Re: List of packages with problematic license
On Mon, Jan 03, 2022 at 12:12:38PM -0500, Matthew Miller wrote:
On Mon, Jan 03, 2022 at 01:26:33PM +0100, Miroslav Suchý wrote:
> The License tag was never formally defined. If we agree that there can be
> anything, then let it be.
The Pending PR here updates that to: SPDX License identifier or expression
(from our "Good" list).
https://pagure.io/packaging-committee/pull-request/1142#_1__38
Although given the context here, I note that that's ambiguous about whether
the _whole expression_ must be on the list — I don't think that's the
intention!
I think in some cases, it may be. As our discussions on this PR have noted,
Fedora may approve an expression but not all expressions that SPDX can
represent. So the objective is more about using the tokens and expression
syntax defined by SPDX, but then we have our list of approved expressions.
This is also necessary because we need to maintain our own list of LicenseRef
tokens for things we approve for Fedora but that do not have an upstream SPDX
token.
However, in many cases Fedora is ok with combining something with
GPL-2.0-or-later with BSD-3-Clause using AND. The good list we've been
working through has some of these expressions that are a license token and
then a WITH qualifier. So this may be more about ensuring that a WITH clause
isn't noted as approved without also requiring the main token.
IANAL, so take my comments with that in mind. And this is where I defer to
Jilayne for the actual expertise here. :)
--
David Cantrell <dcantrell(a)redhat.com>
Red Hat, Inc. | Boston, MA | EST5EDT