THE SPDX WIKI IS NO LONGER ACTIVE. ALL CONTENT HAS BEEN MOVED TO https://github.com/spdx

Difference between revisions of "Technical Team/Use Cases/2.0/Intermediate packager subsetting upstream source that provides SPDX data"

From SPDX Wiki
Jump to: navigation, search
Line 1: Line 1:
−
<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong>&nbsp;Intermediate packager subsetting upstream source that provides SPDX data</li><li><strong>Primary Actor:</strong>&nbsp;Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong>&nbsp;To include in the package SPDX data describing the packages licensing information for the package base upon the SPDX data provided by the upstream source in a way that allows the packager to verifiably reference the upstream packagers SPDX data and to make clear that only a subset of the copyrightable artifacts provided by upstream maintainer are included in the copyright artifacts provided in the package. &nbsp;Examples would include -dev packages that only include headers, packages that do not package contrib/ subdirectories, or otherwise break up what upstream has provided into package shaped pieces.</li><li><strong>Stakeholders and Interests:</strong>&nbsp;<ol><li><strong>Upstream maintainers:&nbsp;</strong><ol><li>To communicate the licensing information for their copyrightable artifacts. &nbsp;</li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To indicate that they are only passing on copyrightable artifacts based on a subset of the copyrightable artifacts provided by the upstream maintainers.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong>&nbsp;<ol><li>Upstream maintainer has provided SPDX data</li><li>Packager understands how they are subsetting the upstream source</li></ol></li><li><strong>Main Success Senario:</strong>&nbsp;Packager communicates accurate complete licensing information for their package in an SPDX data format in the package archive in such a way that indicates they are only using parts of what is provided in the upstream source.</li><li><strong>Failed End Condition:</strong>&nbsp;Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>&nbsp; Upstream may be the root provider of the code, a source package, or some other intermediate party. &nbsp;At the end of the day it's who you got the code from.</li></ol>
+
<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong>&nbsp;Intermediate packager subsetting upstream source that provides SPDX data</li><li><strong>Primary Actor:</strong>&nbsp;Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong>&nbsp;To include in the package SPDX data describing the packages licensing information for the package base upon the SPDX data provided by the upstream source in a way that allows the packager to verifiably reference the upstream packagers SPDX data and to make clear that only a subset of the copyrightable artifacts provided by upstream maintainer are included in the copyright artifacts provided in the package. &nbsp;Examples would include -dev packages that only include headers, packages that do not package contrib/ subdirectories, or otherwise break up what upstream has provided into package shaped pieces.</li><li><strong>Stakeholders and Interests:</strong>&nbsp;<ol><li><strong>Upstream maintainers:&nbsp;</strong><ol><li>To communicate the licensing information for their copyrightable artifacts. &nbsp;</li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To indicate that they are only passing on copyrightable artifacts based on a subset of the copyrightable artifacts provided by the upstream maintainers.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong>&nbsp;<ol><li>Upstream maintainer has provided SPDX data</li><li>Packager understands how they are subsetting the upstream source</li></ol></li><li><strong>Main Success Senario:</strong>&nbsp;Packager communicates accurate complete licensing information for their package in an SPDX data format in the package archive in such a way that indicates they are only using parts of what is provided in the upstream source.</li><ol><li>NOTE: sub-setting the data from the upstream SPDX data may require modifications of the original data in the newly created sub-set. For example, eliminating the contrib files might mean that some licenses are no longer applicable.</li></ol><li><strong>Failed End Condition:</strong>&nbsp;Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>&nbsp; Upstream may be the root provider of the code, a source package, or some other intermediate party. &nbsp;At the end of the day it's who you got the code from.</li></ol>

Revision as of 18:51, 7 August 2012

  1. Title: Intermediate packager subsetting upstream source that provides SPDX data
  2. Primary Actor: Intermediate packager (someone building a rpm, deb, etc from upstream source)
  3. Goal in Context: To include in the package SPDX data describing the packages licensing information for the package base upon the SPDX data provided by the upstream source in a way that allows the packager to verifiably reference the upstream packagers SPDX data and to make clear that only a subset of the copyrightable artifacts provided by upstream maintainer are included in the copyright artifacts provided in the package.  Examples would include -dev packages that only include headers, packages that do not package contrib/ subdirectories, or otherwise break up what upstream has provided into package shaped pieces.
  4. Stakeholders and Interests: 
    1. Upstream maintainers: 
      1. To communicate the licensing information for their copyrightable artifacts.  
      2. To have their licenses respected
    2. Intermediate Packager:
      1. To communicate the licensing information for their package
      2. To communicate the licensing information provided by the upstream maintainer.
      3. To indicate that they are only passing on copyrightable artifacts based on a subset of the copyrightable artifacts provided by the upstream maintainers.
      4. To respect the licenses of the upstream maintainer
    3. Consumers of packages:
      1. To receive accurate and clear information of licensing of packages
      2. To be able to comply easily with licenses for packages
      3. To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.
      4. To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.
  5. Preconditions: 
    1. Upstream maintainer has provided SPDX data
    2. Packager understands how they are subsetting the upstream source
  6. Main Success Senario: Packager communicates accurate complete licensing information for their package in an SPDX data format in the package archive in such a way that indicates they are only using parts of what is provided in the upstream source.
    1. NOTE: sub-setting the data from the upstream SPDX data may require modifications of the original data in the newly created sub-set. For example, eliminating the contrib files might mean that some licenses are no longer applicable.
  7. Failed End Condition: Package maintainer communicates inaccurate incomplete licensing information for their package.
  8. Trigger:
    1. Release of a new package
  9. Notes:  Upstream may be the root provider of the code, a source package, or some other intermediate party.  At the end of the day it's who you got the code from.
Retrieved from "https://wiki.spdx.org/index.php?title=Technical_Team/Use_Cases/2.0/Intermediate_packager_subsetting_upstream_source_that_provides_SPDX_data&oldid=1725"