Re: Using SPDX for firmware


Richard Hughes
 

On 12 August 2015 at 17:40, Kate Stewart <kstewart@...> wrote:
typo?
Is at: http://spdx.org/licenses/exceptions-index.html
Its available from the http://spdx.org/licenses/ page
On http://spdx.org/spdx-license-list the link is marked as
http://spdx.org/exceptions-index.html ...

"LicenseRef-"<insert your favorite identifier for it here>
Right, I wasn't sure if LicenseRef-proprietary was correct as
proprietary isn't really a licence to use something, more of a
statement of reservation of rights. I guess we need some more
information there about when it's legal to use the firmware and under
what circumstances. I'm thinking about something like
https://github.com/raspberrypi/firmware/blob/master/boot/LICENCE.broadcom
for the Raspberry Pi firmware.

So in the example - using something like
"LicenseRef-proprietary" is fine as an identifier,
(as would be LicenseRef-proprietary-1, or
License-Ref-ACME-proprietary-firmware, etc.)
Right, I'll add that information to the AppStream parser, thanks.

as long as there's the definition somewhere
Where and how would I define this? In the AppStream metadata format itself?

Agree - if you can line up with using "LicenseRef-" prefix infront of any
you need to create, it will permit more automatic recognition down the
road.
Right. I'll have to handle LicenseRef prefixes in the software center
explicitly; at the moment we show a clickable link from each
application showing them the licence text.

The alternative could to have also a catch-all "non-free" or "proprietary"
license ID in SPDX indeed.
Probably this is a discussion for the legal list, as to whether they want
to permit this? Concern point is that it won't give enough information
when there are multiple non-free licenses present.
Right, this makes my life easier, but doesn't sit 100% with the idea
of an SPDX licence in itself. I suppose in the RPi example above it
would have to be something ugly like
LicenseRef-ForRaspberryPiUseOnlyRedistributionWithoutModificationOnly
or maybe "LicenseRef-RaspberryPi AND LicenseRef-NoModification" or
even "LicenseRef-https://github.com/raspberrypi/firmware/blob/master/boot/LICENCE.broadcom"
although I know I'm pushing things here. Better ideas welcome.

Richard.

Join {spdx@lists.spdx.org to automatically receive all group messages.