LWN: Comments on "ClearlyDefined: Putting license information in one place"

ClearlyDefined: Putting license information in one place

pabs — Sun, 05 May 2019 02:53:39 +0000

A wiki page about some of the available tools:

https://wiki.debian.org/CopyrightReviewTools

There is also one in development that uses machine learning:

https://salsa.debian.org/lumin/licensecheck-ng

ClearlyDefined: Putting license information in one place

spwhitton — Sat, 04 May 2019 22:46:03 +0000

Debian cares a lot about knowing that everything we distribute in the main archive complies with DFSG, but achieving that is almost completely manual. Members of the FTP team look at every file in every new source package, and confirm that the Debian copyright file takes account of all licenses and copyright holders. There are tools to automatically generate these Debian copyright files, but TTBOMK none of them are comprehensive. There just too much variation in the free software that gets uploaded to Debian.

It's nice to see that people are thinking about how we might save volunteer time in this area, though integrating Debian's processes with something like ClearlyDefined is a very long way off!

ClearlyDefined: Putting license information in one place

kpfleming — Sat, 04 May 2019 11:54:33 +0000

SPDX itself is large and complicated as you've noted, but thankfully ClearlyDefined isn't dealing with the entirety of SPDX. It's only addressing license statements, which are specified using SPDX license identifiers or expressions. You can read about those here::

https://spdx.org/ids-how

The identifier/expression language, along with the SPDX list of known licenses, is all you would need to understand the information which is put into source files in the process.

ClearlyDefined: Putting license information in one place

ovitters — Wed, 01 May 2019 21:52:45 +0000

I tried reading the mentioned SPDX specification. Current latest version is at https://spdx.org/spdx-specification-21-web-version. It seems written by enterprise companies or something. The page is super long and is pretty unreadable. It seems to provide things pretty similar to DOAP (https://github.com/ewilderj/doap/wiki). The current DOAP site also doesn't have good documentation but at least in the past I remember things being pretty readable.

I work for a big company btw, the big company way of doing things is not always something that leads to success.