PR#476: use SPDX schema when calling licensecheck - FedoraReview

FedoraReview

#476 use SPDX schema when calling licensecheck

Closed 9 months ago by ngompa. Opened a year ago by msuchy.

msuchy/FedoraReview spdx into master

use SPDX schema when calling licensecheck

Miroslav Suchý • a year ago

6ffeb81

plugins/generic.py

file modified

+1 -1

		`@@ -695,7 +695,7 @@`
		`source_dir, msg = self._get_source_dir()`
		`self.log.debug("Scanning sources in %s", source_dir)`
		`if os.path.exists(source_dir):`
		`- cmd = "licensecheck -r " + source_dir`
		`+ cmd = "licensecheck --shortname-scheme=spdx -r " + source_dir`
		`try:`
		`out = check_output(cmd, shell=True, universal_newlines=True)`
		`except (OSError, CalledProcessError) as err:`

msuchy commented a year ago

SPDX is now standard in Fedora, lets use it

This has been available since v3.2 which is in all current Fedoras.

frostyx commented a year ago

I think it should be done already?
But I did it differently, please take a look at PR#465.

ngompa commented a year ago

Why should we presume a license scheme instead of giving the full name?

msuchy commented a year ago

This is how the output looks with this change:

./src/fedora-create-review: *No copyright* GPL-2.0-or-later
./src/fedora-review: GPL-2.0-or-later

and how it looks now (before this PR)

./src/fedora-create-review: *No copyright* GNU General Public License v2.0 or later
./src/fedora-review: GNU General Public License v2.0 or later

But I did it differently, please take a look at PR#465.

This PR check the validity of License field. Only.

Why should we presume a license scheme instead of giving the full name?

To ease the work of reviewers. Now the licensecheck can print you that the license is: a CMU License and it is non-trivial to know that it indeed matches MIT-CMU. With this change licensecheck outputs directly the names as SPDX indentifiers.

ngompa commented a year ago

That would also require licensecheck to know Fedora's custom SPDX identifiers too, which it doesn't.

msuchy commented a year ago

You mean LicenseRef-* ? There is just few of them. I tried few of them. And licensecheck reports them as UNKNOWN with or without this change.

ngompa commented a year ago

And what about Public Domain?

msuchy commented a year ago

licensecheck uses "public-domain" - which is NOT allowed in Fedora. Because what people think is public domain is often not public domain. We have it documented here: https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_public_domain And the consensus is to document it in https://gitlab.com/fedora/legal/fedora-license-data/-/blob/main/public-domain-text.txt and use LicenseRef-Fedora-Public-Domain for the time being. And we will revisit this topic later (likely when all the SPDX dust settle down).