[gentoo-dev] [RFC] SPDX-2.0 license mapping in the repository

[gentoo-dev] [RFC] SPDX-2.0 license mapping in the repository

[Michał Górny]

Hi, everyone.

TL;DR: I'd like to propose adding metadata/spdx-license.conf using
the following format:

  <spdx-expr> = <ebuild-expr>

where <spdx-expr> is a SPDX-2.0 license identifier, optionally followed
by "+", optionally followed by "WITH" and an exception identifier,
and <ebuild-expr> is the corresponding ebuild-style LICENSE field value.


This has been proposed in bug 706472 [1], as an effort to aid converting
from the more commonly used SPDX-2.0 identifiers (used e.g. by Cargo) to
Gentoo licenses.  Right now an inline mapping for them is used e.g. by
cargo-ebuild [2].

Besides maintaining a basic mapping of licenses, there are two main
challenges to be overcome here:

1. SPDX-2.0 using "WITH" operator to combine licenses with exceptions,
whereas Gentoo uses combined files for that, e.g. "Apache-2.0 WITH LLVM-
exception" corresponds to Gentoo "Apache-2.0-with-LLVM-exceptions").

2. SPDX-2.0 using "+" operator to indicate "or later" for most of
the licenses (except for GNU licenses, that have explicit "*-or-later"
variant, whereas Gentoo only features "or later" variants of specific
licenses.

I think the best approach here is to include both "+" and "WITH ..."
explicitly in the key, and to allow the RHS to specify an arbitrary
Gentoo license expression.  Therefore, e.g. the file would specify:

  Apache-1.1 = Apache-1.1
  Apache-2.0 = Apache-2.0
  Apache-2.0 WITH LLVM-exception = Apache-2.0-with-LLVM-exceptions
  Apache-1.1+ = || ( Apache-1.1 Apache-2.0 )

Then, SPDX (sub)expressions would be mapped the following way:

a. plain "Apache-x.y" would be mapped to "Apache-x.y"

b. "Apache-2.0 WITH LLVM-exception" would be mapped to the appropriate
license

c. "Apache-2.0 WITH ..." any other exception would remain unmatched

d. "Apache-1.1+" would map to the OR-expression for all matching
licenses

e. "Apache-2.0+" would not be listed explicitly, the tool could fall
back to "Apache-2.0" then (assuming we don't have any later version)


WDYT?


[1] https://bugs.gentoo.org/706472
[2] https://github.com/gentoo/cargo-ebuild/blob/master/src/license.rs#L3

-- 
Best regards,
Michał Górny

Re: [gentoo-dev] [RFC] SPDX-2.0 license mapping in the repository

[Maciej Barć]

[-- Attachment #1.1.1: Type: text/plain, Size: 2600 bytes --]

Hi Michał!

I like the idea a lot, with this the automatic Ebuild generator tools 
like for example Racket-Collector2 and Cargo-Ebuild could use the config 
file or could base their license id matching system on such config.


On 11/9/22 17:36, Michał Górny wrote:
> Hi, everyone.
> 
> TL;DR: I'd like to propose adding metadata/spdx-license.conf using
> the following format:
> 
>    <spdx-expr> = <ebuild-expr>
> 
> where <spdx-expr> is a SPDX-2.0 license identifier, optionally followed
> by "+", optionally followed by "WITH" and an exception identifier,
> and <ebuild-expr> is the corresponding ebuild-style LICENSE field value.
> 
> 
> This has been proposed in bug 706472 [1], as an effort to aid converting
> from the more commonly used SPDX-2.0 identifiers (used e.g. by Cargo) to
> Gentoo licenses.  Right now an inline mapping for them is used e.g. by
> cargo-ebuild [2].
> 
> Besides maintaining a basic mapping of licenses, there are two main
> challenges to be overcome here:
> 
> 1. SPDX-2.0 using "WITH" operator to combine licenses with exceptions,
> whereas Gentoo uses combined files for that, e.g. "Apache-2.0 WITH LLVM-
> exception" corresponds to Gentoo "Apache-2.0-with-LLVM-exceptions").
> 
> 2. SPDX-2.0 using "+" operator to indicate "or later" for most of
> the licenses (except for GNU licenses, that have explicit "*-or-later"
> variant, whereas Gentoo only features "or later" variants of specific
> licenses.
> 
> I think the best approach here is to include both "+" and "WITH ..."
> explicitly in the key, and to allow the RHS to specify an arbitrary
> Gentoo license expression.  Therefore, e.g. the file would specify:
> 
>    Apache-1.1 = Apache-1.1
>    Apache-2.0 = Apache-2.0
>    Apache-2.0 WITH LLVM-exception = Apache-2.0-with-LLVM-exceptions
>    Apache-1.1+ = || ( Apache-1.1 Apache-2.0 )
> 
> Then, SPDX (sub)expressions would be mapped the following way:
> 
> a. plain "Apache-x.y" would be mapped to "Apache-x.y"
> 
> b. "Apache-2.0 WITH LLVM-exception" would be mapped to the appropriate
> license
> 
> c. "Apache-2.0 WITH ..." any other exception would remain unmatched
> 
> d. "Apache-1.1+" would map to the OR-expression for all matching
> licenses
> 
> e. "Apache-2.0+" would not be listed explicitly, the tool could fall
> back to "Apache-2.0" then (assuming we don't have any later version)
> 
> 
> WDYT?
> 
> 
> [1] https://bugs.gentoo.org/706472
> [2] https://github.com/gentoo/cargo-ebuild/blob/master/src/license.rs#L3
> 

-- 
Have a great day!

~ Maciej XGQT Barć

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 6297 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]