Explaining & Accessing the SPDX License List

Size: px

Start display at page:

Download "Explaining & Accessing the SPDX License List"

Eunice Foster
5 years ago
Views:

1 Explaining & Accessing the SPDX License List SOFTWARE PACKAGE DATA EXCHANGE Gary O Neall Source Auditor Inc. Jilayne Lovejoy ARM August, 2014 Copyright Linux Foundation

2 The SPDX License List 2

3 The SPDX License List List of (common) open source* licenses Current release (v1.20) has 306 licenses on it Full name, short identifier, notes, URL, whether OSI approved, license text Short identifier allows for easy reference Principles of inclusion * use OSD as a baseline, but not strict requirement Ability to request a license be added Matching guidelines 3

4 License Info at Package Level 4

5 License Info at the File Level 5

6 It s Complicated... LicenseConcluded: (Ruby or BSD-2-Clause) LicenseConcluded: (GPL-2.0 and BSD-3-Clause) LicenseConcluded: (GPL-2.0+ and BSD-3-Clause) ((GPL-2.0 or GPL-3.0) and BSD-3-Clause) 6

7 It s a bit flat... 7

8 Version more expressive! Goal: improve the ability to describe more license variations utilizing some operator(s) GPL WITH AND OR GPL-2.0+ WITH GCC-exception license_expression_syntax 8

9 Version License Templates Some licenses have text that is replaceable: BSD-3-Clause: third clause and disclaimer might have specific copyright holder name Don t want to have a different name result in a non-match Such licenses will include a template file (.txt) that includes mark-ups to indicate optional and replaceable text Example: BSD 2-Clause (next slide) 9

10 <<beginoptional;name=copyrightsection>> Copyright (c) <<var;name=copyright;original= <year> <owner>;match=.+;example=john Doe>> All rights reserved. <<endoptional>> Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY <<var;name=copyrightholderasis;original=the COPYRIGHT HOLDERS AND CONTRIBUTORS; match=.+;example=john DOE>> "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL <<var;name=copyrightholderliability;original=the COPYRIGHT HOLDER OR CONTRIBUTORS; match=.+;example=john DOE>> BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS I NTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

11 ACCESSING THE SPDX LICENSE LIST How do I get my hands on it? August, 2014 Copyright Linux Foundation

12 Overview Simply reading the licenses the SPDX License List web pages Accessing the licenses from the repository Programmatically accessing the licenses Via the Semantic Web RDFa Via Java SPDX Tools Library Accessing older versions of the license web pages 12

13 SPDX License List - Index Location: 13

14 SPDX License Pages Location: where spdx-short-id is the SPDX short identifier for the license 14

15 SPDX License List Repository A Git repository of the SPDX License List is maintained at git.spdx.org. Web access to the repository: Tags are created for each release of the license list in the format v followed by the version number. There are 2 types of files: Spreadsheet - A spreadsheet file named spdx_licenselist_vx.xx containing the license information Text files for each of the licenses (in the license template format, if applicable) 15

16 SPDX License List Repository 16

17 RDFa Access What is RDFa? RDFa (Resource Descriptor Framework in Attributes) extends HTML (and XHTML) with attributes allowing RDF data to be easily extracted from the same web pages which can also be rendered using web browsers. Several parsers and tools are available see Location The index html file ( contains license IDs and license list version information Each license HTML file contains terms fully describing the license 17

18 RDFa Terms License ID - License Name - (earlier versions License Header - License Template - OSI Approved - Cross Reference URL - (earlier versions 18

19 SPDX Tools Library Open source (Apache 2.0 licensed) Java code providing access the SPDX Standard Libraries Binary.jar files available: Maven central repository the group ID org.spdx and the artifact ID spdx-tools Source code available: git.spdx.org spdx-tools project Bugs / enhancement ideas can be reported: bugs.linuxfoundation.org project SPDX/tools Contributions welcome! 19

20 SPDXLicenseInfoFactory The primary interfaces to the SPDX standard licenses are the following methods in the org.spdx.rdfparser.spdxlicenseinfofactory class String getlicenselistversion() SPDXStandardLicense getstandardlicensebyid(string licenseid) String[] getstandardlicenseids() isstandardlicenseid(string licenseid) SPDXLicenseInfo parsespdxlicensestring(string licensestring) 20

21 licensetemplate Package The package org.spdx.licensetemplate contains classes to manage the license templates used in SPDX standard licenses. See the JavaDocs for this package (located in the doc directory of the source code or in the javadoc jar file in Maven) for a description of the interface to this package. The primary interfaces are in the org.spdx.licensetemplate SpdxLicenseTemplateHelper class 21

22 LicenseCompareHelper The class: org.spdx.compare.licensecomparehelper contains methods to compare license text to determine if they are equivalent according to the license matching guidelines maintained by the SPDX workgroup boolean LicenseCompareHelper.isTextStandardLicense (SPDXStandardLicense license, String licensetext) 22

23 More Information See the tech report Accessing SPDX Licenses : accessing-spdx-licenses Join the spdx-tech mailing list me at gary@sourceauditor.com 23

24 Example #1 Get License Text public static void main(string[] args) { try { SPDXStandardLicense apache11 = SPDXLicenseInfoFactory.getStandardLicenseById("Apache-1.1"); System.out.println(apache11.getText()); } catch (InvalidSPDXAnalysisException e) { System.out.println("Error getting Standard License: " + } } e.getmessage()); 24

25 Example 2: Equivalent Licenses public static void main(string[] args) { String licensetext = "..."; try { SPDXStandardLicense bsd3clause = SPDXLicenseInfoFactory.getStandardLicenseById("BSD-3-Clause"); boolean matches = LicenseCompareHelper if (matches) { } else { }.istextstandardlicense(bsd3clause, licensetext); System.out.println("Matches"); System.out.println("Does not match"); } catch (InvalidSPDXAnalysisException e) { System.out.println("Error getting lic: "+e.getmessage()); } catch (SpdxCompareException e) { } } System.out.println("Error comparing: "+e.getmessage()); 25

26 Accessing Older Versions An archive of the older versions of the license list starting with version 1.18 can be found at spdx.org/licenses/archive/archived_ll_vx.xx where vx.xx is the version of the license list. 26

An Unexpected Journey. Implementing License Matching using the SPDX License List

An Unexpected Journey. Implementing License Matching using the SPDX License List An Unexpected Journey Implementing License Matching using the SPDX License List Kris Reeves kris@pressbuttonllc.com https://github.com/myndzi https://www.npmjs.com/profile/myndzi myndzi @ freenode Gary