Hello everyone!
Are you heading to FOSDEM? Join us for a one-day workshop for
developers and users of open source SCA, SBOM, and license and
security compliance tools.
This is on Friday, January 31, 2025 in Brussels, just before FOSDEM 2025
https://workshop.aboutcode.org
If you are involved with Fedora legal issues around open source
license compliance, you are super welcome to join!
The program will be a single track unconference with the day split in
two: tools developers share their plans in the morning and users share
their requirements in the afternoon. Then we will be trying to
hopefully match requirements and plans, and hatch some plans for
cross-project collaboration.
This is the 4th time we have this event, and we expect a who-s-who in
the space to join for the day, like last year where we were about 75
participants and had a blast!
Registration is required. We have free tickets available for the
community, but we encourage your contributions to help us pay for the
event's expenses!
Visit https://workshop.aboutcode.org
We're also looking for generous sponsors to help fund the venue and
catering - you can contribute online directly or email me directly at
pombredanne(a)aboutcode.org
I look forward to seeing you there.
--
Cordially
Philippe Ombredanne
AboutCode.org
AboutCode - Open source for open source - https://www.aboutcode.org
VulnerableCode - the open code and open data vulnerability database
ScanCode - scan your code, for origin/license/vulnerabilities, report SBOMs
package-url - the mostly universal and essential SBOM identifier for packages
DejaCode - What's in your code?!
-------- Přeposlaná zpráva --------
Předmět: SPDX Statistics - 161 packages remaining
Datum: Fri, 10 Jan 2025 07:07:35 +0100
Od: Miroslav Suchý <msuchy(a)redhat.com>
Společnost: Red Hat Czech, s.r.o.
Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org>
Hot news:
- New version of upstream SPDX list has been released
https://github.com/spdx/license-list-XML/releases/tag/v3.26.0
Most of the licenses were added due to Fedora.
Three weeks (because of Christmas) ago we had:
> * 24368spec files in Fedora
>
> * 31025license tags in all spec files
>
> * 224 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*)
>
> * 2475 tags have not been converted to SPDX yet
>
> * 21 tags can be trivially converted using `license-fedora2spdx`
>
> * Progress: 99.28% ░░░░░░░░░█100%
>
> ELN subset:
>
> 62 out of 2314 packages are not converted yet (progress 97.32%)
>
Today we have:
* 24379spec files in Fedora
* 30988license tags in all spec files
* 161 tags are not SPDX compliant (number from line bellow minus packages with LicenseRef-Callaway-*)
* 2325 tags have not been converted to SPDX yet
* 21 tags can be trivially converted using `license-fedora2spdx`
* Progress: 99.48% ░░░░░░░░░█100%
ELN subset:
61 out of 2316 packages are not converted yet (progress 97.37%)
Graph of these data with the burndown chart:
https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r…
The list of packages needed to be converted is here:
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
List by package maintainers is here
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f…
Packages that are neither in SPDX nor in Callaway format (highest priority for now) - 55 packages:
https://pagure.io/copr/license-validate/blob/main/f/neither-nor-remaining-p…
Most of such packages has open issue in fedora-license-data. A lot of them are waiting for SPDX to approved the license
and assign ID.
New version of fedora-license-data has been released. With:
3 new licenses and several public domain or ultrapermissive dedications
12 licenses are waiting to be reviewed by SPDX.org (and then to be added to fedora-license-data)
https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B…
Legal docs and especially
https://docs.fedoraproject.org/en-US/legal/allowed-licenses/
was updated too.
If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license
tag matches SPDX formula, you can put your package on ignore list
https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt
Either pull-request or direct email to me is fine.
Miroslav