-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - University of Constantinople edition Datum: Mon, 27 Feb 2023 23:34:52 +0100 Od: Miroslav Suchý msuchy@redhat.com Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora devel@lists.fedoraproject.org
Two weeks ago we had:
23029 spec files in Fedora
29405 license tags in all spec files
22401 tags have not been converted to SPDX yet
8795 tags can be trivially converted using `license-fedora2spdx`
Today we have:
* 23060 spec files in Fedora
* 29449license tags in all spec files
* 21194 tags have not been converted to SPDX yet [*]
* 8439 tags can be trivially converted using `license-fedora2spdx`
[*] I have got some reports of packages that have been converted, but does not have spec/git changelog and I hope I will edit my scripts to work with some filter list.
The list of packages needed to be converted is again here:
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-fi...
List by package maintainers is here
https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-fi...
New version of fedora-license-data has been released.
Legal docs and especially
https://docs.fedoraproject.org/en-US/legal/allowed-licenses/
has been updated too.
I updated the progress in this spreadsheet:
https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807rp...
You converted 1207 license tags in 14 days. Amazing!
New projection when we will be finished is 2024-06-04. Pure linear approximation.
Did you know?: rpmlint checks if you have correct license. It uses `rpmlint-fedora-license-data` which is a subpackage of `fedora-license-data`. So anytime a new version of `fedora-license-data` is released, rpmlint uses the new data.
Why University of Constantinople? Because on today's day in a year 425 a.d. was found University of Constantinople. It lacked the structure of later universities so generally, it is missing in the top of oldest universities, but it was the beggining.
https://en.wikipedia.org/wiki/University_of_Constantinople
Do you hesitate how to proceed with the migration? Please follow
https://docs.fedoraproject.org/en-US/legal/update-existing-packages/
or attend SPDX office hours (see different thread in this mailing list)
Miroslav
On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
8795 tags can be trivially converted using `license-fedora2spdx`
Hello, running [1] the result is [2]
[1] askalono crawl libcomps-0.1.19
[2] libcomps-0.1.19/COPYING License: GPL-2.0-only (original text) Score: 0.988
but libcomps.spec have "License: GPLv2+"
running: license-fedora2spdx GPLv2+ GPL-2.0-or-later
what is correct GPL-2.0-only or GPL-2.0-or-later ?
Thank you
On Tue, Feb 28, 2023 at 6:49 PM Sérgio Basto sergio@serjux.com wrote:
On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
8795 tags can be trivially converted using `license-fedora2spdx`
Hello, running [1] the result is [2]
[1] askalono crawl libcomps-0.1.19
[2] libcomps-0.1.19/COPYING License: GPL-2.0-only (original text) Score: 0.988
but libcomps.spec have "License: GPLv2+"
running: license-fedora2spdx GPLv2+ GPL-2.0-or-later
what is correct GPL-2.0-only or GPL-2.0-or-later ?
This is probably beyond the ability of any tool to reliably determine (I mean, even more so than license identification in general), and is particularly way beyond what askalono can figure out since it is (by design I think) fairly primitive. In particular, askalono AFAIK only looks at what it thinks are standalone license files, while in GPL culture the "or later" vs. "only" distinction is typically not made in the license file itself.
I took a very quick look at the source code of libcomps version 0.1.18 and concluded 'GPL-2.0-or-later' is likely correct. As far as I could tell, all source file GPL notices were of the "GPLv2 or any later version" form. The upstream spec file and setup.py file also indicate GPLv2+.
Richard
Dne 01. 03. 23 v 3:18 Richard Fontana napsal(a):
On Tue, Feb 28, 2023 at 6:49 PM Sérgio Basto sergio@serjux.com wrote:
On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
8795 tags can be trivially converted using `license-fedora2spdx`
Hello, running [1] the result is [2]
[1] askalono crawl libcomps-0.1.19
[2] libcomps-0.1.19/COPYING License: GPL-2.0-only (original text) Score: 0.988
I tried to use license-diff plugin for Firefox and it shows the same score for GPL-2.0-only and for GPL-2.0-or-later.
And license-diff plugin does not show "any later" as diff when I compare it to GPL-2.0-only.
what is correct GPL-2.0-only or GPL-2.0-or-later ?
This is probably beyond the ability of any tool to reliably determine (I mean, even more so than license identification in general), and is particularly way beyond what askalono can figure out since it is (by design I think) fairly primitive. In particular, askalono AFAIK only looks at what it thinks are standalone license files, while in GPL culture the "or later" vs. "only" distinction is typically not made in the license file itself.
I took a very quick look at the source code of libcomps version 0.1.18 and concluded 'GPL-2.0-or-later' is likely correct. As far as I could tell, all source file GPL notices were of the "GPLv2 or any later version" form. The upstream spec file and setup.py file also indicate GPLv2+.
*nod* It is GPL-2.0-or-later
Miroslav
On 3/1/23 12:55 PM, Miroslav Suchý wrote:
Dne 01. 03. 23 v 3:18 Richard Fontana napsal(a):
On Tue, Feb 28, 2023 at 6:49 PM Sérgio Basto sergio@serjux.com wrote:
On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
8795 tags can be trivially converted using `license-fedora2spdx`
Hello, running [1] the result is [2]
[1] askalono crawl libcomps-0.1.19
[2] libcomps-0.1.19/COPYING License: GPL-2.0-only (original text) Score: 0.988
I tried to use license-diff plugin for Firefox and it shows the same score for GPL-2.0-only and for GPL-2.0-or-later.
And license-diff plugin does not show "any later" as diff when I compare it to GPL-2.0-only.
that is correct b/c - like license diff is comparing full text of the license (kind of like what Richard explains below)... maybe good to add a note specific to GPL about this in our documentation... and so it grows... :)
what is correct GPL-2.0-only or GPL-2.0-or-later ?
This is probably beyond the ability of any tool to reliably determine (I mean, even more so than license identification in general), and is particularly way beyond what askalono can figure out since it is (by design I think) fairly primitive. In particular, askalono AFAIK only looks at what it thinks are standalone license files, while in GPL culture the "or later" vs. "only" distinction is typically not made in the license file itself.
I took a very quick look at the source code of libcomps version 0.1.18 and concluded 'GPL-2.0-or-later' is likely correct. As far as I could tell, all source file GPL notices were of the "GPLv2 or any later version" form. The upstream spec file and setup.py file also indicate GPLv2+.
*nod* It is GPL-2.0-or-later
Miroslav _______________________________________________ legal mailing list -- legal@lists.fedoraproject.org To unsubscribe send an email to legal-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
On Wed, Mar 1, 2023 at 4:53 PM Jilayne Lovejoy jlovejoy@redhat.com wrote:
On 3/1/23 12:55 PM, Miroslav Suchý wrote:
Dne 01. 03. 23 v 3:18 Richard Fontana napsal(a):
On Tue, Feb 28, 2023 at 6:49 PM Sérgio Basto sergio@serjux.com wrote:
On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
8795 tags can be trivially converted using `license-fedora2spdx`
Hello, running [1] the result is [2]
[1] askalono crawl libcomps-0.1.19
[2] libcomps-0.1.19/COPYING License: GPL-2.0-only (original text) Score: 0.988
I tried to use license-diff plugin for Firefox and it shows the same score for GPL-2.0-only and for GPL-2.0-or-later.
And license-diff plugin does not show "any later" as diff when I compare it to GPL-2.0-only.
that is correct b/c - like license diff is comparing full text of the license (kind of like what Richard explains below)... maybe good to add a note specific to GPL about this in our documentation... and so it grows... :)
To the extent that license detection tools are reporting "GPL-2.0-only" based solely on recognition of the GPL version 2 license text, that is unfortunate, and I would argue, a bug in those tools and a misapplication of SPDX identifiers. This seems to be the case for askalono. Of course this may be a side effect of the questionable change SPDX made (resulting, from what I understand, from lobbying by the FSF) to deprecate the GPL identifiers that don't use -or-later or -only. :)
(I'm not asserting it *matters* -- that is a more complicated question.)
Richard
On 3/1/23 3:07 PM, Richard Fontana wrote:
On Wed, Mar 1, 2023 at 4:53 PM Jilayne Lovejoy jlovejoy@redhat.com wrote:
On 3/1/23 12:55 PM, Miroslav Suchý wrote:
Dne 01. 03. 23 v 3:18 Richard Fontana napsal(a):
On Tue, Feb 28, 2023 at 6:49 PM Sérgio Basto sergio@serjux.com wrote:
On Mon, 2023-02-27 at 23:37 +0100, Miroslav Suchý wrote:
8795 tags can be trivially converted using `license-fedora2spdx`
Hello, running [1] the result is [2]
[1] askalono crawl libcomps-0.1.19
[2] libcomps-0.1.19/COPYING License: GPL-2.0-only (original text) Score: 0.988
I tried to use license-diff plugin for Firefox and it shows the same score for GPL-2.0-only and for GPL-2.0-or-later.
And license-diff plugin does not show "any later" as diff when I compare it to GPL-2.0-only.
that is correct b/c - like license diff is comparing full text of the license (kind of like what Richard explains below)... maybe good to add a note specific to GPL about this in our documentation... and so it grows... :)
To the extent that license detection tools are reporting "GPL-2.0-only" based solely on recognition of the GPL version 2 license text, that is unfortunate, and I would argue, a bug in those tools and a misapplication of SPDX identifiers.
ideally or technically, the tools would suggest GPL-2.0-only or GPL-2.0-or-later b/c the license text itself isn't where the differentiation is identified, so you have to look elsewhere, which I think you already pointed out.
This seems to be the case for askalono. Of course this may be a side effect of the questionable change SPDX made (resulting, from what I understand, from lobbying by the FSF) to deprecate the GPL identifiers that don't use -or-later or -only. :)
yes, the change of SPDX identifiers from GPL-2.0 to represent GPL-2.0 only and GPL-2.0+ (by way of adding the + operator) to represent GPL-2.0 or later to a license-specific listings on the SPDX License List of: GPL-2.0-only and GPL-2.0-or-later
was due to pressure from the FSF back in 2017 or 2018. You can read blog posts about it and the rationale if you want.
I suspect that prior to that, tool makers and others used "GPL-2.0" to mean: the specific text of the license itself, I'm not sure if it's "only" or "or later"; and just only that version. Which is what the FSF didn't like.
One of the proposals that the SPDX community came up with at that time was to have GPL-2.0 mean that text of the license itself or I'm not sure if it's "only" or "or later" and then add an operator to the license expression syntax that meant "only" (along the lines of + meaning "or later"). This would have been much easier for license scanning tools to consume. But that solution was rejected by the FSF.
Sometimes community leadership is hard.
(I'm not asserting it *matters* -- that is a more complicated question.)
Richard
On Thu, Mar 2, 2023 at 5:52 PM Jilayne Lovejoy jlovejoy@redhat.com wrote:
yes, the change of SPDX identifiers from GPL-2.0 to represent GPL-2.0 only and GPL-2.0+ (by way of adding the + operator) to represent GPL-2.0 or later to a license-specific listings on the SPDX License List of: GPL-2.0-only and GPL-2.0-or-later
was due to pressure from the FSF back in 2017 or 2018. You can read blog posts about it and the rationale if you want.
I suspect that prior to that, tool makers and others used "GPL-2.0" to mean: the specific text of the license itself, I'm not sure if it's "only" or "or later"; and just only that version. Which is what the FSF didn't like.
One of the proposals that the SPDX community came up with at that time was to have GPL-2.0 mean that text of the license itself or I'm not sure if it's "only" or "or later" and then add an operator to the license expression syntax that meant "only" (along the lines of + meaning "or later"). This would have been much easier for license scanning tools to consume. But that solution was rejected by the FSF.
Sometimes community leadership is hard.
If I could make a suggestion to the SPDX legal team: adopt a rule or guiding principle that "license stewards are not stakeholders". :)
Richard