4:37 p.m.
-------- Přeposlaná zpráva --------
Předmět: SPDX Statistics - University of Constantinople edition
Datum: Mon, 27 Feb 2023 23:34:52 +0100
Od: Miroslav Suchý <msuchy(a)redhat.com>
Společnost: Red Hat Czech, s.r.o.
Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org>
Two weeks ago we had:
* 23029 spec files in Fedora
* 29405 license tags in all spec files
* 22401 tags have not been converted to SPDX yet
* 8795 tags can be trivially converted using `license-fedora2spdx`
Today we have:
* 23060 spec files in Fedora
* 29449license tags in all spec files
* 21194 tags have not been converted to SPDX yet [*]
* 8439 tags can be trivially converted using `license-fedora2spdx`
[*] I have got some reports of packages that have been converted, but does not have
spec/git changelog and I hope I will
edit my scripts to work with some filter list.
The list of packages needed to be converted is again here:
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx...
List by package maintainers is here
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx...
New version of fedora-license-data has been released.
Legal docs and especially
https://docs.fedoraproject.org/en-US/legal/allowed-licenses/
has been updated too.
I updated the progress in this spreadsheet:
https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE80...
You converted 1207 license tags in 14 days. Amazing!
New projection when we will be finished is 2024-06-04. Pure linear approximation.
Did you know?: rpmlint checks if you have correct license. It uses
`rpmlint-fedora-license-data` which is a subpackage
of `fedora-license-data`. So anytime a new version of `fedora-license-data` is released,
rpmlint uses the new data.
Why University of Constantinople? Because on today's day in a year 425 a.d. was found
University of Constantinople. It
lacked the structure of later universities so generally, it is missing in the top of
oldest universities, but it was the
beggining.
https://en.wikipedia.org/wiki/University_of_Constantinople
Do you hesitate how to proceed with the migration? Please follow
https://docs.fedoraproject.org/en-US/legal/update-existing-packages/
or attend SPDX office hours (see different thread in this mailing list)
Miroslav
5:49 p.m.
New subject: Fwd: SPDX Statistics - University of Constantinople edition
On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
8795 tags can be trivially converted using `license-fedora2spdx`
Hello,
running [1] the result is [2]
[1]
askalono crawl libcomps-0.1.19
[2]
libcomps-0.1.19/COPYING
License: GPL-2.0-only (original text)
Score: 0.988
but libcomps.spec have "License: GPLv2+"
running: license-fedora2spdx GPLv2+
GPL-2.0-or-later
what is correct GPL-2.0-only or GPL-2.0-or-later ?
Thank you
--
Sérgio M. B.
8:18 p.m.
New subject: Fwd: SPDX Statistics - University of Constantinople edition
On Tue, Feb 28, 2023 at 6:49 PM Sérgio Basto <sergio(a)serjux.com> wrote:
On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
8795 tags can be trivially converted using `license-fedora2spdx`
Hello,
running [1] the result is [2]
[1]
askalono crawl libcomps-0.1.19
[2]
libcomps-0.1.19/COPYING
License: GPL-2.0-only (original text)
Score: 0.988
but libcomps.spec have "License: GPLv2+"
running: license-fedora2spdx GPLv2+
GPL-2.0-or-later
what is correct GPL-2.0-only or GPL-2.0-or-later ?
This is probably beyond the ability of any tool to reliably determine
(I mean, even more so than license identification in general), and is
particularly way beyond what askalono can figure out since it is (by
design I think) fairly primitive. In particular, askalono AFAIK only
looks at what it thinks are standalone license files, while in GPL
culture the "or later" vs. "only" distinction is typically not made
in
the license file itself.
I took a very quick look at the source code of libcomps version 0.1.18
and concluded 'GPL-2.0-or-later' is likely correct. As far as I could
tell, all source file GPL notices were of the "GPLv2 or any later
version" form. The upstream spec file and setup.py file also indicate
GPLv2+.
Richard
1:55 p.m.
New subject: Fwd: SPDX Statistics - University of Constantinople edition
Dne 01. 03. 23 v 3:18 Richard Fontana napsal(a):
On Tue, Feb 28, 2023 at 6:49 PM Sérgio Basto
<sergio(a)serjux.com> wrote:
> On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
>
> 8795 tags can be trivially converted using `license-fedora2spdx`
>
>
> Hello,
> running [1] the result is [2]
>
> [1]
> askalono crawl libcomps-0.1.19
>
> [2]
> libcomps-0.1.19/COPYING
> License: GPL-2.0-only (original text)
> Score: 0.988
I tried to use license-diff plugin for Firefox and it shows the same score for
GPL-2.0-only and for GPL-2.0-or-later.
And license-diff plugin does not show "any later" as diff when I compare it to
GPL-2.0-only.
> what is correct GPL-2.0-only or GPL-2.0-or-later ?
This is probably beyond the ability of any tool to reliably determine
(I mean, even more so than license identification in general), and is
particularly way beyond what askalono can figure out since it is (by
design I think) fairly primitive. In particular, askalono AFAIK only
looks at what it thinks are standalone license files, while in GPL
culture the "or later" vs. "only" distinction is typically not made
in
the license file itself.
I took a very quick look at the source code of libcomps version 0.1.18
and concluded 'GPL-2.0-or-later' is likely correct. As far as I could
tell, all source file GPL notices were of the "GPLv2 or any later
version" form. The upstream spec file and setup.py file also indicate
GPLv2+.
*nod* It is GPL-2.0-or-later
Miroslav
3:53 p.m.
New subject: Fwd: SPDX Statistics - University of Constantinople edition
On 3/1/23 12:55 PM, Miroslav Suchý wrote:
Dne 01. 03. 23 v 3:18 Richard Fontana napsal(a):
> On Tue, Feb 28, 2023 at 6:49 PM Sérgio Basto <sergio(a)serjux.com> wrote:
>> On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
>>
>> 8795 tags can be trivially converted using `license-fedora2spdx`
>>
>>
>> Hello,
>> running [1] the result is [2]
>>
>> [1]
>> askalono crawl libcomps-0.1.19
>>
>> [2]
>> libcomps-0.1.19/COPYING
>> License: GPL-2.0-only (original text)
>> Score: 0.988
I tried to use license-diff plugin for Firefox and it shows the same
score for GPL-2.0-only and for GPL-2.0-or-later.
And license-diff plugin does not show "any later" as diff when I
compare it to GPL-2.0-only.
that is correct b/c - like license diff is comparing
full text of the
license (kind of like what Richard explains below)... maybe good to add
a note specific to GPL about this in our documentation... and so it
grows... :)
>> what is correct GPL-2.0-only or GPL-2.0-or-later ?
> This is probably beyond the ability of any tool to reliably determine
> (I mean, even more so than license identification in general), and is
> particularly way beyond what askalono can figure out since it is (by
> design I think) fairly primitive. In particular, askalono AFAIK only
> looks at what it thinks are standalone license files, while in GPL
> culture the "or later" vs. "only" distinction is typically not
made in
> the license file itself.
>
> I took a very quick look at the source code of libcomps version 0.1.18
> and concluded 'GPL-2.0-or-later' is likely correct. As far as I could
> tell, all source file GPL notices were of the "GPLv2 or any later
> version" form. The upstream spec file and setup.py file also indicate
> GPLv2+.
*nod* It is GPL-2.0-or-later
Miroslav
_______________________________________________
legal mailing list -- legal(a)lists.fedoraproject.org
To unsubscribe send an email to legal-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
4:07 p.m.
New subject: Fwd: SPDX Statistics - University of Constantinople edition
On Wed, Mar 1, 2023 at 4:53 PM Jilayne Lovejoy <jlovejoy(a)redhat.com> wrote:
On 3/1/23 12:55 PM, Miroslav Suchý wrote:
> Dne 01. 03. 23 v 3:18 Richard Fontana napsal(a):
>> On Tue, Feb 28, 2023 at 6:49 PM Sérgio Basto <sergio(a)serjux.com> wrote:
>>> On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
>>>
>>> 8795 tags can be trivially converted using `license-fedora2spdx`
>>>
>>>
>>> Hello,
>>> running [1] the result is [2]
>>>
>>> [1]
>>> askalono crawl libcomps-0.1.19
>>>
>>> [2]
>>> libcomps-0.1.19/COPYING
>>> License: GPL-2.0-only (original text)
>>> Score: 0.988
>
> I tried to use license-diff plugin for Firefox and it shows the same
> score for GPL-2.0-only and for GPL-2.0-or-later.
>
> And license-diff plugin does not show "any later" as diff when I
> compare it to GPL-2.0-only.
that is correct b/c - like license diff is comparing full text of the
license (kind of like what Richard explains below)... maybe good to add
a note specific to GPL about this in our documentation... and so it
grows... :)
To the extent that license detection tools are reporting
"GPL-2.0-only" based solely on recognition of the GPL version 2
license text, that is unfortunate, and I would argue, a bug in those
tools and a misapplication of SPDX identifiers. This seems to be the
case for askalono. Of course this may be a side effect of the
questionable change SPDX made (resulting, from what I understand, from
lobbying by the FSF) to deprecate the GPL identifiers that don't use
-or-later or -only. :)
(I'm not asserting it *matters* -- that is a more complicated question.)
Richard
4:52 p.m.
New subject: Fwd: SPDX Statistics - University of Constantinople edition
On 3/1/23 3:07 PM, Richard Fontana wrote:
On Wed, Mar 1, 2023 at 4:53 PM Jilayne Lovejoy
<jlovejoy(a)redhat.com> wrote:
>
>
> On 3/1/23 12:55 PM, Miroslav Suchý wrote:
>> Dne 01. 03. 23 v 3:18 Richard Fontana napsal(a):
>>> On Tue, Feb 28, 2023 at 6:49 PM Sérgio Basto <sergio(a)serjux.com>
wrote:
>>>> On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
>>>>
>>>> 8795 tags can be trivially converted using `license-fedora2spdx`
>>>>
>>>>
>>>> Hello,
>>>> running [1] the result is [2]
>>>>
>>>> [1]
>>>> askalono crawl libcomps-0.1.19
>>>>
>>>> [2]
>>>> libcomps-0.1.19/COPYING
>>>> License: GPL-2.0-only (original text)
>>>> Score: 0.988
>> I tried to use license-diff plugin for Firefox and it shows the same
>> score for GPL-2.0-only and for GPL-2.0-or-later.
>>
>> And license-diff plugin does not show "any later" as diff when I
>> compare it to GPL-2.0-only.
> that is correct b/c - like license diff is comparing full text of the
> license (kind of like what Richard explains below)... maybe good to add
> a note specific to GPL about this in our documentation... and so it
> grows... :)
To the extent that license detection tools are reporting
"GPL-2.0-only" based solely on recognition of the GPL version 2
license text, that is unfortunate, and I would argue, a bug in those
tools and a misapplication of SPDX identifiers.
ideally or technically, the tools
would suggest GPL-2.0-only or
GPL-2.0-or-later b/c the license text itself isn't where the
differentiation is identified, so you have to look elsewhere, which I
think you already pointed out.
This seems to be the
case for askalono. Of course this may be a side effect of the
questionable change SPDX made (resulting, from what I understand, from
lobbying by the FSF) to deprecate the GPL identifiers that don't use
-or-later or -only. :)
yes, the change of SPDX identifiers from GPL-2.0 to
represent GPL-2.0 only
and GPL-2.0+ (by way of adding the + operator) to represent GPL-2.0 or later
to
a license-specific listings on the SPDX License List of:
GPL-2.0-only and GPL-2.0-or-later
was due to pressure from the FSF back in 2017 or 2018. You can read blog
posts about it and the rationale if you want.
I suspect that prior to that, tool makers and others used "GPL-2.0" to
mean: the specific text of the license itself, I'm not sure if it's
"only" or "or later"; and just only that version. Which is what the
FSF
didn't like.
One of the proposals that the SPDX community came up with at that time
was to have GPL-2.0 mean that text of the license itself or I'm not sure
if it's "only" or "or later" and then add an operator to the
license
expression syntax that meant "only" (along the lines of + meaning "or
later"). This would have been much easier for license scanning tools to
consume. But that solution was rejected by the FSF.
Sometimes community leadership is hard.
(I'm not asserting it *matters* -- that is a more complicated question.)
Richard
7:57 a.m.
New subject: Fwd: SPDX Statistics - University of Constantinople edition
On Thu, Mar 2, 2023 at 5:52 PM Jilayne Lovejoy <jlovejoy(a)redhat.com> wrote:
yes, the change of SPDX identifiers from GPL-2.0 to represent GPL-2.0 only
and GPL-2.0+ (by way of adding the + operator) to represent GPL-2.0 or later
to
a license-specific listings on the SPDX License List of:
GPL-2.0-only and GPL-2.0-or-later
was due to pressure from the FSF back in 2017 or 2018. You can read blog
posts about it and the rationale if you want.
I suspect that prior to that, tool makers and others used "GPL-2.0" to
mean: the specific text of the license itself, I'm not sure if it's
"only" or "or later"; and just only that version. Which is what the
FSF
didn't like.
One of the proposals that the SPDX community came up with at that time
was to have GPL-2.0 mean that text of the license itself or I'm not sure
if it's "only" or "or later" and then add an operator to the
license
expression syntax that meant "only" (along the lines of + meaning "or
later"). This would have been much easier for license scanning tools to
consume. But that solution was rejected by the FSF.
Sometimes community leadership is hard.
If I could make a suggestion to the SPDX legal team: adopt a rule or
guiding principle that "license stewards are not stakeholders". :)
Richard
417
days inactive
421
days old
7 comments
4 participants
participants (4)
-
Jilayne Lovejoy -
Miroslav Suchý -
Richard Fontana -
Sérgio Basto