From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 4C734158020 for ; Wed, 9 Nov 2022 16:36:12 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 93AB5E0869; Wed, 9 Nov 2022 16:36:07 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 44ECFE0843 for ; Wed, 9 Nov 2022 16:36:06 +0000 (UTC) Message-ID: <39d3ea1735ec2e5c1f1237348a6361511e482cda.camel@gentoo.org> Subject: [gentoo-dev] [RFC] SPDX-2.0 license mapping in the repository From: =?UTF-8?Q?Micha=C5=82_G=C3=B3rny?= To: gentoo-dev@lists.gentoo.org Date: Wed, 09 Nov 2022 17:36:01 +0100 Organization: Gentoo Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.44.4 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 X-Archives-Salt: d52f91d3-2cad-479c-b20e-26e48c4c2c36 X-Archives-Hash: 01924bb71411696dce04445d85da508d Hi, everyone. TL;DR: I'd like to propose adding metadata/spdx-license.conf using the following format: =3D where is a SPDX-2.0 license identifier, optionally followed by "+", optionally followed by "WITH" and an exception identifier, and is the corresponding ebuild-style LICENSE field value. This has been proposed in bug 706472 [1], as an effort to aid converting from the more commonly used SPDX-2.0 identifiers (used e.g. by Cargo) to Gentoo licenses. Right now an inline mapping for them is used e.g. by cargo-ebuild [2]. Besides maintaining a basic mapping of licenses, there are two main challenges to be overcome here: 1. SPDX-2.0 using "WITH" operator to combine licenses with exceptions, whereas Gentoo uses combined files for that, e.g. "Apache-2.0 WITH LLVM- exception" corresponds to Gentoo "Apache-2.0-with-LLVM-exceptions"). 2. SPDX-2.0 using "+" operator to indicate "or later" for most of the licenses (except for GNU licenses, that have explicit "*-or-later" variant, whereas Gentoo only features "or later" variants of specific licenses. I think the best approach here is to include both "+" and "WITH ..." explicitly in the key, and to allow the RHS to specify an arbitrary Gentoo license expression. Therefore, e.g. the file would specify: Apache-1.1 =3D Apache-1.1 Apache-2.0 =3D Apache-2.0 Apache-2.0 WITH LLVM-exception =3D Apache-2.0-with-LLVM-exceptions Apache-1.1+ =3D || ( Apache-1.1 Apache-2.0 ) Then, SPDX (sub)expressions would be mapped the following way: a. plain "Apache-x.y" would be mapped to "Apache-x.y" b. "Apache-2.0 WITH LLVM-exception" would be mapped to the appropriate license c. "Apache-2.0 WITH ..." any other exception would remain unmatched d. "Apache-1.1+" would map to the OR-expression for all matching licenses e. "Apache-2.0+" would not be listed explicitly, the tool could fall back to "Apache-2.0" then (assuming we don't have any later version) WDYT? [1] https://bugs.gentoo.org/706472 [2] https://github.com/gentoo/cargo-ebuild/blob/master/src/license.rs#L3 --=20 Best regards, Micha=C5=82 G=C3=B3rny