Technical Team/Use Cases/2.0/License list extension - Revision history

MartinMichlmayr: Convert to MediaWiki syntax

2013-03-07T13:18:25Z

Convert to MediaWiki syntax

Bschineller at 18:58, 2 October 2012

2012-10-02T18:58:44Z

Pezra at 23:02, 15 May 2012

2012-05-15T23:02:25Z

Pezra at 22:56, 15 May 2012

2012-05-15T22:56:04Z

New page

<p>An organization that does a lot of compliance work is likely to have a license list already which is a superset of the SPDX license list. Such an organization probably will have policies for how to deal with at least some of these licenses. It is important that organizations be able identify the equivalency of these non-SPDX listed license texts/notices.</p>

<h2>Stakeholders and interests</h2>

<h3>Analyzer<h3>
<p>A person or organization which produced the SDPX file and maintains their own license list.</p>

<h3>Consumer</h3>
<p>A person, organization or tool which wants to consume SPDX files produced by one or more analyzer. This entity maintains its own license list and policies for those licenses. This license list partially overlaps with each of the Analyzers' license lists. The Consumer maintains mappings between its list and those of the analyzers from which it receives SPDX files.</p>

<h2>Main success Scenario<h2>

<ol>
<li>Analyzer analyzes a package and finds licenses it recognizes that are not listed on <http://spdx.org/licenses></li>
<li>Analyzer passes SPDX data to Consumer </li>
<li>For each SPDX listed license Consumer performs appropriate action based on its policy for that license</li>
<li>For each non-SPDX listed license Consumer maps from the globally unique id of the license in the Anaylzer's license list to the license in it's list and performs appropriate action based on its policy for that license</li>
</ol>

← Older revision		Revision as of 13:18, 7 March 2013
Line 1:		Line 1:
−	~~<p>~~An organization that does a lot of compliance work is likely to have a license list already which is a superset of the SPDX license list. Such an organization probably will have policies for how to deal with at least some of these licenses. It is important that organizations be able identify the equivalency of these non-SPDX listed license texts/notices.~~</p><p>[~~Use Case request is that there be possibility to convey non-SPDX (or not-yet SPDX) licensing in an SPDX doc exchanged between knowing partners referencing a short-form license identifier from that non-SPDX list namespace~~]</p><h2>~~Stakeholders and interests~~</h2><h3>~~Analyzer~~</h3><p>~~A person or organization which produced the SDPX file and maintains their own license list.~~</p><h3>~~Consumer~~</h3><p>~~A person, organization or tool which wants to consume SPDX files produced by one or more analyzer. This entity maintains its own license list and policies for those licenses. This license list partially overlaps with each of the Analyzers' license lists. The Consumer maintains mappings between its list and those of the analyzers from which it receives SPDX files.~~</p><h2>~~Main Scenario~~</h2><ol><li>~~Analyzer analyzes a package and finds licenses it recognizes that are not listed on ~~<~~http://spdx.org/licenses~~></li><li>~~Analyzer passes SPDX data to Consumer~~</li><li>~~For each SPDX listed license Consumer performs appropriate action based on its policy for that license~~</li><li>~~For each non-SPDX listed license Consumer maps from the globally unique id of the license in the Anaylzer's license list to the license in it's list and performs appropriate action based on its policy for that license~~</li></ol><h2>~~Alternate scenario A~~</h2><ol><li>~~Analyzer generates SPDX data referencing its license list for non-SPDX listed licenses~~</li><li>~~Later one of the licenses in that SPDX file is added to SPDX license list~~</li><li>~~Consumer detects non-SPDX listed license and maps it to the now SPDX listed license~~</li></ol><h2>~~Alternate scenario B~~</h2><ol><li>~~Analyzer analyzes a package and finds licenses it recognizes that are not listed on ~~<~~http://spdx.org/licenses~~></li><li>~~Analyzer passes SPDX data to Consumer~~</li><li>~~For each SPDX listed license Consumer performs appropriate action based on its policy for that license~~</li><li>~~Consumer encounters license from Analyzers list that it does not have a mapping for~~</li><li>~~Consumer fetches license data from Analyzer's license list and adds that license to its license list~~</li></ol><p><strong>~~Failed scenario~~</strong></p><ol><li>~~Failed scenario if there ends up being a collision between references to SPDX standard license list and reference to another license list.~~</li></ol>~~	+	An organization that does a lot of compliance work is likely to have a license list already which is a superset of the SPDX license list. Such an organization probably will have policies for how to deal with at least some of these licenses. It is important that organizations be able identify the equivalency of these non-SPDX listed license texts/notices.
		+
		+	(Use Case request is that there be possibility to convey non-SPDX (or not-yet SPDX) licensing in an SPDX doc exchanged between knowing partners referencing a short-form license identifier from that non-SPDX list namespace)
		+
		+	==Stakeholders and interests==
		+
		+	===Analyzer===
		+
		+	A person or organization which produced the SDPX file and maintains their own license list.
		+
		+	===Consumer===
		+
		+	A person, organization or tool which wants to consume SPDX files produced by one or more analyzer. This entity maintains its own license list and policies for those licenses. This license list partially overlaps with each of the Analyzers' license lists. The Consumer maintains mappings between its list and those of the analyzers from which it receives SPDX files.
		+
		+	==Main Scenario==
		+
		+	# Analyzer analyzes a package and finds licenses it recognizes that are not listed on http://spdx.org/licenses
		+	# Analyzer passes SPDX data to Consumer
		+	# For each SPDX listed license Consumer performs appropriate action based on its policy for that license
		+	# For each non-SPDX listed license Consumer maps from the globally unique id of the license in the Anaylzer's license list to the license in it's list and performs appropriate action based on its policy for that license
		+
		+	==Alternate scenario A==
		+
		+	# Analyzer generates SPDX data referencing its license list for non-SPDX listed licenses
		+	# Later one of the licenses in that SPDX file is added to SPDX license list
		+	# Consumer detects non-SPDX listed license and maps it to the now SPDX listed license
		+
		+	==Alternate scenario B==
		+
		+	# Analyzer analyzes a package and finds licenses it recognizes that are not listed on http://spdx.org/licenses
		+	# Analyzer passes SPDX data to Consumer
		+	# For each SPDX listed license Consumer performs appropriate action based on its policy for that license
		+	# Consumer encounters license from Analyzers list that it does not have a mapping for
		+	# Consumer fetches license data from Analyzer's license list and adds that license to its license list
		+
		+	== Failed scenario ==
		+
		+	# Failed scenario if there ends up being a collision between references to SPDX standard license list and reference to another license list.
		+
		+	[[Category:Technical]]

@@ Line 1: / Line 1: @@
-<p>An organization that does a lot of compliance work is likely to have a license list already which is a superset of the SPDX license list. Such an organization probably will have policies for how to deal with at least some of these licenses. It is important that organizations be able identify the equivalency of these non-SPDX listed license texts/notices.</p>
+<p>An organization that does a lot of compliance work is likely to have a license list already which is a superset of the SPDX license list. Such an organization probably will have policies for how to deal with at least some of these licenses. It is important that organizations be able identify the equivalency of these non-SPDX listed license texts/notices.</p><p>[Use Case request is that there be possibility to convey non-SPDX (or not-yet SPDX) licensing in an SPDX doc exchanged between knowing partners referencing a short-form license identifier from that non-SPDX list namespace]</p><h2>Stakeholders and interests</h2><h3>Analyzer</h3><p>A person or organization which produced the SDPX file and maintains their own license list.</p><h3>Consumer</h3><p>A person, organization or tool which wants to consume SPDX files produced by one or more analyzer. This entity maintains its own license list and policies for those licenses. This license list partially overlaps with each of the Analyzers' license lists. The Consumer maintains mappings between its list and those of the analyzers from which it receives SPDX files.</p><h2>Main Scenario</h2><ol><li>Analyzer analyzes a package and finds licenses it recognizes that are not listed on &lt;http://spdx.org/licenses&gt;</li><li>Analyzer passes SPDX data to Consumer</li><li>For each SPDX listed license Consumer performs appropriate action based on its policy for that license</li><li>For each non-SPDX listed license Consumer maps from the globally unique id of the license in the Anaylzer's license list to the license in it's list and performs appropriate action based on its policy for that license</li></ol><h2>Alternate scenario A</h2><ol><li>Analyzer generates SPDX data referencing its license list for non-SPDX listed licenses</li><li>Later one of the licenses in that SPDX file is added to SPDX license list</li><li>Consumer detects non-SPDX listed license and maps it to the now SPDX listed license</li></ol><h2>Alternate scenario B</h2><ol><li>Analyzer analyzes a package and finds licenses it recognizes that are not listed on &lt;http://spdx.org/licenses&gt;</li><li>Analyzer passes SPDX data to Consumer</li><li>For each SPDX listed license Consumer performs appropriate action based on its policy for that license</li><li>Consumer encounters license from Analyzers list that it does not have a mapping for</li><li>Consumer fetches license data from Analyzer's license list and adds that license to its license list</li></ol><p><strong>Failed scenario</strong></p><ol><li>Failed scenario if there ends up being a collision between references to SPDX standard license list and reference to another license list.</li></ol>
-−
 <h2>Stakeholders and interests</h2>
-−
 <h3>Analyzer<h3>
 <p>A person or organization which produced the SDPX file and maintains their own license list.</p>
-−
 <h3>Consumer</h3>
 <p>A person, organization or tool which wants to consume SPDX files produced by one or more analyzer. This entity maintains its own license list and policies for those licenses. This license list partially overlaps with each of the Analyzers' license lists. The Consumer maintains mappings between its list and those of the analyzers from which it receives SPDX files.</p>
-−
- <h2>Main Scenario<h2>
-−
- <ol>
- <li>Analyzer analyzes a package and finds licenses it recognizes that are not listed on <http://spdx.org/licenses></li>
- <li>Analyzer passes SPDX data to Consumer </li>
- <li>For each SPDX listed license Consumer performs appropriate action based on its policy for that license</li>
- <li>For each non-SPDX listed license Consumer maps from the globally unique id of the license in the Anaylzer's license list to the license in it's list and performs appropriate action based on its policy for that license</li>
- </ol>
-−
- <h2>Alternate scenario A</h2>
- <ol>
-  <li>Analyzer generates SPDX data referencing its license list for non-SPDX listed licenses</li>
-  <li>Later one of the licenses in that SPDX file is added to SPDX license list</li>
-  <li>Consumer detects non-SPDX listed license and maps it to the now SPDX listed license</li>
- </ol>
-−
-  <h2>Alternate scenario B</h2>
-  <ol>
-   <li>Analyzer analyzes a package and finds licenses it recognizes that are not listed on <http://spdx.org/licenses></li>
- <li>Analyzer passes SPDX data to Consumer </li>
- <li>For each SPDX listed license Consumer performs appropriate action based on its policy for that license</li>
-  <li>Consumer encounters license from Analyzers list that it does not have a mapping for</li>
-  <li>Consumer fetches license data from Analyzer's license list and adds that license to its license list</li>
-  </ol>