THE SPDX WIKI IS NO LONGER ACTIVE. ALL CONTENT HAS BEEN MOVED TO https://github.com/spdx
Technical Team/Use Cases/2.0/Intermediate packager subsetting upstream source that provides SPDX data
From SPDX Wiki
- Title: Intermediate packager subsetting upstream source that provides SPDX data
- Primary Actor: Intermediate packager (someone building a rpm, deb, etc from upstream source)
- Goal in Context: To include in the package SPDX data describing the packages licensing information for the package base upon the SPDX data provided by the upstream source in a way that allows the packager to verifiably reference the upstream packagers SPDX data and to make clear that only a subset of the copyrightable artifacts provided by upstream maintainer are included in the copyright artifacts provided in the package. Examples would include -dev packages that only include headers, packages that do not package contrib/ subdirectories, or otherwise break up what upstream has provided into package shaped pieces.
- Stakeholders and Interests:
- Upstream maintainers:
- To communicate the licensing information for their copyrightable artifacts.
- To have their licenses respected
- Intermediate Packager:
- To communicate the licensing information for their package
- To communicate the licensing information provided by the upstream maintainer.
- To indicate that they are only passing on copyrightable artifacts based on a subset of the copyrightable artifacts provided by the upstream maintainers.
- To respect the licenses of the upstream maintainer
- Consumers of packages:
- To receive accurate and clear information of licensing of packages
- To be able to comply easily with licenses for packages
- To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.
- To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.
- Upstream maintainers:
- Preconditions:
- Upstream maintainer has provided SPDX data
- Packager understands how they are subsetting the upstream source
- Main Success Senario: Packager communicates accurate complete licensing information for their package in an SPDX data format in the package archive in such a way that indicates they are only using parts of what is provided in the upstream source.
- Failed End Condition: Package maintainer communicates inaccurate incomplete licensing information for their package.
- Trigger:
- Release of a new package
- Notes: