3:03 p.m.
Wiki - https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
The fourth phase of transition from using Fedora's short names for
licenses to [https://spdx.org/licenses/ SPDX identifiers] in the
License: field of Fedora package spec files. This phase focuses on
migrating the remaining packages.
== Owner ==
* Name: [[User:msuchy| Miroslav Suchý]], [[User:jlovejoy| Jilayne
Lovejoy]], [[User:dcantrell| David Cantrell]], [[User:ref| Richard
Fontana]]
* Email: msuchy(a)redhat.com, dcantrell(a)redhat.com, jlovejoy(a)redhat.com,
rfontana(a)redhat.com
== Current status ==
*
[https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE80...
Burndow chart]
== Detailed Description ==
This is follow-up of [[Changes/SPDX_Licenses_Phase_3|Phase 3]]. During
this phase, all remaining packages should be migrated to use SPDX
license identifiers in the License: field of the package spec file.
So far, package maintainers have been updating their packages in
accordance with the guidance provided at
https://docs.fedoraproject.org/en-US/legal/update-existing-packages/
and filing issues in the
[https://gitlab.com/fedora/legal/fedora-license-data
fedora-license-data repo]. Miroslav has been tracking how many
packages that have been updated. Given the large number of packages in
Fedora, this progress is good, but slow.
In this phase, all remaining packages will be converted automatically
when possible. When human analysis is required then Bugzilla entry
will be created. All these Bugzillas will block tracking bug to easily
find these issues.
== Feedback ==
See [[Changes/SPDX_Licenses_Phase_1#Feedback|feedback section of Phase 1]]
Discussions on mailing list:
*
[https://lists.fedoraproject.org/archives/search?q=SPDX+statistics&pag...
regular SPDX Statistics]
*
[https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.o...
SPDX - How to handle MIT and BSD]
Challenges:
* license-fedora2spdx tool uses mapping of legacy Fedora short names
to SPDX identifiers using the
[https://gitlab.com/fedora/legal/fedora-license-data/-/tree/main
fedora-license-data] to suggest SPDX identifiers. Where there is an
apparent one-to-one mapping, the package maintainer could simply
update the License field: and move on.
* for many packages, particularly packages that use "umbrella" legacy
short names that may refer to a large set of unrelated or
loosely-related licenses, further inspection will be needed.
Currently, Fedora documentation provides sparse advice on how to do
this inspection and thus, a range of methods are used.
== Benefit to Fedora ==
The use of standardized identifiers for licenses will align Fedora
with other distributions and facilitate efficient and reliable
identification of licenses. Depending on the level of diligence done
in this transition, Fedora could be positioned as a leader and
contributor to better license information upstream (of Fedora).
== Scope ==
* Change Owners:
** Continue adding newly found licenses to fedora-license-data and to
SPDX.org list.
** Continue to report progress
** Automatically convert packages in several bulks using proven
packager rights. These changes will be announced in advance on the
devel mailing list.
** When the automatic conversion is impossible, Change Owners will
create a Bugzilla entry asking package maintainers to migrate the
package.
* Other developers:
** All packages (during the package review) should use the SPDX
expression. - this is redundant as this has already been approved
since Phase 1, but it should be reminded.
** Migrate the existing License tag from a short name to an SPDX expression.
* Release engineering: nothing
* Policies and guidelines: all done in previous phases
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
License strings are not used anything in run time. This change will
not affect the upgrade or runtime of Fedora.
During the transition period, developer tools like rpminspect,
licensecheck, etc. may produce false negatives. And we have to define
a date where we flip these tools from old Fedora's short names to the
SPDX formula.
== How To Test ==
See [[Changes/SPDX_Licenses_Phase_1#How_To_Test|How to test section of Phase 1]]
== User Experience ==
Users should be able to use standard software tools that audit
licenses. E.g. for Software Bills of Materials.
== Dependencies ==
No other dependencies.
== Contingency Plan ==
* Contingency mechanism: There will be no way back. We are already
beyond of point to return. We are heading to explore strange new
worlds... to boldly go where no man has gone before.
* Contingency deadline: Beta freeze. But it is expected that not all
packages will be converted by that time and the change will continue
in the next release.
* Blocks release? No. This change has no impact on runtime of any package.
== Documentation ==
[https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ Allowed Licenses]
[https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_pro...
Update existing packages]
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney