Latest revision as of 20:10, 28 February 2024

SPDX License Phase 3

Summary

The third phase of transition from using Fedora's short names for licenses to SPDX identifiers in the License: field of Fedora package spec files. This phase focuses on finishing migrating packages from ELN set. We still do not expect that all packages from Fedora Linux will be migrated in this phase.

Owner

Name: Miroslav Suchý, Jilayne Lovejoy, David Cantrell, Richard Fontana

Email: msuchy@redhat.com, dcantrell@redhat.com, jlovejoy@redhat.com, rfontana@redhat.com

Current status

Targeted release: Fedora Linux 40
Last updated: 2024-02-28
Announced
Discussion thread
FESCo issue: #3141
Tracker bug: #2258888
Release notes tracker: #1081

Burndown chart
95% ELN packages migrated
61% of all Fedora license tags migrated

In this phase, we aimed to migrate all packages in the ELN set. We achieved to migrate 95% of packages. Given the nature of this Change (spanning multiple releases, lots of packages), I consider this phase done. And we will focus on the next phase.

Detailed Description

This is follow-up of Phase 2. During this phase, all remaining packages should be migrated to use SPDX license identifiers in the License: field of the package spec file.

So far, package maintainers have been updating their packages in accordance with the guidance provided at https://docs.fedoraproject.org/en-US/legal/update-existing-packages/ and filing issues in the fedora-license-data repo. Miroslav has been tracking how many packages that have been updated. Given the large number of packages in Fedora, this progress is good, but slow.

The intake of newly discovered licenses is still more than we are able to process. We want to focus on adding the new license to both fedora-license-data and SPDX.org list.

At the same time, we want to focus on the ELN subset of Fedora and cooperate with maintainers of these packages to finish the migration of these packages.

This Change will be followed by Phase 4, where we want to finish the migration of the remaining Fedora packages.

Feedback

See feedback section of Phase 1

Discussions on the mailing list:

Challenges:

license-fedora2spdx tool uses mapping of legacy Fedora short names to SPDX identifiers using the fedora-license-data to suggest SPDX identifiers. Where there is an apparent one-to-one mapping, the package maintainer could simply update the License field: and move on.
for many packages, particularly packages that use "umbrella" legacy short names that may refer to a large set of unrelated or loosely related licenses, further inspection will be needed. Currently, Fedora documentation provides sparse advice on how to do this inspection and thus, a range of methods are used.

Benefit to Fedora

The use of standardized identifiers for licenses will align Fedora with other distributions and facilitates efficient and reliable identification of licenses. Depending on the level of diligence done in this transition, Fedora could be positioned as a leader and contributor to better license information upstream (of Fedora).

Scope

Change Owners:
- Continue adding newly found licenses to fedora-license-data and to SPDX.org list.
- Continue to report progress
- Focus on the ELN subset of Fedora.

Other developers:
- All packages (during the package review) should use the SPDX expression. - this is redundant as this has already been approved since Phase 1, but it should be reminded.
- Migrate the existing License tag from a short name to an SPDX expression.

Release engineering: nothing

Policies and guidelines: all done in previous phases

Trademark approval: N/A (not needed for this Change)

Alignment with Objectives:

Upgrade/compatibility impact

License strings are not used anything in run time. This change will not affect the upgrade or runtime of Fedora.

During the transition period, developer tools like rpminspect, licensecheck, etc. may produce false negatives. And we have to define a date where we flip these tools from old Fedora's short names to the SPDX formula.

How To Test

See How to test section of Phase 1

User Experience

Users should be able to use standard software tools that audit licenses. E.g. for Software Bills of Materials.

Dependencies

No other dependencies.

Contingency Plan

Contingency mechanism: There will be no way back. We are already beyond of point to return. We are heading to explore strange new worlds... to boldly go where no man has gone before.
Contingency deadline: Beta freeze. But it is expected that not all packages will be converted by that time and the change will continue in the next release.
Blocks release? No. This change has no impact on runtime of any package.

Documentation

Allowed Licenses

Update existing packages

Release Notes

In Fedora 40, all core RPM packages use SPDX identifiers as a standard. In total XX percent of packages have been migrated to SPDX identifiers. The remaining packages are estimated to be migrated in upcoming releases of Fedora.

@@ Line 1: / Line 1: @@
 <!-- The actual name of your proposed change page should look something like: Changes/Your_Change_Proposal_Name.  This keeps all change proposals in the same namespace -->
-= SPDX License Phase 3 <!-- The name of your change proposal --> =
+= SPDX License Phase 3 =
 == Summary ==
 <!-- A sentence or two summarizing what this change is and what it will do. This information is used for the overall changeset summary page for each release. Note that motivation for the change should be in the Benefit to Fedora section below, and this part should answer the question "What?" rather than "Why?". -->
-The third phase of transition from using Fedora's short names for licenses to [https://spdx.org/licenses/ SPDX identifiers] in the License: field of Fedora package spec files. This phase focuses on migrating the remaining packages. Although we still do not expect that all packages will be migrated in this phase.
+The third phase of transition from using Fedora's short names for licenses to [https://spdx.org/licenses/ SPDX identifiers] in the License: field of Fedora package spec files. This phase focuses on finishing migrating packages from ELN set. We still do not expect that all packages from Fedora Linux will be migrated in this phase.
 == Owner ==
@@ Line 24: / Line 25: @@
 == Current status ==
-[[Category:ChangePageIncomplete]]
+[[Category:ChangeAcceptedF40]]
 <!-- When your change proposal page is completed and ready for review and announcement -->
 <!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->
@@ Line 42: / Line 43: @@
 ON_QA -> change is fully code complete
 -->
-* [https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/CXASGCNBQOWXFFA2X5KNCI2GF6RXQGHL/ devel thread]
+* [https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org/thread/C3NOAQQ2NLDWCY6MFK5FUWDN7VCJKEXZ/ Announced]
-* FESCo issue: to be filled by the wrangler
+* [https://discussion.fedoraproject.org/t/f40-change-proposal-spdc-licence-phase-3-system-wide/100169 Discussion thread]
-* Tracker bug: to be filled by the wrangler
+* FESCo issue: [https://pagure.io/fesco/issue/3141 #3141]
-* Release notes tracker: to be filled by the wrangler
+* Tracker bug: [https://bugzilla.redhat.com/show_bug.cgi?id=2258888 #2258888]
+* Release notes tracker: [https://pagure.io/fedora-docs/release-notes/issue/1081 #1081]
-* [https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807rpCjus-8s/edit#gid=0 Burndow chart]
+* [https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807rpCjus-8s/edit#gid=0 Burndown chart]
+* 95% ELN packages migrated
+* 61% of all Fedora license tags migrated
+In this phase, we aimed to migrate all packages in the ELN set. We achieved to migrate 95% of packages. Given the nature of this Change (spanning multiple releases, lots of packages), I consider this phase done. And we will focus on the next phase.
 == Detailed Description ==
 <!-- Expand on the summary, if appropriate.  A couple sentences suffices to explain the goal, but the more details you can provide the better. -->
-This is follow-up of [[Changes/SPDX_Licenses_Phase_1|Phase 1]]. During this phase, all remaining packages should be migrated to use SPDX license identifiers in the License: field of the package spec file.
+This is follow-up of [[Changes/SPDX_Licenses_Phase_2|Phase 2]]. During this phase, all remaining packages should be migrated to use SPDX license identifiers in the License: field of the package spec file.
 So far, package maintainers have been updating their packages in accordance with the guidance provided at https://docs.fedoraproject.org/en-US/legal/update-existing-packages/ and filing issues in the [https://gitlab.com/fedora/legal/fedora-license-data fedora-license-data repo]. Miroslav has been tracking how many packages that have been updated. Given the large number of packages in Fedora, this progress is good, but slow.
-We are considering options for how to more quickly migrate, in terms of how much automation can be applied as opposed to taking this as an opportunity as a more thorough license review. Automated updating of Fedora legacy abbreviations to SPDX expressions is only possible to a limited extent due to different criteria used in each system, most notably the use of [https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_updating_existing_packages_callaway_short_name_categories "category" short names in the Fedora legacy system]. Also, the [https://docs.fedoraproject.org/en-US/legal/license-field/ policy for populating the License: field] has been clarified with a view to eliminating inconsistent guidance in past documentation, which may mean that a determination made in the past would be different today. Nonetheless, automated updates for a curated set of Fedora legacy abbreviations can help speed up the migration and serve as a reminder and helping hand to package maintainers who may have not started this process. If the automatic migration is not possible (e.g., needs clarification from legal), then a Bugzilla issue has to be created.
+The intake of newly discovered licenses is still more than we are able to process. We want to focus on adding the new license to both fedora-license-data and SPDX.org list.
-Plan:
+At the same time, we want to focus on the ELN subset of Fedora and cooperate with maintainers of these packages to finish the migration of these packages.
-* Hold a hackfest focusing on a limited set of Fedora packages. Feedback from the hackfest can then be used to improve documentation related to updating existing packages.
-* Review of licenses for which there seems to be a one-to-one mapping from Fedora legacy abbreviations to SPDX identifiers to ensure reliable mapping. license-fedora2spdx will then be updated to use that curated set of mappings.
-* Packages using legacy license expressions will be automatically converted if the package maintainer has not already taken care of it. Packages with compound legacy license expressions will only be converted if all included identifiers can map to fedora-license-data.  That is, there is no mixing of SPDX and legacy Fedora identifiers.
-** The conversion will be done in waves to minimize errors in automation (e.g., 100 packages in the first week, 200 packages in another week, ...).  A pull request for the package spec file will be created as part of the conversion. If the maintainer does not respond to the pull-request within 14 days, the pull request will be merged by Change owners.
-** As mentioned above and at https://docs.fedoraproject.org/en-US/legal/update-existing-packages/, automatic conversion is not possible for a lot of packages and will need direct review.  For example, legacy license identifiers that cannot be automatically converted: BSD, MIT, with exceptions.
-* Regular office hours will be held to help answer questions for package maintainers.
-As of 2023-03-13 the automatic conversion can be done for approximately 8096 packages.
+This Change will be followed by [[Changes/SPDX_Licenses_Phase_4|Phase 4]], where we want to finish the migration of the remaining Fedora packages.
-Around Fedora 39 Beta owners will file a BZ for any package that does not update the license tag. As of 2023-03-13 that would be 12206 packages. But owners expect a much lower number by that time.
-This Change may be followed by Phase 3 where want to provide package maintainers with a service that will notify them when it is likely that the upstream license has changed. But such service is not part of this Phase 2 Change proposal.
 == Feedback ==
@@ Line 76: / Line 72: @@
 See [[Changes/SPDX_Licenses_Phase_1#Feedback|feedback section of Phase 1]]
-Discussions on mailing list:
+Discussions on the mailing list:
-* [https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/EXGT34EJPG3G4FJZ4R2SRAI342QDHFOF/ SPDX Statistics]
+* [https://lists.fedoraproject.org/archives/search?q=SPDX+statistics&page=1&mlist=devel%40lists.fedoraproject.org&sort=date-desc regular SPDX Statistics]
-* [https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/NZIFT62REORSNS6MMES446PMCOOSEPSA/ SPDX Change Update]
 * [https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3TGCSROJTSX5PXZLKOHCOMVIBTZDORNS/ SPDX - How to handle MIT and BSD]
 Challenges:
-* license-fedora2spdx tool uses mapping of legacy Fedora short names to SPDX identifiers using the [https://gitlab.com/fedora/legal/fedora-license-data/-/tree/main|fedora-license-data] to suggest SPDX identifiers. Where there is an apparent one-to-one mapping, the package maintainer could simply update the License field: and move on.
+* license-fedora2spdx tool uses mapping of legacy Fedora short names to SPDX identifiers using the [https://gitlab.com/fedora/legal/fedora-license-data/-/tree/main fedora-license-data] to suggest SPDX identifiers. Where there is an apparent one-to-one mapping, the package maintainer could simply update the License field: and move on.
-* for many packages, particularly packages that use "umbrella" legacy short names that may refer to a large set of unrelated or loosely-related licenses, further inspection will be needed. Currently, Fedora documentation provides sparse advice on how to do this inspection and thus, a range of methods are used.
+* for many packages, particularly packages that use "umbrella" legacy short names that may refer to a large set of unrelated or loosely related licenses, further inspection will be needed. Currently, Fedora documentation provides sparse advice on how to do this inspection and thus, a range of methods are used.
 == Benefit to Fedora ==
@@ Line 116: / Line 111: @@
 == Scope ==
-* Prep work:
+* Change Owners:
-** poll package maintainers on methods and tools used for license inspection
+** Continue adding newly found licenses to fedora-license-data and to SPDX.org list.
-** create additional guidance (using info from above)
+** Continue to report progress
-** planning/brainstorming on most efficient way to update packages, especially those that do not have one-to-one identifier update and will need closer inspection
+** Focus on the ELN subset of Fedora.
-* Proposal owners (things sorted by done/todo and by priorities):
-<!-- What work do the feature owners have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
-** Identify all remaining packages.
-** Notify owners of these packages.
-** After a grace period, submit PR to a package where the transition is easy.
-** Create tracking BZ for packages with unclear transition path
-** Submit BZ for packages that cannot migrate in time.
 * Other developers: <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
 <!-- What work do other developers have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
-** All packages (during the package review) should use the SPDX expression. - this is redundant as this is already approved since Phase 1, but should be reminded.
+** All packages (during the package review) should use the SPDX expression. - this is redundant as this has already been approved since Phase 1, but it should be reminded.
 ** Migrate the existing License tag from a short name to an SPDX expression.
-* Release engineering: [https://pagure.io/releng/issues #Releng issue number] <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
+* Release engineering: nothing <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
 <!-- Does this feature require coordination with release engineering (e.g. changes to installer image generation or update package delivery)?  Is a mass rebuild required?  include a link to the releng issue.
 The issue is required to be filed prior to feature submission, to ensure that someone is on board to do any process development work and testing and that all changes make it into the pipeline; a bullet point in a change is not sufficient communication -->
-* Policies and guidelines: Licensing page will need to be altered. But almost all the work has been done in Phase 1.  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
+* Policies and guidelines: all done in previous phases  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
 <!-- Do the packaging guidelines or other documents need to be updated for this feature?  If so, does it need to happen before or after the implementation is done?  If a FPC ticket exists, add a link here. Please submit a pull request with the proposed changes before submitting your Change proposal. -->
@@ Line 197: / Line 184: @@
 <!-- If you cannot complete your feature by the final development freeze, what is the backup plan?  This might be as simple as "Revert the shipped configuration".  Or it might not (e.g. rebuilding a number of dependent packages).  If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy.  -->
-* Contingency mechanism: There will be no way back. We either rollback in Phase 1. Once we will start Phase 2 we will be beyond of point with no return. <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
+* Contingency mechanism: There will be no way back. We are already beyond of point to return. We are heading to explore strange new worlds... to boldly go where no man has gone before. <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
 <!-- When is the last time the contingency mechanism can be put in place?  This will typically be the beta freeze. -->
 * Contingency deadline: Beta freeze. But it is expected that not all packages will be converted by that time and the change will continue in the next release.  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
@@ Line 208: / Line 195: @@
 <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
-[https://docs.fedoraproject.org/en-US/legal/allowed-licenses/|Allowed Licenses]
+[https://docs.fedoraproject.org/en-US/legal/allowed-licenses/ Allowed Licenses]
 [https://docs.fedoraproject.org/en-US/legal/update-existing-packages/#_process_used Update existing packages]
@@ Line 218: / Line 205: @@
 Release Notes are not required for initial draft of the Change Proposal but has to be completed by the Change Freeze.
 -->
-In Fedora 39, RPM packages use SPDX identifiers as a standard. More than half of the packages have been migrated to SPDX identifiers. The remaining packages are estimated to be migrated in two upcoming releases of Fedora.
+In Fedora 40, all core RPM packages use SPDX identifiers as a standard. In total XX percent of packages have been migrated to SPDX identifiers. The remaining packages are estimated to be migrated in upcoming releases of Fedora.

Search

Changes/SPDX Licenses Phase 3: Difference between revisions