotoolsPackage, NMakePackage):
     list_depth = 1
     tags = ["windows"]
 
-    license("Ruby AND BSD-2-Clause AND MIT")
+    license("Ruby AND BSD-2-Clause AND MIT", checked_by="tgamblin")
 
     version("3.1.0", sha256="50a0504c6edcb4d61ce6b8cfdbddaa95707195fab0ecd7b5e92654b2a9412854")
     version("3.0.2", sha256="5085dee0ad9f06996a8acec7ebea4a8735e6fac22f22e2d98c3f2bc3bef7e6f1")

var/spack/repos/builtin/packages/rust/package.py

@@ -23,7 +23,7 @@ class Rust(Package):
     # As a general rule of thumb Rust can be built with either the previous major
     # version or the current version of the compiler as shown above.
 
-    license("Apache-2.0 AND MIT")
+    license("Apache-2.0 OR MIT")
 
     # Pre-release versions.
     # Note: If you plan to use these versions remember to install with

var/spack/repos/builtin/packages/spack/package.py

@@ -21,7 +21,7 @@ class Spack(Package):
     url = "https://github.com/spack/spack/releases/download/v0.16.2/spack-0.16.2.tar.gz"
     maintainers("haampie")
 
-    license("Apache-2.0")
+    license("Apache-2.0 OR MIT")
 
     version("develop", branch="develop")
     version("0.20.1", sha256="141be037b56e4b095840a95ac51c428c29dad078f7f88140ae6355b2a1b32dc3")

var/spack/repos/builtin/packages/subversion/package.py

@@ -22,7 +22,8 @@ class Subversion(AutotoolsPackage):
 
     tags = ["build-tools"]
 
-    license("Apache-2.0 AND BSD-2-Clause")
+    # internal lz4, x509, and utf8proc code have different licenses.
+    license("Apache-2.0 AND BSD-3-Clause AND BSD-2-Clause AND MIT", checked_by="tgamblin")
 
     version("1.14.2", sha256="fd826afad03db7a580722839927dc664f3e93398fe88b66905732c8530971353")
     version("1.14.1", sha256="dee2796abaa1f5351e6cc2a60b1917beb8238af548b20d3e1ec22760ab2f0cad")

var/spack/repos/builtin/packages/sysfsutils/package.py

@@ -17,7 +17,7 @@ class Sysfsutils(AutotoolsPackage):
     homepage = "https://github.com/linux-ras/sysfsutils/"
     url = "https://github.com/linux-ras/sysfsutils/archive/sysfsutils_0_5.tar.gz"
 
-    license("GPL-2.0-only AND LGPL-2.1-only")
+    license("GPL-2.0-only AND LGPL-2.1-only", checked_by="tgamblin")
 
     version("0_5", sha256="6878c8a4281e7de52e57b40fe543b1b4e01d6fbce4ffd45a36e5fc25e376746f")
     version("0_4_0", sha256="9c78edb118c6bd962e04558ddb2df46d456273284fe3f23bb930dc287225aea5")

var/spack/repos/builtin/packages/texlive/package.py

@@ -25,7 +25,7 @@ class Texlive(AutotoolsPackage):
     list_url = "http://ftp.math.utah.edu/pub/tex/historic/systems/texlive"
     list_depth = 1
 
-    license("GPL-2.0-or-later AND GPL-3.0-or-later")
+    license("GPL-2.0-or-later AND GPL-3.0-or-later", checked_by="tgamblin")
 
     # Below is the url for a binary distribution. This was originally how this
     # was distributed in Spack, but should be considered deprecated. Note that

var/spack/repos/builtin/packages/unifdef/package.py

@@ -18,7 +18,7 @@ class Unifdef(MakefilePackage):
 
     maintainers("matthiasdiener")
 
-    license("BSD-2-Clause AND BSD-3-Clause")
+    license("BSD-2-Clause AND BSD-3-Clause", checked_by="tgamblin")
 
     version("2.12", sha256="43ce0f02ecdcdc723b2475575563ddb192e988c886d368260bc0a63aee3ac400")
     version("2.11", sha256="828ffc270ac262b88fe011136acef2780c05b0dc3c5435d005651740788d4537")

var/spack/repos/builtin/packages/xmlrpc-c/package.py

@@ -13,7 +13,7 @@ class XmlrpcC(AutotoolsPackage):
     homepage = "https://sourceforge.net/projects/xmlrpc-c/"
     url = "https://sourceforge.net/projects/xmlrpc-c/files/Xmlrpc-c%20Super%20Stable/1.51.06/xmlrpc-c-1.51.06.tgz"
 
-    license("BSD-3-Clause AND MIT")
+    license("BSD-3-Clause AND MIT", checked_by="tgamblin")
 
     version("1.51.06", sha256="06dcd87d9c88374559369ffbe83b3139cf41418c1a2d03f20e08808085f89fd0")
 

var/spack/repos/builtin/packages/xz/package.py

@@ -26,7 +26,7 @@ class Xz(MSBuildPackage, AutotoolsPackage, SourceforgePackage):
 
     executables = [r"^xz$"]
 
-    license("GPL-2.0-or-later AND Public-Domain AND LGPL-2.1-or-later")
+    license("GPL-2.0-or-later AND Public-Domain AND LGPL-2.1-or-later", checked_by="tgamblin")
 
     version("5.4.1", sha256="dd172acb53867a68012f94c17389401b2f274a1aa5ae8f84cbfb8b7e383ea8d3")
     version("5.2.10", sha256="01b71df61521d9da698ce3c33148bff06a131628ff037398c09482f3a26e5408")