Developers Care About the License Using SPDX to Describe License Information. Jilayne Lovejoy 6 October 2015

Transcription

1 Developers Care About the License Using SPDX to Describe License Information Jilayne Lovejoy 6 October 2015

2 sharing code! Developers care about the license How do we share? 2

3 CC0 from Pixabay 3

4 How do we share software? How we share something that is otherwise protected by Upon creation All rights reserved By default - no permission to use Via a license (giving permission)

5 All software developers should add a copyright license. Why? Because open source licensing is all about granting permission in advance Simon Phipps, Infoworld 5

6 Github research on % of public repositories with a license showed an uptick after implementing a way to add a license to new repositories h0ps://github.com/blog/1964- open- source- license- usage- on- github- com 6

7 7

8 Developers care about sharing code (the license) How do we indicate the license? 8

9 CC0 from Pixabay LICENSE.txt

10 LICENSE.txt COPYING.txt LICENSE.txt 10

11 Underverse400 DreamsPme.com - Files Binder In A Box On The Office Floor Photo 11

12 By Sandrine Z - CC BY- SA via Wikimedia Commons 12

13 CC0 from Pixabay

14 How do we make it easy to license share code? 14

15

16 What is SPDX? Standard: A standard format for communicating the components, licenses and copyrights associated with a software package Guiding principles: Human and machine readable Focus on capturing facts; avoid interpretations Vision: To help reduce redundant work in determining software license information and facilitate compliance

17 Example SPDX document Formats Tag/Value RDF Spreadsheet

18 SPDX: The big picture

19 Using SPDX to describe license information 1. Use SPDX License List short identifiers 2. Provide an SPDX document 19

20 Use SPDX License List short identifiers SPDX License List is a list of (common) open source licenses Contains name, identifier, license text, reference URL s, whether OSI approved, and standard headers Matching guidelines to help determine if the license text matches the text (and templates for some licenses) Backed by an active organization which maintains the license list 20

21 21

22 Use SPDX License List short identifiers 22

23 23

24 24

25 25

26 26

27 Use SPDX License List short identifiers What if more than one license applies or you have a choice of licenses? Use the license expression syntax Operators allow various combinations, etc. Part of SPDX specification, Appendix IV

28 License expression syntax AND OR WITH Conjunctive licenses (more than 1 license applies) Disjunctive licenses (choice) Exceptions (apply an exception to the main license) + Or later versions of license allowed 28

29 Using License Expressions Ruby OR GPL-2.0+ Ruby OR BSD-2-Clause CC BY- ND

30 Advantages: SPDX short identifiers Easy to use, easy to read Concise Reliable Use matching guidelines Machine-readable Makes it easy to produce an SPDX document Guidance on how to use: 30

31 More Info on the SPDX License List Human and machine readable at Tools to programmatically access the SPDX License List: RDFa machine readable access JSON file at For tools support, see the tech report Accessing SPDX Licenses

32 Using SPDX to describe license information 1. Use SPDX License List short identifiers 2. Provide an SPDX document 32

33 Provide an SPDX document Meta data Source Tool SPDX Document Requires some tooling since the package verification code is generated by file checksums

34 Tools to support SPDX creation FOSSology license scanner Install yourself: Public instance: Wind River: Can submit code and sends you an SPDX document Yocto generates SPDX for builds Debsources: Debian source database generates SPDX Maven plug-in: uses Maven license data to generate SPDX document Eclipse plug-in: DoSOCS: produce SPDX, store that info in relational database, extract info on request Also see

35 Provide an SPDX document Document Crea-on Informa-on 2.1 SPDX Version. 2.2 Data License 2.3 SPDX Iden-fier 2.4 Document Name 2.5 SPDX Document Namespace 2.8 Creator 2.9 Created 1 per document 1 per package in document Package Informa-on 3.1 Package Name 3.2 Package SPDX Iden-fier 3.7 Package Download Loca-on 3.8 Package Verifica-on Code 3.12 Concluded License 3.13 All Licenses Informa-on from Files 3.14 Declared License 3.16 Copyright Text File Informa-on 4.1 File Name 4.2 File SPDX Iden-fier 4.4 File Checksum 4.5 Concluded License 4.6 License Informa-on in File 4.8 Copyright Text 1 per file in each package

36 Package Relationships (optional) Package Apache MQ contains SPDX Doc Apache MQ Jetty Web Container javax.servlet Jetty Web Container contained by contains contained by javax.servlet

37 Advantages: SPDX document Can be very descriptive contains copyrights, relationships, creation, provenance Can be easily translated to human readable form e.g., spreadsheet Integrates with various open source and commercial tools REALLY helps the downstream consumers

38 More Info on SPDX Best practices for creating SPDX documents: spdx.org à General information spdx.org/licenses à SPDX License List spdx.org/tools à SPDX Tools wiki.spdx.org à Workgroup wiki for technical, business, and legal teams Contains information on joining the mailing lists and calls

39 Developers care about sharing code (the license) Make it easy to license (share) code 39

40 Using SPDX to describe license information 1. Use SPDX License List short identifiers 2. Provide an SPDX document 40

41 Thank you! Questions? 41