[gentoo-dev] [RFC] SPDX-2.0 license mapping in the repository

["Michał Górny" <mgorny@gentoo.org>]

Hi, everyone.

TL;DR: I'd like to propose adding metadata/spdx-license.conf using
the following format:

  <spdx-expr> = <ebuild-expr>

where <spdx-expr> is a SPDX-2.0 license identifier, optionally followed
by "+", optionally followed by "WITH" and an exception identifier,
and <ebuild-expr> is the corresponding ebuild-style LICENSE field value.


This has been proposed in bug 706472 [1], as an effort to aid converting
from the more commonly used SPDX-2.0 identifiers (used e.g. by Cargo) to
Gentoo licenses.  Right now an inline mapping for them is used e.g. by
cargo-ebuild [2].

Besides maintaining a basic mapping of licenses, there are two main
challenges to be overcome here:

1. SPDX-2.0 using "WITH" operator to combine licenses with exceptions,
whereas Gentoo uses combined files for that, e.g. "Apache-2.0 WITH LLVM-
exception" corresponds to Gentoo "Apache-2.0-with-LLVM-exceptions").

2. SPDX-2.0 using "+" operator to indicate "or later" for most of
the licenses (except for GNU licenses, that have explicit "*-or-later"
variant, whereas Gentoo only features "or later" variants of specific
licenses.

I think the best approach here is to include both "+" and "WITH ..."
explicitly in the key, and to allow the RHS to specify an arbitrary
Gentoo license expression.  Therefore, e.g. the file would specify:

  Apache-1.1 = Apache-1.1
  Apache-2.0 = Apache-2.0
  Apache-2.0 WITH LLVM-exception = Apache-2.0-with-LLVM-exceptions
  Apache-1.1+ = || ( Apache-1.1 Apache-2.0 )

Then, SPDX (sub)expressions would be mapped the following way:

a. plain "Apache-x.y" would be mapped to "Apache-x.y"

b. "Apache-2.0 WITH LLVM-exception" would be mapped to the appropriate
license

c. "Apache-2.0 WITH ..." any other exception would remain unmatched

d. "Apache-1.1+" would map to the OR-expression for all matching
licenses

e. "Apache-2.0+" would not be listed explicitly, the tool could fall
back to "Apache-2.0" then (assuming we don't have any later version)


WDYT?


[1] https://bugs.gentoo.org/706472
[2] https://github.com/gentoo/cargo-ebuild/blob/master/src/license.rs#L3

-- 
Best regards,
Michał Górny