Proposed: two methods for for organizations to self-declare SPDX license identifiers.


Mark Atwood (Amazon.com)
 

As discussed at the SPDX meeting prior to OSLS two weeks ago.



Proposed: two methods for for organizations to self-declare SPDX license identifiers.
The two methods will be referred to a “organization names” and “dns names”.


Organization Name:

The SPDX Project maintains a list of organization names in github.
Organizations submit their entry into this list via github pull requests.
SPDX core maintainers sanity check the entry, discuss in meeting, and accept the pull request.
The entry contains a URL pointing to a SPDX doc maintained by the organization.
That file can contain the license definitions.
That file can contain XML URL external refers that point to more SPDX docs.
Completely ordinary XML parsing and external reference handling.

An example SPDX license tag:  “License-Ref--amazon-ASL-1.1”.  Notice the two hyphens.

The URL for the entry could be https://github.com/aws/spdx/registration.xml
The URL for the ASL-1.1 license could be https://github.com/aws/spdx/asl-1.1.xml


DNS Name:


An organization already has a DNS name, assigned via the ordinary DNS registration and name arbitration system.
The organization uses its DNS name, but reversed, similar to a JVM class name.
For example: “.com.amazon.”.  Notice the leading and trailing dots, which are usually implicit in the DNS, but are made explicit here.
By using the DNS name, the organization can immediately start using their namespace without concern that it will conflict with a different organization.

An example SPDX license tag:  “License-Ref-.com.amazon.-ASL-1.1”.

The organization may and should send a pull request to the SPDX github, treat similar to the “Organization Name” process.


..m

-- 
Mark Atwood <atwoodm@...>





From: Kate Stewart <kstewart@...>
Sent: Monday, March 25, 2019 12:02 PM
To: Mark Atwood; Atwood, Mark
Cc: Gàry O'Neall
Subject: write up?
 
Hi Mark, 
     Can you send out a definition from our meeting 2 weeks ago (before the details fade) to the tech list,  so we can discuss in the meeting tomorrow?

     If not, can you let us know this too, so we can figure out another agenda for tomorrow's meeting.

Thanks, Kate

Join Spdx-legal@lists.spdx.org to automatically receive all group messages.