8:09 a.m.
3 weeks ago it was:
1.
As of 2022-10-27:
1.
There are 23302 spec files in Fedora
2.
264 mentions "SPDX" in the spec changelog
3.
out of the remaining, 173 packages mention "SPDX" in dist-git log
4.
22865 packages need to be migrated yet.
5.
11371 package has straight answer from `license-fedora2spdx` and the migration is
trivial.
Today we have:
* 23390 spec files in Fedora
* 29290 license tags in all spec files
* 19985 tags have not been converted to SPDX yet
I count as converted even all rubygem-* packages (509 pkgs) and all rust-* packages (2007
pkgs) - ecosystem maintainers
will hand them seperately.
That means 9305 license tags has been converted so far. That is big change from 3 weeks
ago where we had only 437. Part
of this big change can be the difference in script that count it. Now I try to validate
the license according the old
rule and the new rule. If the old one is invalid and the new one is valid I assume that it
is new package and already
has the SPDX format.
You rocks in converting the tags. You converted almost 7k tags in just 3 weeks!
Here is the artifact from my check:
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx...
If your package is not listed there, then I assume it is SPDX.
If your package is listed there without any comment, then you still need to convert it,
but `license-fedora2spdx` does
not give straight answer.
If your package is like:
|abcMIDI - can be trivialy converted to GPL-2.0-or-later|
|then you can easily convert your license tag to this string.|
|If your package is like:|
| abattis-cantarell-fonts warning: not valid as calaway nor as SPDX, please check
|
|then your license string is not valid using both old and new rules. But there is a lot of
false negative - especially
the *-fonts because they declare the license using macro, which I am unable to process
(yet).|
|Fun fact: the script with the checks runs on my notebook for 32 hours.|
|I will try to re-run the check in few weeks again and will report you on how we are
going.|
|Miroslav
|
|
|
5:37 a.m.
On 18. 11. 22 15:09, Miroslav Suchý wrote:
|Fun fact: the script with the checks runs on my notebook for 32
hours.|
That sounds pretty bad. What is the biggest bottleneck? Do you clone the
repositories from dist-git, or use
https://pkgs.fedoraproject.org/repo/rpm-specs-latest.tar.xz ?
--
Miro Hrončok
--
Phone: +420777974800
IRC: mhroncok
10:38 a.m.
Dne 19. 11. 22 v 12:37 Miro Hrončok napsal(a):
On 18. 11. 22 15:09, Miroslav Suchý wrote:
> |Fun fact: the script with the checks runs on my notebook for 32 hours.|
That sounds pretty bad. What is the biggest bottleneck? Do you clone the repositories
from dist-git, or use
https://pkgs.fedoraproject.org/repo/rpm-specs-latest.tar.xz ?
It is not so bad. I am not sitting in front of the computer and waiting till the script
finish. :) I just wanted
emphasis that I cannot gather the data daily and the heuristics is already complicated.
It is mostly quick'n'dirty design. Like gathering the data from one step. Then
feeding the data from first step to next
script which process second step. Then feeding the data to do third one...
I already started concating the pipes so it will run in paralel next time.
But yeah, biggest time consumer is git checkout of packages (that does not mention spdx in
%changelog). I am not aware
of other method how to retrieve git log.
Miroslav
11:46 a.m.
Am 20.11.22 um 17:38 schrieb Miroslav Suchý:
Dne 19. 11. 22 v 12:37 Miro Hrončok napsal(a):
> On 18. 11. 22 15:09, Miroslav Suchý wrote:
>> |Fun fact: the script with the checks runs on my notebook for 32 hours.|
>
>
> That sounds pretty bad. What is the biggest bottleneck? Do you clone
> the repositories from dist-git, or use
> https://pkgs.fedoraproject.org/repo/rpm-specs-latest.tar.xz ?
It is not so bad. I am not sitting in front of the computer and waiting
till the script finish. :) I just wanted emphasis that I cannot gather
the data daily and the heuristics is already complicated.
Why don't you extract the License-field from *.rpms and check if they
comply to the new rules?
Ralf
3:30 a.m.
Dne 20. 11. 22 v 18:46 Ralf Corsépius napsal(a):
Why don't you extract the License-field from *.rpms and check if
they comply to the new rules?
It would work for cases like GPLv2 -> GPL-2.0-only.
But you can have cases like:
MIT -> MIT
MIT -> MIT-Modern-Variant
so at the end you want to check %changelog and dist-git log. If there is no entry in one
of these two changelogs and
license is MIT then I assume it is Callaway MIT. If there is an entry that mention spdx
then I assume it is SPDX MIT.
Miroslav
3:14 a.m.
Dne 18. 11. 22 v 15:09 Miroslav Suchý napsal(a):
>
> 1.
>
> As of 2022-10-27:
>
> 1.
>
> There are 23302 spec files in Fedora
>
> 2.
>
> 264 mentions "SPDX" in the spec changelog
>
> 3.
>
> out of the remaining, 173 packages mention "SPDX" in dist-git log
>
> 4.
>
> 22865 packages need to be migrated yet.
>
> 5.
>
> 11371 package has straight answer from `license-fedora2spdx` and the
migration is trivial.
>
Today we have:
* 23390 spec files in Fedora
* 29290 license tags in all spec files
* 19985 tags have not been converted to SPDX yet
Today we have:
23084 spec files in Fedora
29041 license tags in all spec files
24865 tags have not been converted to SPDX yet - it is much higher compared to previous
run because last time my script
actually counted packages instead of tags.
10325 tags can be trivially converted using `license-fedora2spdx`
The list of packages needed to be converted is again here:
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx...
Any question? Please check
https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1#Questions_fr...
Miroslav
9:43 a.m.
On Thu, Dec 01, 2022 at 10:14:04AM +0100, Miroslav Suchý wrote:
The list of packages needed to be converted is again here:
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx...
Any question? Please check
https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1#Questions_fr...
What does this warning mean?
ladvd warning: valid as old and new and no changelong entry, please check
I can't find this string neither on wiki page nor in license-validate script.
--
Tomasz Torcz There exists no separation between gods and men:
tomek(a)pipebreaker.pl one blends softly casual into the other. — Frank Herbert
7:54 a.m.
Dne 01. 12. 22 v 16:43 Tomasz Torcz napsal(a):
What does this warning mean?
ladvd warning: valid as old and new and no changelong entry, please check
Hmm, let me look. The ladvd license is ICS
https://src.fedoraproject.org/rpms/ladvd/blob/rawhide/f/ladvd.spec#_10
and both
license-validate'ISC'
and
license-validate--old 'ISC'
validate it. I.e. this license is valid as both Callaway **and** SPDX identifier.
It very often happens that the old Callaway id was identifier for the whole family of SPDX
licenses (see MIT license case).
I cannot guess if you investigated whether the old id is valid as the new one too **and**
it reflect the same license.
Or you still did not check it at all and the tag simply describe the old Callaway license
id - and the validity using
spdx rules are pure coincidence.
If you checked that it actually match the SPDX license, then I recommend to put in a
changelog (or even dist-git commit)
a line
- migrated to spdx license
or
- checked that license match spdx identifier
In my script, I actually just check /spdx/i existence in the log.
Miroslav
6:01 a.m.
false negative - especially
the *-fonts because they declare the license using macro, which I am unable to process
(yet).|
Can I put the new tags in the same macro, e.g.:
```
%global foundry ADF
-%global fontlicense GPLv2+ with exceptions
+%global fontlicense GPL-2.0-or-later WITH Font-exception-2.0
%global fontlicenses OTF/COPYING
%global fontdocs NOTICE.txt
```
505
days inactive
525
days old
10 comments
6 participants
participants (6)
-
Kevin Kofler -
Michael J Gruber -
Miro Hrončok -
Miroslav Suchý -
Ralf Corsépius -
Tomasz Torcz