Technical Team/Use Cases/2.0/Build System Yocto

THis is still a draft and not quite finiliazed but its close.

Title:  Yocto

Background: 

(quick blurb in how Yocto works)

When Yocto builds a package the package source can come from various sources such as: source code control system like GIT or a tarball. Entities providng a Yocto build for their hardware may also be providing pacthes for the package.

RPMs.

Yocto uses recipes to build packages. These recipes do contain a License field. The current short names do not match SPDX short names and likely will not. It was rather difficult to get alignment on the current ones used. There is talk on the Yocto project about converting the Yocto short names into SPDX ones. 

This needs verification but the license field is generally high leveland may not break down the complete licensing for a package. As an example, a package could be listed as GPL v2 which would be in the License field but the package may contain BSD, MIT, etc sub elements.

Also see <a href="http://www.yoctoproject.org/docs/1.0/yocto-quick-start/yocto-project-qs.html">http://www.yoctoproject.org/docs/1.0/yocto-quick-start/yocto-project-qs.html</a> 

Primary Actor:

Yocto User: Executs a build

Package Maintainer: These are upstream projects thatr have projects that Yocto consumes. This upstream project could be a company that provides a package as well.

Yocto Project: Provides the Yocto build system

Yocto Build System Provider: They provide a particular build system, for example for their product. They may also provide patches to Packages that the recipes pull.

Goal in Context:  To generate a kernel/file system image for a hardware device or simulator using Yocto and to have SPDX documents that describe the licensing for all copyrigthable artifacts,

Stakeholders and Interests: 

Yocto User: Genetrates a buuod getting an image for their hardware. They want SPDX documents for each package/coyrightable element.

Package Maintainer: To provide license information using SPDX

Yocto Project: To provide SPDX documents that describe the licensing of the artifacts provided by the build system.

Build System Provider: They provide a particular build system for thier hardware, for example for their product. They may also provide patches to Packages that the recipes pull.

Providers of artifacts: 

Consumers of artifacts:

1. To receive accurate and clear information of licensing of artifacts
2. To be able to comply easily with licenses for artifacts
3. To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.

Preconditions: 

Main Success Scenario: Someone executing a Yocto based build gets SPDX documents that decsribe the licensing for all copyrightable elements that were used to create the build and are e result of a build.

Failed End Condition: SPDX documents for copyrigthable elements are missing.ow easy will be tis to detect as these builds can be rather large?

Trigger:

A Yocto user executes a build.

Notes:  This looks like a good candidate for an SPDX Lite?