legal March 2024

legal@lists.fedoraproject.org

13 participants
13 discussions

Trivy for licenses
by Maxwell G 04 Mar '24

04 Mar '24

Hi, Has anyone every used trivy [1] to scan for licenses? It appears more robust and better maintained than askalono-cli and can detect files with multiple licenses and licenses embedded in file headers. I have been running it with "trivy fs --scanners license --license-full ." [1] https://github.com/aquasecurity/trivy -- Maxwell G (@gotmax23) Pronouns: He/They

2 2

License check for pyuca
by Sandro 01 Mar '24

01 Mar '24

Hi, A while ago I opened issue #39[1] on GitLab. There have been some recent developments regarding the license. Upstream is welcoming a PR for fixing/clarifying the license situation. I have prepared a draft PR, but before I submit that for upstream to review and hopefully merge, I'd like someone from legal to go over my proposal and tell me if that PR would allow me to proceed with the package review of python-pyuca. More information can be found in the ticket, in particular my latest comment. [1] https://gitlab.com/fedora/legal/fedora-license-data/-/issues/379 Cheers, -- Sandro FAS: gui1ty Matrix: Penguinpee Elsewhere: [Pp]enguinpee

1 0

Fwd: SPDX Statistics - Beginning of the year edition
by Miroslav Suchý 01 Mar '24

01 Mar '24

-------- Přeposlaná zpráva -------- Předmět: SPDX Statistics - Beginning of the year edition Datum: Fri, 1 Mar 2024 09:27:48 +0100 Od: Miroslav Suchý <msuchy(a)redhat.com> Společnost: Red Hat Czech, s.r.o. Komu: Development discussions related to Fedora <devel(a)lists.fedoraproject.org> Hot news: fedora-license-data has Copr project https://copr.fedorainfracloud.org/coprs/g/osci/fedora-license-data where new package is built whenever new PR is merged The last phase is ready for wrangler https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 and we will proceed when approved with FESCO. I corrected lots of SPDX formula where you used lowercase "and", "or". The specification allows only "AND", "OR". This will likely change in specification version 3, but now the operator has to be upper case. Two weeks ago we had: > * 23737spec files in Fedora > > * 30335license tags in all spec files > > * 11314 tags have not been converted to SPDX yet > > * 5105 tags can be trivially converted using `license-fedora2spdx` > > * Progress: 62,70% ░░░░░░████ 100% > > ELN subset: > > 128 out of 2412 packages are not converted yet (progress 94.69%) > Today we have: * 23786spec files in Fedora * 30396license tags in all spec files * 11182 tags have not been converted to SPDX yet * 5044 tags can be trivially converted using `license-fedora2spdx` * Progress: 63,21% ░░░░░░████ 100% ELN subset: 112 out of 2411 packages are not converted yet (progress 95.35%) Graph of these data with the burndown chart: https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807r… The list of packages needed to be converted is here: https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List by package maintainers is here https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-f… List of packages from ELN subset that needs to be converted: https://pagure.io/copr/license-validate/blob/main/f/eln-not-migrated.txt New version of fedora-license-data has been released. With: 7 new licenses (plus some public domain declarations). 17 licenses are waiting to be review by SPDX.org (and then to be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B… Legal docs and especially https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ was updated too. License analysis of remaining packages: http://miroslav.suchy.cz/fedora/spdx-reports/ New projection when we will be finished is 2025-02-01 (+17 days from last report). Pure linear approximation. If your package does not have neither git-log entry nor spec-changelog entry mentioning SPDX and you know your license tag matches SPDX formula, you can put your package on ignore list https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt Either pull-request or direct email to me is fine. Why Beggining of the year? That should be January 1st, right? Before the advent of the Gregorian calendar, March 1st was considered the beginning of the year. Hence Septemeber as the "seventh month" despite the fact it is 9th now. But in the Republic of Venice, for example, March was considered the beginning of the year until 1797. So in Venice, March 1790 < January 1790. For more interesting facts about time (and time zones) see this legendary video https://www.youtube.com/watch?v=-5wpm-gesOY Miroslav

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

legal March 2024