Hi Richard,
On Fri, 2023-11-17 at 13:52 -0500, Richard Fontana wrote:
This seems indeed to match bzip2-1.06 -- Jilayne, I assume the full text of what is wrapped in the <copyrightText> tag could be ignored for purposes of matching? i.e. https://github.com/spdx/license-list-XML/blob/main/src/bzip2-1.0.6.xml#L10-L...
The SPDX Matching Guidelines say: "To avoid a license mismatch merely because the copyright notice (usually found above the actual license or exception text) is different. The copyright notice is important information to be recorded elsewhere in the SPDX document, but for the purposes of matching a license to the SPDX License List, it should be ignored because it is not part of the substantive license text."
but this does not define what a "copyright notice" is. If we don't hear from Jilayne, I'd go ahead with assuming that this is a perfect match. :)
OK, but can we use a more appropriate tag. bzip2-1.0.6 seems a little odd (it is a version of bzip2 with a CVE[*] from a couple of years back). Maybe just call it 'bzip2' or 'Hybrid-BSD' as Fedora used to call it (although it seems to still use the plain 'BSD' tag for it) since it seems to be a generic license used by different projects: https://fedoraproject.org/wiki/Licensing:BSD#Hybrid_BSD_(half_BSD,_half_zlib)
Thanks,
Mark
[*] NVD assigned it a 9.8 Critcal score (!), but it really isn't a security issue (and even if it was a bug, it really didn't have any impact), still hope people have updated their bzip2 though: https://gnu.wildebeest.org/blog/mjw/2019/08/02/bzip2-and-the-cve-that-wasnt/