From f2957294de073f66c959ced0fb1cbf09f133aa38 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 1/30] add to general description initial commit to update a small part of intro text --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 003be9a..0cb3283 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -13,8 +13,7 @@ https://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses[Free Soft https://opensource.org/licenses/[OSI] and consultation with Red Hat Legal. -If code is multiple licensed, and at least one of the licenses is approved for Fedora, -that code can be included in Fedora under the approved license(s) (but only under the terms of the approved license(s)). +The information here provides guidance related to identifying and recording the license for each Fedora package. == License Text From 0d3f77f4242cb21f69d6293fa7126d4013586a04 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 2/30] Update guidelines/modules/ROOT/pages/LicensingGuidelines.adoc update references to SPDX identifiers --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 0cb3283..2dd568d 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -25,7 +25,7 @@ but does not provide a copy of the license text (in the source tree, or in some the packager should do their best to point out this confusion to upstream. This sometimes occurs when an upstream project's only reference to a license is in a README (where they simply say "licensed under the FOO license"), on their website, or when they simply do not check a copy of the license into their Source tree. -Common licenses that require including their texts with all derivative works include ASL 2.0, EPL, BSD and MIT. +Common licenses that require including their texts with all derivative works include Apache-2.0, EPL-1.0, EPL-2.0, BSD-3-Clause and most BSD variants, and MIT and most MIT variants. Packagers should point out to upstream that by not including a proper full license text, they are making it difficult or impossible for anyone to comply with their desired license terms. From 4360e20eb3bedcfa9c6d3c37caa517be99a565b8 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 3/30] update references re where to find license text add license steward and SPDX License List as places to find license text, when needed --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 2dd568d..221b881 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -38,8 +38,8 @@ Fedora believes that this risk is minimized by the fact that if the upstream dis they can easily remedy this by making full license text available in the source code. Packagers who choose to do this should ensure that they have exhausted all attempts to work with upstream to include the license text as part of the source code, or at least, to confirm the full license text explicitly with the upstream, as this minimizes the risk on the packager. -Packagers should also take copies of license texts from reliable and canonical sources -(such as the Fedora Software Licenses page, the FSF licenses page, or the OSI license list), whenever possible. +Packagers may also take copies of license texts from reliable and canonical sources +(such as the original license text from the license steward, Fedora Software Licenses page, the SPDX License List, the FSF licenses page, or the OSI license list), whenever possible. * Choose not to package that software for Fedora. From fa163418ab2169eebc222063bf01b5152685819d Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 4/30] add info to use SPDX identifiers --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 221b881..685e49a 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -80,7 +80,7 @@ Each of those License: tags must comply with all applicable guidelines. === Valid License Short Names -The `+License:+` field must be filled with the appropriate license Short License identifier(s) from the "Good License" tables on the {fedora-licensing} page. +The `+License:+` field for new packages as of the Fedora Linux 36 branch date (2022-02-08) must be filled with the appropriate SPDX License identifier or expression from the SPDX License List and listed as a "Good License" on the {fedora-licensing} page. If your license does not appear in the tables, it needs to be sent to legal@lists.fedoraproject.org (note that this list is moderated, only members may directly post). If the license is approved, it will be added to the appropriate table. From 8084b17ef4c9cef6b7cfd608c3743d4bee12e5ef Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 5/30] add general description of SPDX identifiers add general description of SPDX identifiers and note re: different approvals (e.g., font, content, documentation) --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 685e49a..40efff4 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -81,8 +81,13 @@ Each of those License: tags must comply with all applicable guidelines. === Valid License Short Names The `+License:+` field for new packages as of the Fedora Linux 36 branch date (2022-02-08) must be filled with the appropriate SPDX License identifier or expression from the SPDX License List and listed as a "Good License" on the {fedora-licensing} page. -If your license does not appear in the tables, it needs to be sent to legal@lists.fedoraproject.org (note that this list is moderated, only members may directly post). -If the license is approved, it will be added to the appropriate table. +Note that some licenses may be approved for only certain types of material, e.g., fonts, content, or documentation. + +The SPDX License List provides identifiers for each individual license or exception based on a set of matching guidelines. +For example, licenses that have different versions or options related to later versions have specific identifiers. +License expressions accommodate when multiple licenses apply, there is a choice of a license, a license and exception, or a combination thereof. +See further information below. + === "Distributable" From c2899eb404f98e7139f1f823c5d1fbf492ea3c18 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 6/30] remove sections not needed due to SPDX identifiers remove specific sections re: identifiers for versioned, or-later version, and GPL/LGPL - as this is covered by way of SPDX --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 40efff4..75b523f 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -102,24 +102,6 @@ then that package can use "Freely redistributable without restriction" as its `+ The `+License:+` field for any firmware that disallows modification should be set to: "Redistributable, no modification permitted". -=== Versioned licenses - -Some licenses include the version as part of the Short License Identifier. -This is only done when multiple versions of the license differ in significant ways (e.g. -one revision is GPLv2 incompatible, while a later version is not). -Be careful to ensure that you use the correct Short License Identifier, as shown in the tables on the {fedora-licensing} page. - -=== "or later version" licenses - -Some licenses state that either the current version of the license or later versions may be used. -It is important to note when a license states this. -When a license has an "or later version" clause, we note that by appending a + to the Short License Identifier. -Please note that there are already special Short License Identifiers for GPLv2+ and LGPLv2+, there is no need to append an additional + for those cases. - -=== GPL and LGPL - -Since compatibility of code and library linking is especially complex with GPL and LGPL, Fedora packages can no longer simply use "GPL" or "LGPL" in the `+License:+` field. -Please refer to the {fedora-licensing} page for the acceptable identifiers, and be careful to ensure that you select the correct one. === Dual Licensing Scenarios From c6e37ee1007c91ec94dcae93381626ce36acb4f9 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 7/30] add section on how to identify a license add section on how to identify a license with tool suggestions --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 75b523f..e2fc3ee 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -88,6 +88,24 @@ For example, licenses that have different versions or options related to later v License expressions accommodate when multiple licenses apply, there is a choice of a license, a license and exception, or a combination thereof. See further information below. +=== How do I identify a license? === + +Many licenses look similar to the naked eye, but may still have substantial differences. +There are several open source projects that can help detect and identify licenses. + +* SPDX-license-diff - https://github.com/spdx/spdx-license-diff - a browser plugin where you can highlight the text of a license and it will look for the closest match to the SPDX License List. +This tool is quite fast and implements the SPDX Matching Guidelines. +The big advantage here (over SPDX Check License) is it shows you close matches. +This is likely the most useful tool in determining if a license matches a license on the SPDX License List. +* SPDX Check License - https://tools.spdx.org/app/check_license/ - an online tool where you can paste the text of a license and it will match it against all the license and exceptions on the SPDX License List, fully implementing the SPDX Matching Guidelines. +Due to its thoroughness, this tool may take a little time to get an answer (than license-diff) and will simply tell you if there is a match or not. +* ScanCode - https://github.com/nexB/scancode-toolkit - scanning tool that detects licenses, copyrights, package manifests, and dependencies. +Can be used to scan a whole package or set of files for license information. +Very lightweight and can be run stand alone on a local workstation or integrated into a larger process. +Can use add-ons to create UI and graphs to further explore data. +* FOSSology - https://www.fossology.org/ - a license compliance toolkit that, among other things, includes license scanning agents to identify license text. +Can be used to scan a whole package or set of files for license information. +Installed as a full-scale web application with postgres database. Full WEBUI with file exploration capabilities to quickly find and review licenses as they exist in the code. === "Distributable" From bd3ba1f4c6003817ab5f5cce5e64115764f3a153 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 8/30] add/update section on new licenses add section on what to do if there is a new license not yet reviewed by Fedora --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index e2fc3ee..b41b6ab 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -107,6 +107,15 @@ Can use add-ons to create UI and graphs to further explore data. Can be used to scan a whole package or set of files for license information. Installed as a full-scale web application with postgres database. Full WEBUI with file exploration capabilities to quickly find and review licenses as they exist in the code. +=== What if I find a (new) license that is not on any Fedora list (good or bad)? +Send a link or text of the license and any other relevant information to legal@lists.fedoraproject.org mailing list for a determination as to whether the license is appropriate for Fedora. + +The list is open to any interested subscribers, but is moderated such that only subscribers may directly post. +You can subscribe to the mailing list and view the archives here: https://admin.fedoraproject.org/mailman/listinfo/legal + +Once a determination is made as to whether it is a good or bad license, the data for the license will need to be added to https://pagure.io/fedora-legal/license-data. +Anyone can submit a PR to contribute to this data, please follow the instructions there. + === "Distributable" In the past, Fedora (and Red Hat Linux) packages have used "Distributable" in the `+License:+` field. From e0686239641d190de8f5630b36ee1dd01d75c93f Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 9/30] add section re: requesting license to SPDX License List and update public domain section add section on if a license is not in SPDX, but reviewed for Fedora also moved Public Domain section up and updated re: SPDX identifiers --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index b41b6ab..2a588b2 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -116,6 +116,21 @@ You can subscribe to the mailing list and view the archives here: https://admin. Once a determination is made as to whether it is a good or bad license, the data for the license will need to be added to https://pagure.io/fedora-legal/license-data. Anyone can submit a PR to contribute to this data, please follow the instructions there. +=== What if a license is on a Fedora list (good or bad), but not on the SPDX License List? +If a license has been approved for Fedora as a good license, but it is not on the SPDX License List, submit the license to the SPDX-legal team at https://tools.spdx.org/app/submit_new_license/. +Make sure to note that it is approved for use in Fedora, what package it was found in Fedora and the other requested information. + +If a license has been determined to be a "bad" license, then there is generally no reason to add it to the SPDX License List. +However, it should still be recorded in the Fedora license database. + +=== Public Domain + +The SPDX License List may already include entries and short ids for public domain dedications, in which case, use the SPDX id. +For any public domain dedication that is not represented with an SPDX identifier, follow the same process as for any new license. + +If you believe that a work in Fedora which is marked as being in the Public Domain is actually available under a copyright license, +please inform us of this fact with details, and we will immediately investigate the claim. + === "Distributable" In the past, Fedora (and Red Hat Linux) packages have used "Distributable" in the `+License:+` field. @@ -223,10 +238,4 @@ Package spot-utils contains some files under the Python License, but one of the License: Python and (BSD with advertising and QPL) .... -== Public Domain -Works which are clearly marked as being in the Public Domain, and for which no evidence is known to contradict this statement, -are treated in Fedora as being in the Public Domain, on the grounds that the intentions of the original creator are reflected by such a use, even if due to regional issues, -it may not have been possible for the original creator to fully abandon all of their their copyrights on the work and place it fully into the Public Domain. -If you believe that a work in Fedora which is marked as being in the Public Domain is actually available under a copyright license, -please inform us of this fact with details, and we will immediately investigate the claim. From 1646907f2d05aee85f87b177dab25e4f89751b0d Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 10/30] update sentence re: license field update sentence re: license field to be more concise as per @mattdm suggestion --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 2a588b2..5e26a4e 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -80,7 +80,7 @@ Each of those License: tags must comply with all applicable guidelines. === Valid License Short Names -The `+License:+` field for new packages as of the Fedora Linux 36 branch date (2022-02-08) must be filled with the appropriate SPDX License identifier or expression from the SPDX License List and listed as a "Good License" on the {fedora-licensing} page. +The `+License:+` field for new packages must be filled with the appropriate SPDX License identifier or expression from the "Good License" on the {fedora-licensing} page. Note that some licenses may be approved for only certain types of material, e.g., fonts, content, or documentation. The SPDX License List provides identifiers for each individual license or exception based on a set of matching guidelines. From b3971620db579605520cfe4bd18fed5d460309b7 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 11/30] remove sentence re: common licenses require text suggestion from @ref re: "I think we should just get rid of this sentence. It raises a complicated question about FOSS compliance norms that I don' t think this document should necessarily get into." --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 5e26a4e..23172e8 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -25,7 +25,6 @@ but does not provide a copy of the license text (in the source tree, or in some the packager should do their best to point out this confusion to upstream. This sometimes occurs when an upstream project's only reference to a license is in a README (where they simply say "licensed under the FOO license"), on their website, or when they simply do not check a copy of the license into their Source tree. -Common licenses that require including their texts with all derivative works include Apache-2.0, EPL-1.0, EPL-2.0, BSD-3-Clause and most BSD variants, and MIT and most MIT variants. Packagers should point out to upstream that by not including a proper full license text, they are making it difficult or impossible for anyone to comply with their desired license terms. From ecbf39c6bd0282f618cefc85ee6ebdee1a6ff87b Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 12/30] modified title of section and added a bit to lead-in as per comments by @ref - updated some of language around "identify" to clarify (still noting that this whole section may be more appropriate in a general section on legal and licensing in docs) --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 23172e8..64e5138 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -87,10 +87,11 @@ For example, licenses that have different versions or options related to later v License expressions accommodate when multiple licenses apply, there is a choice of a license, a license and exception, or a combination thereof. See further information below. -=== How do I identify a license? === +=== How do I determine the license? === -Many licenses look similar to the naked eye, but may still have substantial differences. -There are several open source projects that can help detect and identify licenses. +Before you can fill in the `+License:+` field with the appropriate SPDX license identifier or expression that corresponds with a Fedora "good license", you need to determine what the actual license is. +The text of many open source licenses look similar to the naked eye, but may still have substantial differences. +There are several open source projects that can help definitively detect licenses. * SPDX-license-diff - https://github.com/spdx/spdx-license-diff - a browser plugin where you can highlight the text of a license and it will look for the closest match to the SPDX License List. This tool is quite fast and implements the SPDX Matching Guidelines. From 27b67372e7246e837cd442ce3dace766a305730e Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 13/30] wording improvements various wording improvements from @ref --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 64e5138..afab0c8 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -13,7 +13,7 @@ https://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses[Free Soft https://opensource.org/licenses/[OSI] and consultation with Red Hat Legal. -The information here provides guidance related to identifying and recording the license for each Fedora package. +The information here provides guidance related on how to populate the `+License:+` field of spec files for Fedora packages. == License Text @@ -84,7 +84,7 @@ Note that some licenses may be approved for only certain types of material, e.g. The SPDX License List provides identifiers for each individual license or exception based on a set of matching guidelines. For example, licenses that have different versions or options related to later versions have specific identifiers. -License expressions accommodate when multiple licenses apply, there is a choice of a license, a license and exception, or a combination thereof. +SPDX license expressions cover situations where multiple licenses apply to a package, where there is a choice of a license, and where licenses are coupled with exceptions or additional permissions. See further information below. === How do I determine the license? === @@ -125,7 +125,7 @@ However, it should still be recorded in the Fedora license database. === Public Domain -The SPDX License List may already include entries and short ids for public domain dedications, in which case, use the SPDX id. +The SPDX License List may already include entries and short ids for specific forms of public domain dedications, in which case, use the SPDX id. For any public domain dedication that is not represented with an SPDX identifier, follow the same process as for any new license. If you believe that a work in Fedora which is marked as being in the Public Domain is actually available under a copyright license, From 1af06b3d4e0f81dd38d49f8a8ff7bfca3e7676fb Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 14/30] update section on license expressions add lead-in and update sections on dual and multiple licensing --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index afab0c8..65d5f2a 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -144,10 +144,19 @@ then that package can use "Freely redistributable without restriction" as its `+ The `+License:+` field for any firmware that disallows modification should be set to: "Redistributable, no modification permitted". - -=== Dual Licensing Scenarios - -If your package is dual licensed (or triple licensed, etc.), the spec must reflect this by using "or" as a separator. +===Composite License Expressions +Often a single license can be used to represent the licensing terms for a package, but there are situations +where a single license identifier is not sufficient. +Some licenses may apply with an exception or additional permissions. +Software may be offered under a choice of one or more licenses (e.g., GPL-2.0-only OR BSD-3-Clause). +Another example is when a set of licenses apply to a package (e.g., LGPL-2.1-only AND BSD-3-Clause). +In these cases, SPDX License Expressions made by the use of the "WITH", "OR", and "AND" operators can be +used in the '+License:+' field as further described below (and in the SPDX Specification). + +==== Dual Licensing Scenarios + +If your package is licensed under a choice or two (or three, etc.) licenses, the '+License:+' field must +reflect this by using "OR" as a separator. Note that this only applies when the contents of the package are actually under a dual license, and not when the package contains items under multiple, distinct, and independent licenses. @@ -156,33 +165,34 @@ Package libfoo is dual licensed as Mozilla Public License v1.1 and GNU General P The package spec must have: .... -License: MPLv1.1 or GPLv2+ +License: MPL-1.1 OR GPL-2.0-or-later .... -=== Multiple Licensing Scenarios +==== Multiple Licensing Scenarios -If your package contains files which are under multiple, distinct, and independent licenses, then the spec must reflect this by using "and" as a separator. +If your package contains files which are under multiple, distinct, and independent licenses, then +the spec must reflect this by using "AND" as a separator. Fedora maintainers are highly encouraged to avoid this scenario whenever reasonably possible, by dividing files into subpackages (subpackages can each have their own `+License:+` field). Example: Package bar-utils contains some files under the Python License, some other files under the GNU Lesser General Public License v2 or later, -and one file under the BSD License (no advertising). +and one file under the BSD 3-Clause License. The package spec must have: .... -License: Python and LGPLv2+ and BSD +License: Python-2.0 AND LGPL-2.0-or-later AND BSD-3-Clause .... -In addition, the package must contain a comment explaining the multiple licensing breakdown. +In addition, the package spec must contain a comment explaining the multiple licensing breakdown. The actual implementation of this is left to the maintainer. -Some suggested implementations include +Some suggested implementations include: * A comment right above the `+License:+` field: .... -# The entire source code is GPLv2+ except foolib/ which is BSD -License: GPLv2+ and BSD +# The entire source code is GPL-2.0-or-later except foolib/ which is BSD-3-Clause +License: GPL-2.0-or-later AND BSD-3-Clause .... * Including a file as `+%license+` which contains the licensing breakdown for the packaged files, then using: @@ -196,29 +206,31 @@ License: GPLv2+ and BSD .... %files %doc Changes -# Python +# Python-2.0 %{_bindir}/cobra-util %{_bindir}/viper-util -# LGPLv2+ +# LGPL-2.0-or-later %{_bindir}/gnu-util %{_bindir}/rms-util -# BSD +# BSD-3-Clause %{_bindir}/berkeley-util .... -=== Combined Dual and Multiple Licensing Scenario +==== Combined Dual and Multiple Licensing Scenario -If you are unlucky enough that your package possesses items multiple, distinct, and independent licenses...AND some of those items are dual licensed, -you must note the dual licensed items by wrapping them with parenthesis (). +If you are unlucky enough that your package possesses multiple, distinct, and independent licenses...AND +some of those items are dual licensed, +you must note the dual licensed items by wrapping them with parenthesis () to express order of predence. Otherwise, the guidelines for Dual and Multiple Licensing apply. Example: -Package baz-utils contains some files under the Python License, some other files under the GNU Lesser General Public License v2 or later, -one file under the BSD License, no advertising, and one file which is dual licensed as Mozilla Public License v1.1 and GNU General Public License v2 or later. +Package baz-utils contains some files under the Python License, some other files under the +GNU Lesser General Public License v2 or later, one file under the BSD 3-Clause License, and one file +which is dual licensed as Mozilla Public License v1.1 and GNU General Public License v2 or later. The package spec must have: .... -License: Python and LGPLv2+ and BSD and (MPLv1.1 or GPLv2+) +License: Python-2.0 AND LGPL-2.0-or-later AND BSD-3-Clause AND (MPL-1.1 OR GPL-2.0-or-later) .... Since this is a multiple licensing scenario, the package must contain a comment explaining the multiple licensing breakdown. @@ -226,16 +238,18 @@ The actual implementation of this is left to the maintainer. === Mixed Source Licensing Scenario -In some cases, it is possible for a binary to be generated from multiple source files with compatible, but differing licenses. +In some cases, it is possible for a binary to be generated from multiple source files with compatible, +but differing licenses. Thus, the binary file would actually have simultaneous dual licensing (an AND, as opposed to an OR). For example, it is possible that a binary is generated from a source file licensed as BSD with advertising, and another source file licensed as QPL (which specifies that modifications must be shipped as patches). In this scenario, we'd wrap the list of licenses for that binary with parenthesis, example: -Package spot-utils contains some files under the Python License, but one of the files is generated from a BSD with advertising source file and a QPL source file. +Package spot-utils contains some files under the Python License, but one of the files is generated from a +BSD-3-Clause source file and a QPL source file. .... -License: Python and (BSD with advertising and QPL) +License: Python-2.0 AND (BSD-3-Clause AND QPL) .... From 3bba635a520f9b70aca0c28777ca5db31890fd6f Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 15/30] add section on exceptions add section on creating a license expression with the WITH operator for license exceptions --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 65d5f2a..7c4f1c1 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -153,6 +153,18 @@ Another example is when a set of licenses apply to a package (e.g., LGPL-2.1-onl In these cases, SPDX License Expressions made by the use of the "WITH", "OR", and "AND" operators can be used in the '+License:+' field as further described below (and in the SPDX Specification). +====License Exceptions + +If your package is licensed under a license and also applies an exception or additional +permission, the '+License:+' field must reflect this using "WITH" as a separator. + +Example: Package bison is licensed under GNU General Public License v2 or later with +the Bison exception. The package spec must have: + +.... +License: GPL-2.0-or-later WITH Bison-exception-2.2 +.... + ==== Dual Licensing Scenarios If your package is licensed under a choice or two (or three, etc.) licenses, the '+License:+' field must From b89bb0da5c2a6a0620185434f21c9807b0dd08ee Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 16/30] fix spacing on headers --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 7c4f1c1..0e44f2f 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -144,7 +144,7 @@ then that package can use "Freely redistributable without restriction" as its `+ The `+License:+` field for any firmware that disallows modification should be set to: "Redistributable, no modification permitted". -===Composite License Expressions +=== Composite License Expressions Often a single license can be used to represent the licensing terms for a package, but there are situations where a single license identifier is not sufficient. Some licenses may apply with an exception or additional permissions. @@ -153,7 +153,7 @@ Another example is when a set of licenses apply to a package (e.g., LGPL-2.1-onl In these cases, SPDX License Expressions made by the use of the "WITH", "OR", and "AND" operators can be used in the '+License:+' field as further described below (and in the SPDX Specification). -====License Exceptions +==== License Exceptions If your package is licensed under a license and also applies an exception or additional permission, the '+License:+' field must reflect this using "WITH" as a separator. From 8d356d87fe87da3d74d99aacc616c6709f773ecc Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 17/30] update good/bad language to allowed/not-allowed --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 0e44f2f..d1aeb03 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -7,11 +7,12 @@ The goal of the Fedora Project is to work with the Linux community to create a complete, general purpose operating system exclusively from Free and Open Source software. -All software in Fedora must be under licenses in the {fedora-licensing-list}. +All software in Fedora must be under allowed licenses in the {fedora-licensing-list}. This list is based on the licenses approved by the https://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses[Free Software Foundation], https://opensource.org/licenses/[OSI] and consultation with Red Hat Legal. +For more details on the criteria for allowed and not-allowed licenses, see LINK The information here provides guidance related on how to populate the `+License:+` field of spec files for Fedora packages. @@ -79,8 +80,8 @@ Each of those License: tags must comply with all applicable guidelines. === Valid License Short Names -The `+License:+` field for new packages must be filled with the appropriate SPDX License identifier or expression from the "Good License" on the {fedora-licensing} page. -Note that some licenses may be approved for only certain types of material, e.g., fonts, content, or documentation. +The `+License:+` field for new packages must be filled with the appropriate SPDX License identifier or expression from the list of allowed licenses on the {fedora-licensing} page. +Note that some licenses may be allowed for only certain types of material, e.g., fonts, content, or documentation. The SPDX License List provides identifiers for each individual license or exception based on a set of matching guidelines. For example, licenses that have different versions or options related to later versions have specific identifiers. @@ -107,7 +108,7 @@ Can use add-ons to create UI and graphs to further explore data. Can be used to scan a whole package or set of files for license information. Installed as a full-scale web application with postgres database. Full WEBUI with file exploration capabilities to quickly find and review licenses as they exist in the code. -=== What if I find a (new) license that is not on any Fedora list (good or bad)? +=== What if I find a (new) license that is not on any Fedora list (allowed or not-allowed)? Send a link or text of the license and any other relevant information to legal@lists.fedoraproject.org mailing list for a determination as to whether the license is appropriate for Fedora. The list is open to any interested subscribers, but is moderated such that only subscribers may directly post. From 41003ff2137df6888f2d3bf96db15104af125bfc Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 18/30] Update to section on dual-licensing updates as per discussion on fedora-legal mailing list --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index d1aeb03..231ea9b 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -168,7 +168,7 @@ License: GPL-2.0-or-later WITH Bison-exception-2.2 ==== Dual Licensing Scenarios -If your package is licensed under a choice or two (or three, etc.) licenses, the '+License:+' field must +If your package is licensed under a choice or two (or three, etc.) licenses and both licenses are allowed for Fedora, the '+License:+' field must reflect this by using "OR" as a separator. Note that this only applies when the contents of the package are actually under a dual license, and not when the package contains items under multiple, distinct, and independent licenses. @@ -181,6 +181,10 @@ The package spec must have: License: MPL-1.1 OR GPL-2.0-or-later .... +If your package is licensed under a known choice of two licenses and one is an allowed license and one is a not-allowed license, then the '+License:+' field must reflect the allowed license only. +You are encouraged to include a comment memorializing the upstream licensing choice. + + ==== Multiple Licensing Scenarios If your package contains files which are under multiple, distinct, and independent licenses, then From a05988e5f906122c5af1b83b52aec3df19d5f4f7 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 19/30] remove process related items Removing "new" sections re: how to determine a license, what do to do if find license not listed in Fedora lists or not on SPDX License List - will move this type of process info to Fedora-legal licensing docs section --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 231ea9b..6094352 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -86,43 +86,8 @@ Note that some licenses may be allowed for only certain types of material, e.g., The SPDX License List provides identifiers for each individual license or exception based on a set of matching guidelines. For example, licenses that have different versions or options related to later versions have specific identifiers. SPDX license expressions cover situations where multiple licenses apply to a package, where there is a choice of a license, and where licenses are coupled with exceptions or additional permissions. -See further information below. - -=== How do I determine the license? === - -Before you can fill in the `+License:+` field with the appropriate SPDX license identifier or expression that corresponds with a Fedora "good license", you need to determine what the actual license is. -The text of many open source licenses look similar to the naked eye, but may still have substantial differences. -There are several open source projects that can help definitively detect licenses. - -* SPDX-license-diff - https://github.com/spdx/spdx-license-diff - a browser plugin where you can highlight the text of a license and it will look for the closest match to the SPDX License List. -This tool is quite fast and implements the SPDX Matching Guidelines. -The big advantage here (over SPDX Check License) is it shows you close matches. -This is likely the most useful tool in determining if a license matches a license on the SPDX License List. -* SPDX Check License - https://tools.spdx.org/app/check_license/ - an online tool where you can paste the text of a license and it will match it against all the license and exceptions on the SPDX License List, fully implementing the SPDX Matching Guidelines. -Due to its thoroughness, this tool may take a little time to get an answer (than license-diff) and will simply tell you if there is a match or not. -* ScanCode - https://github.com/nexB/scancode-toolkit - scanning tool that detects licenses, copyrights, package manifests, and dependencies. -Can be used to scan a whole package or set of files for license information. -Very lightweight and can be run stand alone on a local workstation or integrated into a larger process. -Can use add-ons to create UI and graphs to further explore data. -* FOSSology - https://www.fossology.org/ - a license compliance toolkit that, among other things, includes license scanning agents to identify license text. -Can be used to scan a whole package or set of files for license information. -Installed as a full-scale web application with postgres database. Full WEBUI with file exploration capabilities to quickly find and review licenses as they exist in the code. - -=== What if I find a (new) license that is not on any Fedora list (allowed or not-allowed)? -Send a link or text of the license and any other relevant information to legal@lists.fedoraproject.org mailing list for a determination as to whether the license is appropriate for Fedora. - -The list is open to any interested subscribers, but is moderated such that only subscribers may directly post. -You can subscribe to the mailing list and view the archives here: https://admin.fedoraproject.org/mailman/listinfo/legal - -Once a determination is made as to whether it is a good or bad license, the data for the license will need to be added to https://pagure.io/fedora-legal/license-data. -Anyone can submit a PR to contribute to this data, please follow the instructions there. - -=== What if a license is on a Fedora list (good or bad), but not on the SPDX License List? -If a license has been approved for Fedora as a good license, but it is not on the SPDX License List, submit the license to the SPDX-legal team at https://tools.spdx.org/app/submit_new_license/. -Make sure to note that it is approved for use in Fedora, what package it was found in Fedora and the other requested information. - -If a license has been determined to be a "bad" license, then there is generally no reason to add it to the SPDX License List. -However, it should still be recorded in the Fedora license database. + +For more information on what to do if you find a license that is not on the Fedora list, does not have a corresponding SPDX license identifier or expression or other process questions, see LINK. === Public Domain From e9de46e32092c6526f7422996615e263d841236f Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 20/30] add note at top better description of where to find additional relevant info --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 6094352..24aa7e7 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -12,7 +12,8 @@ This list is based on the licenses approved by the https://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses[Free Software Foundation], https://opensource.org/licenses/[OSI] and consultation with Red Hat Legal. -For more details on the criteria for allowed and not-allowed licenses, see LINK + +For more details on the criteria for allowed and not-allowed licenses, questions related to process, or other helpful guidance related to Fedora licensing, see LINK The information here provides guidance related on how to populate the `+License:+` field of spec files for Fedora packages. From a0123696bd2d3cce393c7e542485fdd68ecd5981 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 21/30] additional wording updates to intro text --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 24aa7e7..53b338c 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -5,17 +5,20 @@ == Fedora Licensing -The goal of the Fedora Project is to work with the Linux community to create a complete, general purpose operating system exclusively from Free and Open Source software. +The goal of the Fedora Project is to work with the Linux community to create a complete, +general purpose operating system exclusively from free and open source software. -All software in Fedora must be under allowed licenses in the {fedora-licensing-list}. -This list is based on the licenses approved by the +All software in Fedora must be under licenses that meet the criteria LINK for Fedora. +This criteria is based on the licenses approved by the https://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses[Free Software Foundation], https://opensource.org/licenses/[OSI] and consultation with Red Hat Legal. -For more details on the criteria for allowed and not-allowed licenses, questions related to process, or other helpful guidance related to Fedora licensing, see LINK +For more details on the criteria for allowed and not-allowed licenses, questions related to process, +or other helpful guidance related to Fedora licensing, see LINK -The information here provides guidance related on how to populate the `+License:+` field of spec files for Fedora packages. +The information here provides guidance on how to populate the `+License:+` field of spec files +for Fedora packages. == License Text @@ -62,9 +65,6 @@ However, if a subpackage is independent of any base package (it does not require In cases where the licensing is unclear, it may be necessary to contact the copyright holders to confirm the licensing of code or content. In those situations, it is _always_ preferred to ask upstream to resolve the licensing confusion by documenting the licensing and releasing an updated tarball. However, this is not always possible to achieve. -In such cases, it is acceptable to receive confirmation of licensing via email. -A copy of the email, containing full headers, must be included as a source file (marked as %license) in the package. -This file is considered part of the license text. == License: field From 5c515daae464e324793b3b6b96d22bfd1bcf0858 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 22/30] update sections on distributable, public domain, and firmware --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 53b338c..7f55fd9 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -73,11 +73,7 @@ Maintainers should be aware that the contents of the `+License:+` field are unde but maintainers must make every possible effort to be accurate when filling the `+License:+` field. The License: field refers to the licenses of the contents of the *_binary_* rpm. -When in doubt, ask. - -If a source package generates multiple binary packages, the License: field may differ between them if necessary. -This implies that a single spec may have multiple per-subpackage License: tags. -Each of those License: tags must comply with all applicable guidelines. +For more information on this see LINK. === Valid License Short Names @@ -88,28 +84,27 @@ The SPDX License List provides identifiers for each individual license or except For example, licenses that have different versions or options related to later versions have specific identifiers. SPDX license expressions cover situations where multiple licenses apply to a package, where there is a choice of a license, and where licenses are coupled with exceptions or additional permissions. -For more information on what to do if you find a license that is not on the Fedora list, does not have a corresponding SPDX license identifier or expression or other process questions, see LINK. +For more information on what to do if you find a license that is not on the Fedora list, +does not have a corresponding SPDX license identifier or expression or other process questions, see LINK. === Public Domain The SPDX License List may already include entries and short ids for specific forms of public domain dedications, in which case, use the SPDX id. For any public domain dedication that is not represented with an SPDX identifier, follow the same process as for any new license. -If you believe that a work in Fedora which is marked as being in the Public Domain is actually available under a copyright license, -please inform us of this fact with details, and we will immediately investigate the claim. - === "Distributable" In the past, Fedora (and Red Hat Linux) packages have used "Distributable" in the `+License:+` field. In virtually all of these cases, this was not correct. Fedora no longer permits packages to use "Distributable" as a valid License. -If your package contains content which is freely redistributable without restrictions, -but does not contain any license other than explicit permission from the content owner/creator, -then that package can use "Freely redistributable without restriction" as its `+License:+` identifier. + === Firmware -The `+License:+` field for any firmware that disallows modification should be set to: "Redistributable, no modification permitted". +The `+License:+` field for any firmware with a license that that meets the allowed-for-firmware criteria +should be set to: "Redistributable, no modification permitted". +This is the one exception to using SPDX identifiers in the License: field. +This may later be addressed in a different way. === Composite License Expressions Often a single license can be used to represent the licensing terms for a package, but there are situations From a14aeb9e1fac236423c0d151768973a0f7c6ed80 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 23/30] remove composite license examples these will move to a new page in Fedora-legal Docs section along with an explanation of the license-of-the-binary policy for the License: field --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 7f55fd9..886b3f8 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -113,121 +113,5 @@ Some licenses may apply with an exception or additional permissions. Software may be offered under a choice of one or more licenses (e.g., GPL-2.0-only OR BSD-3-Clause). Another example is when a set of licenses apply to a package (e.g., LGPL-2.1-only AND BSD-3-Clause). In these cases, SPDX License Expressions made by the use of the "WITH", "OR", and "AND" operators can be -used in the '+License:+' field as further described below (and in the SPDX Specification). - -==== License Exceptions - -If your package is licensed under a license and also applies an exception or additional -permission, the '+License:+' field must reflect this using "WITH" as a separator. - -Example: Package bison is licensed under GNU General Public License v2 or later with -the Bison exception. The package spec must have: - -.... -License: GPL-2.0-or-later WITH Bison-exception-2.2 -.... - -==== Dual Licensing Scenarios - -If your package is licensed under a choice or two (or three, etc.) licenses and both licenses are allowed for Fedora, the '+License:+' field must -reflect this by using "OR" as a separator. -Note that this only applies when the contents of the package are actually under a dual license, -and not when the package contains items under multiple, distinct, and independent licenses. - -Example: -Package libfoo is dual licensed as Mozilla Public License v1.1 and GNU General Public License v2 or later. -The package spec must have: - -.... -License: MPL-1.1 OR GPL-2.0-or-later -.... - -If your package is licensed under a known choice of two licenses and one is an allowed license and one is a not-allowed license, then the '+License:+' field must reflect the allowed license only. -You are encouraged to include a comment memorializing the upstream licensing choice. - - -==== Multiple Licensing Scenarios - -If your package contains files which are under multiple, distinct, and independent licenses, then -the spec must reflect this by using "AND" as a separator. -Fedora maintainers are highly encouraged to avoid this scenario whenever reasonably possible, -by dividing files into subpackages (subpackages can each have their own `+License:+` field). - -Example: -Package bar-utils contains some files under the Python License, some other files under the GNU Lesser General Public License v2 or later, -and one file under the BSD 3-Clause License. -The package spec must have: - -.... -License: Python-2.0 AND LGPL-2.0-or-later AND BSD-3-Clause -.... - -In addition, the package spec must contain a comment explaining the multiple licensing breakdown. -The actual implementation of this is left to the maintainer. -Some suggested implementations include: - -* A comment right above the `+License:+` field: - -.... -# The entire source code is GPL-2.0-or-later except foolib/ which is BSD-3-Clause -License: GPL-2.0-or-later AND BSD-3-Clause -.... - -* Including a file as `+%license+` which contains the licensing breakdown for the packaged files, then using: - -.... -# For a breakdown of the licensing, see PACKAGE-LICENSING -.... - -* Noting the license above the appropriate %files section: - -.... -%files -%doc Changes -# Python-2.0 -%{_bindir}/cobra-util -%{_bindir}/viper-util -# LGPL-2.0-or-later -%{_bindir}/gnu-util -%{_bindir}/rms-util -# BSD-3-Clause -%{_bindir}/berkeley-util -.... - -==== Combined Dual and Multiple Licensing Scenario - -If you are unlucky enough that your package possesses multiple, distinct, and independent licenses...AND -some of those items are dual licensed, -you must note the dual licensed items by wrapping them with parenthesis () to express order of predence. -Otherwise, the guidelines for Dual and Multiple Licensing apply. - -Example: -Package baz-utils contains some files under the Python License, some other files under the -GNU Lesser General Public License v2 or later, one file under the BSD 3-Clause License, and one file -which is dual licensed as Mozilla Public License v1.1 and GNU General Public License v2 or later. -The package spec must have: - -.... -License: Python-2.0 AND LGPL-2.0-or-later AND BSD-3-Clause AND (MPL-1.1 OR GPL-2.0-or-later) -.... - -Since this is a multiple licensing scenario, the package must contain a comment explaining the multiple licensing breakdown. -The actual implementation of this is left to the maintainer. - -=== Mixed Source Licensing Scenario - -In some cases, it is possible for a binary to be generated from multiple source files with compatible, -but differing licenses. -Thus, the binary file would actually have simultaneous dual licensing (an AND, as opposed to an OR). -For example, it is possible that a binary is generated from a source file licensed as BSD with advertising, -and another source file licensed as QPL (which specifies that modifications must be shipped as patches). -In this scenario, we'd wrap the list of licenses for that binary with parenthesis, example: - -Package spot-utils contains some files under the Python License, but one of the files is generated from a -BSD-3-Clause source file and a QPL source file. - -.... -License: Python-2.0 AND (BSD-3-Clause AND QPL) -.... - +used in the '+License:+' field as further described LINK. From 93b2722b2ac8f19dcf2af3bb388bc7873e0cfd0b Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 24/30] update links in first section --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 886b3f8..0863971 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -8,17 +8,17 @@ The goal of the Fedora Project is to work with the Linux community to create a complete, general purpose operating system exclusively from free and open source software. -All software in Fedora must be under licenses that meet the criteria LINK for Fedora. +All software in Fedora must be under licenses that meet https://docs.stg.fedoraproject.org/en-US/legal/license-approval/[Fedora License Approval]. This criteria is based on the licenses approved by the https://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses[Free Software Foundation], https://opensource.org/licenses/[OSI] and consultation with Red Hat Legal. For more details on the criteria for allowed and not-allowed licenses, questions related to process, -or other helpful guidance related to Fedora licensing, see LINK +or other helpful guidance related to Fedora licensing, see https://docs.stg.fedoraproject.org/en-US/legal/[Licensing in Fedora]. -The information here provides guidance on how to populate the `+License:+` field of spec files -for Fedora packages. +The information here provides guidance on how to add license text in `+%license+` and how to populate the `+License:+` field of +spec files for Fedora packages. == License Text From c7e530bf2354407639c8d2e2b57af61166302866 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 25/30] update more links to new docs --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 0863971..7bd2b8e 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -8,7 +8,7 @@ The goal of the Fedora Project is to work with the Linux community to create a complete, general purpose operating system exclusively from free and open source software. -All software in Fedora must be under licenses that meet https://docs.stg.fedoraproject.org/en-US/legal/license-approval/[Fedora License Approval]. +All software in Fedora must be under licenses that has been determined to be https://docs.stg.fedoraproject.org/en-US/legal/license-approval/[allowed for Fedora]. This criteria is based on the licenses approved by the https://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses[Free Software Foundation], https://opensource.org/licenses/[OSI] @@ -73,19 +73,21 @@ Maintainers should be aware that the contents of the `+License:+` field are unde but maintainers must make every possible effort to be accurate when filling the `+License:+` field. The License: field refers to the licenses of the contents of the *_binary_* rpm. -For more information on this see LINK. +For more information on this, see https://docs.stg.fedoraproject.org/en-US/legal/license-field/[License: field in Spec file policy and examples]. === Valid License Short Names -The `+License:+` field for new packages must be filled with the appropriate SPDX License identifier or expression from the list of allowed licenses on the {fedora-licensing} page. +The `+License:+` field for new packages must be filled with the appropriate SPDX license identifier or +expression from the list of https://docs.stg.fedoraproject.org/en-US/legal/allowed-licenses/[allowed licenses for Fedora. Note that some licenses may be allowed for only certain types of material, e.g., fonts, content, or documentation. The SPDX License List provides identifiers for each individual license or exception based on a set of matching guidelines. For example, licenses that have different versions or options related to later versions have specific identifiers. -SPDX license expressions cover situations where multiple licenses apply to a package, where there is a choice of a license, and where licenses are coupled with exceptions or additional permissions. +SPDX license expressions cover situations where multiple licenses apply to a package, where there is a choice +of a license, and where licenses are coupled with exceptions or additional permissions. For more information on what to do if you find a license that is not on the Fedora list, -does not have a corresponding SPDX license identifier or expression or other process questions, see LINK. +does not have a corresponding SPDX license identifier or expression, or other process questions, see https://docs.stg.fedoraproject.org/en-US/legal/license-review-process/[License Review Process]. === Public Domain From 99b488f5464a493bfc9a388b9980ff4a30122bb4 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 26/30] remove bit on public domain move to new docs page --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 7bd2b8e..6e0e08b 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -89,10 +89,6 @@ of a license, and where licenses are coupled with exceptions or additional permi For more information on what to do if you find a license that is not on the Fedora list, does not have a corresponding SPDX license identifier or expression, or other process questions, see https://docs.stg.fedoraproject.org/en-US/legal/license-review-process/[License Review Process]. -=== Public Domain - -The SPDX License List may already include entries and short ids for specific forms of public domain dedications, in which case, use the SPDX id. -For any public domain dedication that is not represented with an SPDX identifier, follow the same process as for any new license. === "Distributable" From 9c240f4d73a28df161fe47e60b5b8ef1f588920b Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 27/30] remove bit on "distributable to move to new licensing docs --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 6e0e08b..54b1541 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -90,11 +90,6 @@ For more information on what to do if you find a license that is not on the Fedo does not have a corresponding SPDX license identifier or expression, or other process questions, see https://docs.stg.fedoraproject.org/en-US/legal/license-review-process/[License Review Process]. -=== "Distributable" - -In the past, Fedora (and Red Hat Linux) packages have used "Distributable" in the `+License:+` field. -In virtually all of these cases, this was not correct. -Fedora no longer permits packages to use "Distributable" as a valid License. === Firmware From 655c4bb8729d1298e65160ef5a3cb8b793dc1902 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 28/30] remove bit on firmware to move to new licensing docx --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 54b1541..890ca0a 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -92,12 +92,6 @@ does not have a corresponding SPDX license identifier or expression, or other pr -=== Firmware - -The `+License:+` field for any firmware with a license that that meets the allowed-for-firmware criteria -should be set to: "Redistributable, no modification permitted". -This is the one exception to using SPDX identifiers in the License: field. -This may later be addressed in a different way. === Composite License Expressions Often a single license can be used to represent the licensing terms for a package, but there are situations From eb83099a176c8127f7b482e9db5135a9ea029ec9 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 29/30] remove composite license bit and update more links --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 890ca0a..8b72f3f 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -8,14 +8,14 @@ The goal of the Fedora Project is to work with the Linux community to create a complete, general purpose operating system exclusively from free and open source software. -All software in Fedora must be under licenses that has been determined to be https://docs.stg.fedoraproject.org/en-US/legal/license-approval/[allowed for Fedora]. +All software in Fedora must be under licenses that has been determined to be https://docs.fedoraproject.org/en-US/legal/license-approval/[allowed for Fedora]. This criteria is based on the licenses approved by the https://www.gnu.org/philosophy/license-list.html#GPLCompatibleLicenses[Free Software Foundation], https://opensource.org/licenses/[OSI] and consultation with Red Hat Legal. For more details on the criteria for allowed and not-allowed licenses, questions related to process, -or other helpful guidance related to Fedora licensing, see https://docs.stg.fedoraproject.org/en-US/legal/[Licensing in Fedora]. +or other helpful guidance related to Fedora licensing, see https://docs.fedoraproject.org/en-US/legal/[Licensing in Fedora]. The information here provides guidance on how to add license text in `+%license+` and how to populate the `+License:+` field of spec files for Fedora packages. @@ -73,12 +73,13 @@ Maintainers should be aware that the contents of the `+License:+` field are unde but maintainers must make every possible effort to be accurate when filling the `+License:+` field. The License: field refers to the licenses of the contents of the *_binary_* rpm. -For more information on this, see https://docs.stg.fedoraproject.org/en-US/legal/license-field/[License: field in Spec file policy and examples]. + +This policy and examples can be found at https://docs.fedoraproject.org/en-US/legal/license-field/[License: field in Spec file]. === Valid License Short Names -The `+License:+` field for new packages must be filled with the appropriate SPDX license identifier or -expression from the list of https://docs.stg.fedoraproject.org/en-US/legal/allowed-licenses/[allowed licenses for Fedora. +The `+License:+` field for new packages as of July 2022 must be filled with the appropriate SPDX license identifier or +expression from the list of https://docs.fedoraproject.org/en-US/legal/allowed-licenses/[allowed licenses for Fedora. Note that some licenses may be allowed for only certain types of material, e.g., fonts, content, or documentation. The SPDX License List provides identifiers for each individual license or exception based on a set of matching guidelines. @@ -86,19 +87,12 @@ For example, licenses that have different versions or options related to later v SPDX license expressions cover situations where multiple licenses apply to a package, where there is a choice of a license, and where licenses are coupled with exceptions or additional permissions. -For more information on what to do if you find a license that is not on the Fedora list, -does not have a corresponding SPDX license identifier or expression, or other process questions, see https://docs.stg.fedoraproject.org/en-US/legal/license-review-process/[License Review Process]. - +https://docs.fedoraproject.org/en-US/legal/license-field/[License: field in Spec file] contains examples and further explanations for using SPDX expressions in the `License:` field. +For more information on what to do if you find a license that is not on the Fedora list, +does not have a corresponding SPDX license identifier or expression, or other process questions, see https://docs.fedoraproject.org/en-US/legal/license-review-process/[License Review Process]. -=== Composite License Expressions -Often a single license can be used to represent the licensing terms for a package, but there are situations -where a single license identifier is not sufficient. -Some licenses may apply with an exception or additional permissions. -Software may be offered under a choice of one or more licenses (e.g., GPL-2.0-only OR BSD-3-Clause). -Another example is when a set of licenses apply to a package (e.g., LGPL-2.1-only AND BSD-3-Clause). -In these cases, SPDX License Expressions made by the use of the "WITH", "OR", and "AND" operators can be -used in the '+License:+' field as further described LINK. + From 1bfc7ee4d5d95d674da8d44e225d1ac1c1582f81 Mon Sep 17 00:00:00 2001 From: Jilayne Lovejoy Date: Jul 27 2022 21:38:27 +0000 Subject: [PATCH 30/30] update sources of license text --- diff --git a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc index 8b72f3f..81c84a4 100644 --- a/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc +++ b/guidelines/modules/ROOT/pages/LicensingGuidelines.adoc @@ -43,7 +43,7 @@ they can easily remedy this by making full license text available in the source Packagers who choose to do this should ensure that they have exhausted all attempts to work with upstream to include the license text as part of the source code, or at least, to confirm the full license text explicitly with the upstream, as this minimizes the risk on the packager. Packagers may also take copies of license texts from reliable and canonical sources -(such as the original license text from the license steward, Fedora Software Licenses page, the SPDX License List, the FSF licenses page, or the OSI license list), whenever possible. +(such as the original license text from the license steward, Fedora licenses page, the FSF licenses page, or the OSI license list), whenever possible. * Choose not to package that software for Fedora.