General Meeting/License Field Discussion - Revision history

MartinMichlmayr: Convert to MediaWiki syntax

2013-03-06T11:28:39Z

Convert to MediaWiki syntax

Jnweiger: oops, this should have been a comment, not an edit.

2011-06-10T19:02:47Z

oops, this should have been a comment, not an edit.

Jnweiger at 16:13, 10 June 2011

2011-06-10T16:13:07Z

Podence at 22:22, 9 June 2011

2011-06-09T22:22:10Z

Podence at 22:21, 9 June 2011

2011-06-09T22:21:07Z

New page

There have been multiple discussions in different working groups about the nomenclature, meaning and intent of the package license fields. To ensure we are all on the right page, we want ot have some wiki-based discussion about the fields with perhaps some examples and use cases tha that we can capture for documentation, FAQs, etc. We may need to go thru this same exercise at the file level, but let's start here. Below is extracted (though for simplicity, not 100% complete) text from the June 5 rev of the spec (http://www.spdx.org/wiki/spdx/specification). Please make comments or ask questions and identify yourself.4.9 Declared License4.9.1 Purpose: This field lists the licenses that have been declared by the authors of the package. Any license information that does not originate from the package authors, e.g. license information from a third party repository, should not be included in this field... 


4.9.2 Intent: This is simply the license identified in text in the actual package source code files. This field is not intended to capture license information obtained from an external source, such as the package website. Such information can be included in 4.7 Concluded License. This field may have multiple declared licenses, if multiple licenses are declared at the package level... 


4.7 Concluded License4.7.1 Purpose: TThis field contains the license the creator has concluded as governing the package or alternative values, if the governing license cannot be determined... 


4.7.2 Intent: Here, the intent is to have the reviewer analyze the license information in package, and other objective information, e.g., COPYING.txt file etc., together with the results from any scanning tools, to arrive at a reasonably objective conclusion as to what license governs the package.So, what do you think? Is the distinction clear between the two fields?Are both useful?Can you provide examples of where they are useful?Do you have an example that raises issues?

@@ Line 1: / Line 1: @@
-<p>There have been multiple discussions in different working groups about the nomenclature, meaning and intent of the package license fields. To ensure we are all on the right page, we want ot have some wiki-based discussion about the fields with perhaps some examples and use cases tha that we can capture for documentation, FAQs, etc. We may need to go thru this same exercise at the file level, but let's start here.&nbsp;</p><p>Below is extracted (though for simplicity, not 100% complete) text from the June 5 rev of the spec (http://www.spdx.org/wiki/spdx/specification). Please make comments or ask questions and identify yourself.</p><p style="padding-left: 30px;"><em>4.9 Declared License</em></p><p style="padding-left: 60px;"><em>4.9.1 Purpose:&nbsp;<span style="font-family: Helvetica;">This field lists the licenses that have been declared by the authors of the package. Any license information that does not originate from the package authors, e.g. license information from a third party repository, should not be included in this field...</span></em></p>
+There have been multiple discussions in different working groups about the nomenclature, meaning and intent of the package license fields. To ensure we are all on the right page, we want ot have some wiki-based discussion about the fields with perhaps some examples and use cases tha that we can capture for documentation, FAQs, etc. We may need to go thru this same exercise at the file level, but let's start here.
-<!--
-p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
--->
-<p style="padding-left: 60px;"><em><span style="font-family: Helvetica;">4.9.2 Intent:&nbsp;</span><span style="font-family: Helvetica;">This is simply the license identified in text in the actual package source code files. This field is not intended to capture license information obtained from an external source, such as the package website. Such information can be included in 4.7 Concluded License. This field may have multiple declared licenses, if multiple licenses are declared at the package level...</span></em></p>
+''4.9 Declared License''
-<!--
-p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
--->
-<p style="padding-left: 30px;"><em>4.7 Concluded License</em></p><p style="padding-left: 60px;"><em>4.7.1 Purpose:&nbsp;<span style="font-family: Helvetica;">T</span><span style="font-family: Helvetica;">This field contains the license the creator has concluded as governing the package or alternative values, if the governing license cannot be determined...</span></em></p>
+''4.9.2 Intent: This is simply the license identified in text in the actual package source code files. This field is not intended to capture license information obtained from an external source, such as the package website. Such information can be included in 4.7 Concluded License. This field may have multiple declared licenses, if multiple licenses are declared at the package level...''
-<!--
-p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
--->
-<p style="padding-left: 60px;"><em><span style="font-family: Helvetica;">4.7.2 Intent:&nbsp;</span><span style="font-family: Helvetica;">Here, the intent is to have the reviewer analyze the license information in package, and other objective information, e.g., COPYING.txt file etc., together with the results from any scanning tools, to arrive at a reasonably objective conclusion as to what license governs the package.</span></em></p><p>So, what do you think?&nbsp;</p><p style="padding-left: 30px;">Is the distinction clear between the two fields?</p><p style="padding-left: 30px;">Are both useful?</p><p style="padding-left: 30px;">Can you provide examples of where they are useful?</p><p style="padding-left: 30px;">Do you have an example that raises issues?</p><p>&nbsp;</p>
+''4.7.1 Purpose: TThis field contains the license the creator has concluded as governing the package or alternative values, if the governing license cannot be determined...''
-<!--
-p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
+''4.7.2 Intent: Here, the intent is to have the reviewer analyze the license information in package, and other objective information, e.g., COPYING.txt file etc., together with the results from any scanning tools, to arrive at a reasonably objective conclusion as to what license governs the package.''
--->

@@ Line 17: / Line 17: @@
-<p style="padding-left: 60px;"><em><span style="font-family: Helvetica;">4.7.2 Intent:&nbsp;</span><span style="font-family: Helvetica;">Here, the intent is to have the reviewer analyze the license information in package, and other objective information, e.g., COPYING.txt file etc., together with the results from any scanning tools, to arrive at a reasonably objective conclusion as to what license governs the package.</span></em></p><p>So, what do you think?&nbsp;</p><p style="padding-left: 30px;">Is the distinction clear between the two fields?</p><p style="padding-left: 30px;">Are both useful?</p><p style="padding-left: 30px;">Can you provide examples of where they are useful?</p><p style="padding-left: 30px;">Do you have an example that raises issues?</p><p>jw@suse.de (2011-06-10):</p><p style="padding-left: 30px;">The distinction is useful and important. Reading 4.9.2, I am surprised to it defined based on all source code files. For any bigger package, this is going to be many licenses. The better the scanning tool, the more get added here. The name declared license implies to me, the license that the autho would use when talking about his work. Simplicity would be paramount. Example: Ask the FSF about gcc-4.5, they would respond with "GPL-3.0+". This is what I'd call the declared license. Going into the files with a scanner&nbsp; I get a collection like this "GPL-2.0+; GPL-2.0+(with linking); X11-MIT; LGPL-2.1+; LGPL-2.1+(with linking); BSD-3-Clause; GFDL-1.2; GFDL-1.1; Public-Domain; Zlib-License; EPL-1.0; BSD-4-Clause(UCB)". Is this the declared license? </p><p style="padding-left: 30px;">If so, we'd need a third field to grasp the simplified concept that "gcc-4.5 is said to be under GPL-3.0+" The usefulness of this inaccuracy is it simplicity. But then, three fields "for basically the same thing" may already be too many, and thus become confusing again.</p><p style="padding-left: 30px;">4.7. is per definition opinionated. It should always be clear, who is the respective reviewer; Would the Schema allow this field multiple times, in case we want to document differning conclusions from multiple reviewers?</p><p>---</p>
+<p style="padding-left: 60px;"><em><span style="font-family: Helvetica;">4.7.2 Intent:&nbsp;</span><span style="font-family: Helvetica;">Here, the intent is to have the reviewer analyze the license information in package, and other objective information, e.g., COPYING.txt file etc., together with the results from any scanning tools, to arrive at a reasonably objective conclusion as to what license governs the package.</span></em></p><p>So, what do you think?&nbsp;</p><p style="padding-left: 30px;">Is the distinction clear between the two fields?</p><p style="padding-left: 30px;">Are both useful?</p><p style="padding-left: 30px;">Can you provide examples of where they are useful?</p><p style="padding-left: 30px;">Do you have an example that raises issues?</p><p>&nbsp;</p>
-<!--
-p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
--->
-−
-−
-<p>&nbsp;</p>
-<!--
-p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
--->
-−
-−
-<p>&nbsp;</p>
-<!--
-p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
--->
-−
-−
 <p>&nbsp;</p>
 <!--
 p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
 -->

@@ Line 17: / Line 17: @@
-<p style="padding-left: 60px;"><em><span style="font-family: Helvetica;">4.7.2 Intent:&nbsp;</span><span style="font-family: Helvetica;">Here, the intent is to have the reviewer analyze the license information in package, and other objective information, e.g., COPYING.txt file etc., together with the results from any scanning tools, to arrive at a reasonably objective conclusion as to what license governs the package.</span></em></p><p>So, what do you think?&nbsp;</p><p style="padding-left: 30px;">Is the distinction clear between the two fields?</p><p style="padding-left: 30px;">Are both useful?</p><p style="padding-left: 30px;">Can you provide examples of where they are useful?</p><p style="padding-left: 30px;">Do you have an example that raises issues?</p><p>&nbsp;</p>
+<p style="padding-left: 60px;"><em><span style="font-family: Helvetica;">4.7.2 Intent:&nbsp;</span><span style="font-family: Helvetica;">Here, the intent is to have the reviewer analyze the license information in package, and other objective information, e.g., COPYING.txt file etc., together with the results from any scanning tools, to arrive at a reasonably objective conclusion as to what license governs the package.</span></em></p><p>So, what do you think?&nbsp;</p><p style="padding-left: 30px;">Is the distinction clear between the two fields?</p><p style="padding-left: 30px;">Are both useful?</p><p style="padding-left: 30px;">Can you provide examples of where they are useful?</p><p style="padding-left: 30px;">Do you have an example that raises issues?</p><p>jw@suse.de (2011-06-10):</p><p style="padding-left: 30px;">The distinction is useful and important. Reading 4.9.2, I am surprised to it defined based on all source code files. For any bigger package, this is going to be many licenses. The better the scanning tool, the more get added here. The name declared license implies to me, the license that the autho would use when talking about his work. Simplicity would be paramount. Example: Ask the FSF about gcc-4.5, they would respond with "GPL-3.0+". This is what I'd call the declared license. Going into the files with a scanner&nbsp; I get a collection like this "GPL-2.0+; GPL-2.0+(with linking); X11-MIT; LGPL-2.1+; LGPL-2.1+(with linking); BSD-3-Clause; GFDL-1.2; GFDL-1.1; Public-Domain; Zlib-License; EPL-1.0; BSD-4-Clause(UCB)". Is this the declared license? </p><p style="padding-left: 30px;">If so, we'd need a third field to grasp the simplified concept that "gcc-4.5 is said to be under GPL-3.0+" The usefulness of this inaccuracy is it simplicity. But then, three fields "for basically the same thing" may already be too many, and thus become confusing again.</p><p style="padding-left: 30px;">4.7. is per definition opinionated. It should always be clear, who is the respective reviewer; Would the Schema allow this field multiple times, in case we want to document differning conclusions from multiple reviewers?</p><p>---</p>
 <!--
 p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}

@@ Line 1: / Line 1: @@
-<p>There have been multiple discussions in different working groups about the nomenclature, meaning and intent of the package license fields. To ensure we are all on the right page, we want ot have some wiki-based discussion about the fields with perhaps some examples and use cases tha that we can capture for documentation, FAQs, etc. We may need to go thru this same exercise at the file level, but let's start here.&nbsp;</p><p>Below is extracted (though for simplicity, not 100% complete) text from the June 5 rev of the spec (http://www.spdx.org/wiki/spdx/specification). Please make comments or ask questions and identify yourself.</p><p><em>4.9 Declared License</em></p><p style="padding-left: 30px;"><em>4.9.1 Purpose:&nbsp;<span style="font-family: Helvetica;">This field lists the licenses that have been declared by the authors of the package. Any license information that does not originate from the package authors, e.g. license information from a third party repository, should not be included in this field...</span></em></p><p>&nbsp;</p>
+<p>There have been multiple discussions in different working groups about the nomenclature, meaning and intent of the package license fields. To ensure we are all on the right page, we want ot have some wiki-based discussion about the fields with perhaps some examples and use cases tha that we can capture for documentation, FAQs, etc. We may need to go thru this same exercise at the file level, but let's start here.&nbsp;</p><p>Below is extracted (though for simplicity, not 100% complete) text from the June 5 rev of the spec (http://www.spdx.org/wiki/spdx/specification). Please make comments or ask questions and identify yourself.</p><p style="padding-left: 30px;"><em>4.9 Declared License</em></p><p style="padding-left: 60px;"><em>4.9.1 Purpose:&nbsp;<span style="font-family: Helvetica;">This field lists the licenses that have been declared by the authors of the package. Any license information that does not originate from the package authors, e.g. license information from a third party repository, should not be included in this field...</span></em></p>
 <!--
 p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
@@ Line 5: / Line 5: @@
-<p style="padding-left: 30px;"><em><span style="font-family: Helvetica;">4.9.2 Intent:&nbsp;</span><span style="font-family: Helvetica;">This is simply the license identified in text in the actual package source code files. This field is not intended to capture license information obtained from an external source, such as the package website. Such information can be included in 4.7 Concluded License. This field may have multiple declared licenses, if multiple licenses are declared at the package level...</span></em></p><p>&nbsp;</p>
+<p style="padding-left: 60px;"><em><span style="font-family: Helvetica;">4.9.2 Intent:&nbsp;</span><span style="font-family: Helvetica;">This is simply the license identified in text in the actual package source code files. This field is not intended to capture license information obtained from an external source, such as the package website. Such information can be included in 4.7 Concluded License. This field may have multiple declared licenses, if multiple licenses are declared at the package level...</span></em></p>
 <!--
 p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
@@ Line 11: / Line 11: @@
-<p><em>4.7 Concluded License</em></p><p style="padding-left: 30px;"><em>4.7.1 Purpose:&nbsp;<span style="font-family: Helvetica;">T</span><span style="font-family: Helvetica;">This field contains the license the creator has concluded as governing the package or alternative values, if the governing license cannot be determined...</span></em></p><p>&nbsp;</p>
+<p style="padding-left: 30px;"><em>4.7 Concluded License</em></p><p style="padding-left: 60px;"><em>4.7.1 Purpose:&nbsp;<span style="font-family: Helvetica;">T</span><span style="font-family: Helvetica;">This field contains the license the creator has concluded as governing the package or alternative values, if the governing license cannot be determined...</span></em></p>
 <!--
 p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
@@ Line 17: / Line 17: @@
-<p style="padding-left: 30px;"><em><span style="font-family: Helvetica;">4.7.2 Intent:&nbsp;</span><span style="font-family: Helvetica;">Here, the intent is to have the reviewer analyze the license information in package, and other objective information, e.g., COPYING.txt file etc., together with the results from any scanning tools, to arrive at a reasonably objective conclusion as to what license governs the package.</span></em></p><p>So, what do you think?&nbsp;</p><p>Is the distinction clear between the two fields?</p><p>Are both useful?</p><p>Can you provide examples of where they are useful?</p><p>Do you have an example that raises issues?</p><p>&nbsp;</p>
+<p style="padding-left: 60px;"><em><span style="font-family: Helvetica;">4.7.2 Intent:&nbsp;</span><span style="font-family: Helvetica;">Here, the intent is to have the reviewer analyze the license information in package, and other objective information, e.g., COPYING.txt file etc., together with the results from any scanning tools, to arrive at a reasonably objective conclusion as to what license governs the package.</span></em></p><p>So, what do you think?&nbsp;</p><p style="padding-left: 30px;">Is the distinction clear between the two fields?</p><p style="padding-left: 30px;">Are both useful?</p><p style="padding-left: 30px;">Can you provide examples of where they are useful?</p><p style="padding-left: 30px;">Do you have an example that raises issues?</p><p>&nbsp;</p>
-<!--
-p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}
--->
-−
-−
 <p>&nbsp;</p>
 <!--
 p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Helvetica}