Hello,
I would like to ask for your consent with me making a particular license-checking program as a thesis assignment. This program would be about to be deployed in production, mostly in Fedora package reviewing, or for the use of individual developers outside Fedora. The problem is that the information obtained by usage of the program or disclosing obtained data could be harmful towards Fedora. Please read on for details.
The assignment is to invent a tool that:
- searches a software project (for the purpose of the thesis, only a Java software project, but more language-specific modules are intended in the future) - determines the project's license (the means of doing that, beyond checking the license header, are to be invented) - reports any problems or license incompatibilities found (mostly as warnings, I expect most of the checks to be based on heuristics) - stores data in a publicly available database to speed up the process and share information, taking into consideration different builds of packages, different versions etc.
The assignment also requires devising a way to manage the database, user contributions, credibility of such etc.
It is to be noted that even though checking the compliance with Fedora licensing is a duty of every reviewer, my experience shows that it is beyond a standard package reviewer to see problems such as copy/pasted code, several classes taken from a different project with a different license (when a header is missing) etc. The aim of this program would be to help mainly with these problems as they often go unnoticed even now.
The problem is that for a successful defense of the thesis, it would be necessary (admittedly not vital) to publish the source code of the program and probably the database properties as well. I am aware that disclosing the data accumulated while checking projects in Fedora could have potentially devastating consequences, therefore I would only publish the source code of the program and bindings to a database system, which a user would need to run separately from Fedora, thus not revealing the internal data to the public. My thesis advisor deemed this idea to be satisfactory for the academia.
What I would like to ask you is if you too consider the execution of this project to be safe enough to be done and not threaten Fedora, e. g. by pointing out unnoticed licensing issues to a malefactor.
Thank you, Tomas Radej FAS: tradej
On 02/28/2012 11:00 AM, Tomas Radej wrote:
What I would like to ask you is if you too consider the execution of this project to be safe enough to be done and not threaten Fedora, e. g. by pointing out unnoticed licensing issues to a malefactor.
Should be fine. Any issues you find will be issues we want to address. Have you looked at FOSSology?
~tom
== Fedora Project
On Wed, Feb 29, 2012 at 09:46:17AM -0500, Tom Callaway wrote:
On 02/28/2012 11:00 AM, Tomas Radej wrote:
What I would like to ask you is if you too consider the execution of this project to be safe enough to be done and not threaten Fedora, e. g. by pointing out unnoticed licensing issues to a malefactor.
Should be fine. Any issues you find will be issues we want to address. Have you looked at FOSSology?
You may also wish to look at Daniel German's work at the University of Victoria if you are not already familiar with it.
- Richard
On Wed, 29 Feb 2012 10:22:08 -0500 Richard Fontana rfontana@redhat.com wrote:
On Wed, Feb 29, 2012 at 09:46:17AM -0500, Tom Callaway wrote:
On 02/28/2012 11:00 AM, Tomas Radej wrote:
What I would like to ask you is if you too consider the execution of this project to be safe enough to be done and not threaten Fedora, e. g. by pointing out unnoticed licensing issues to a malefactor.
Should be fine. Any issues you find will be issues we want to address. Have you looked at FOSSology?
You may also wish to look at Daniel German's work at the University of Victoria if you are not already familiar with it.
- Richard
Hi,
To Tom: I have, but I think it does something slightly different (the NOMOS License scanner, that is). However, I can make my program with contribution to FOSSology in mind.
To Richard: Thank you, I didn't know Mr. German or his work, it indeed is interesting.
To all: Thank you for consent, I will then embark on this project.
On 02/29/2012 01:24 PM, Tomas Radej wrote:
On Wed, 29 Feb 2012 10:22:08 -0500 Richard Fontana rfontana@redhat.com wrote:
On Wed, Feb 29, 2012 at 09:46:17AM -0500, Tom Callaway wrote:
On 02/28/2012 11:00 AM, Tomas Radej wrote:
What I would like to ask you is if you too consider the execution of this project to be safe enough to be done and not threaten Fedora, e. g. by pointing out unnoticed licensing issues to a malefactor.
Should be fine. Any issues you find will be issues we want to address. Have you looked at FOSSology?
You may also wish to look at Daniel German's work at the University of Victoria if you are not already familiar with it.
- Richard
Hi,
To Tom: I have, but I think it does something slightly different (the NOMOS License scanner, that is). However, I can make my program with contribution to FOSSology in mind.
Please note, I was just pointing out FOSSology as a similar player in the same thought-space, not requiring that you contribute to it in order to have "Fedora's blessing". :)
~tom
== Fedora Project
2012/2/28 Tomas Radej tradej@redhat.com:
Hello,
I would like to ask for your consent with me making a particular license-checking program as a thesis assignment. This program would be about to be deployed in production, mostly in Fedora package reviewing, or for the use of individual developers outside Fedora. The problem is that the information obtained by usage of the program or disclosing obtained data could be harmful towards Fedora. Please read on for details.
A bitter truth is better than the sweet lie. IANAL but I'd like to see something like this - fully automated "early prevention program" to detect some license incompatibilities (or impossibility to detect licensing terms)/.
-
Peter Lemenkov -
Richard Fontana -
Tom Callaway -
Tomas Radej