On 6/21/24 7:11 AM, Richard Fontana wrote:
On Fri, Jun 21, 2024 at 5:27 AM Vít Ondruch <vondruch@redhat.com> wrote:

But the intent of both is to be temporary, to help understand where we
need to put some work. If this was initial status:

~~~
License: GPLv2 and MIT
~~~

and prior any SPDX work, we would change all .spec files to:

~~~
License: callaway(GPLv2 and MIT)
~~~

And slowly worked forward to:

~~~
License: GPL-2.0-only AND callaway(MIT)
~~~

and finally:

~~~
License: GPL-2.0-only AND MIT
~~~

We would know where we are. Now, nobody knows. We still have to use
something like changelog messages and what not, which is hardly better.

We could even mark packages with e.g. `Provides: license(callaway)`,
which would make easier to query where we stand.

IMHO it is still is not late to do something like this!
Could we wrap remaining Callaway names in a `LicenseRef-` (similar to
your "callaway(MIT)" idea but sort of SPDX-conformant)?
Red Hat is doing something like this in RHEL SBOMs, currently.

Jilayne?

if we wanted to go this route, then yes, adding "LicenseRef-" to the non-SPDX ids would be a better route.

The only thing is - where there are Callaway ids that are also SPDX-conformant, e.g., "MIT" but have different meanings.
But I suppose we simply wouldn't touch those, as they need to be manually inspected in any case?

(Disclaimer: off top of head, on a Friday afternoon.)

j.

Richard
--
_______________________________________________
legal mailing list -- legal@lists.fedoraproject.org
To unsubscribe send an email to legal-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue