Spec comments and suggestions
Jilayne Lovejoy <Jlovejoy@...>
Hello All,
I am getting up to speed, have taken a close look at the current spec, and have some comments noted below. 3.4 Download URL COMMENT: We may want to have some guideline as to which page is to be specified for this field, i.e. the home page or the download page where there is both or the website has many pages. 3.5 Additional Source Information COMMENT: We may want to add a guideline for this field to encourage complete information. In my experience, brief notes written by someone else (let alone myself sometimes) are sometimes incomprehensible later. While this is hard to control, requesting that people use complete sentences (with a proper subject) and minimize the use of pronouns might help ensure this information is useful and clear to the next person. Perhaps simply rewriting the example as suggested below may meet this goal. 3.5.7 Example: SourceInfo: The glibc-2.11.1 used here was obtained from git://sourceware.org/git/glibc.git. 3.6 Declared License(s) for a Package 3.6.7 Example: DeclaredLicense/DisjunctiveLicense: ________ - Add example of how this will look. This may have already been mentioned. 3.8 Declared Copyright Holder of Package 3.8.3 Cardinality: Mandatory, single instance - There is often more than one author or copyright holder, so this needs to accommodate multiple instances. 5.4 Copyright Information Detected 5.4.3 Cardinality: Mandatory, single instance - There is often more than one author or copyright holder, so this needs to accommodate multiple instances. OTHER: In several places in the spec the idea of identifying a license as either "NotSpecified" or "UnKnown" is mentioned. The current definitions of these terms in the license list are a bit unclear to me and could easily overlap. I would suggest revising them as such: NoLicense (instead of NotSpecified) = no license was found in the file or elsewhere whatsoever UnKnown = some license info was found, but it is unclear what license applies, if the license found applies, etc. - In both cases, it would be helpful to have a comment field to accompany these designations for the purpose of explaining why this conclusion was reached Cheers, Jilayne Lovejoy | Corporate Counsel jlovejoy@... 720 240 4545 | phone 720 240 4556 | fax 1 888 OpenLogic | toll free www.openlogic.com OpenLogic, Inc. Headquarters, Broomfield, Colorado 80021 |
|
SPDX - License List Discussion (special topic call on 9/24 at 11MT/12CT/13ET, )
kate.stewart@...
Hi,
Following up from last week and from SPDX call today, we'll be having a special topic call tomorrow on the licenses. Here's the dial in information for the call tomorrow: US 866-740-1260 Look up int'l toll free numbers at http://www.readytalk.com/an.php?tfnum=8667401260 ID 2404502 Web meeting Www.readytalk.com Join meeting with ID 2404502 Embedded below is the agenda, and notes from the previous call. If I've missed something, please feel free to bring it up by email or on the call tomorrow. Look for some pointers to web sites to be mailed out before the call. Thanks, Kate --- On Thu, 9/16/10, kate.stewart@... <kate.stewart@...> wrote: From: kate.stewart@... <kate.stewart@...>... Agenda:approach propose by Callaway was felt reasonable. We'll go with the embedded version in the name varient for now, and adjust later unless someone feels very strongly. seems to be ok, but revisit after RDF figured out a bit more to make sure can handle. Discuss with wider audience a bit. 3) volunteers to help with pulling the license list |
|
launchpad.net RDF
Philippe Ombredanne
All:
as discussed during today's call here are some pointers to Launchpad RDF: This is an example of a project page: https://launchpad.net/do and the matching RDF metadata: https://launchpad.net/do/+rdf or: https://launchpad.net/launchpad and https://launchpad.net/launchpad/+rdf The spec for the RDF is there: http://bazaar.launchpad.net/~launchpad-pqm/launchpad/db-devel/files/head%3A/lib/canonical/launchpad/rdfspec/ -- Cordially Philippe philippe ombredanne | 1 650 799 0949 | pombredanne at nexb.com nexB - Open by Design (tm) - http://www.nexb.com |
|
SPDX field Proposal: Optional SPDX author comment field.
Mark Gisi
Issue: Not clear how to include SPDX author comments to the consumers of the SPDX file. For example, a SPDX author may like to include a disclaimer, assumptions made, context of the analysis performed and so forth.
Proposal: Include an optional field for the SPDX file that enables authors (i.e., producers) of the SPDX file to provide general comments to the consumers of the SPDX file.
Suggested Draft: 2.5 SPDX Author Comments
2.5.1 Purpose: An optional field for authors of the SPDX file content to provide general comments to the consumers of the SPDX content.
2.5.2 Intent: Here, the intent is to provide readers/reviewers with comments by the author of the SDPX …
2.5.3 Cardinality: Optional one or more.
2.5.4 Tag: “AuthorComment:”
2.5.5 RDF: /RDF/SPDXDoc/Describes/Package/AuthorComment
2.5.6 Data Format: free form text that can span multiple lines.
2.5.7 Example: AuthorComment: This information is provided "as is" without any warranty. It does not represent legal advice...
Mark Gisi | Wind River | Senior Intellectual Property Manager Tel (510) 749-2016 | Fax (510) 749-4552
|
|
Agenda for Sept 23 call
Philip Odence
Meeting Time: Sept 23, 8am PDT / 10 am CDT / 11am EDT / 15:00 UTC Conf call dial-in: Conference code: 7812589502 Toll-free dial-in number (U.S. and Canada): (877) 435-0230 International dial-in number: (253) 336-6732 For those dialing in from other regions, a list of toll free numbers can be found: https://www.intercallonline.com/portlets/scheduling/viewNumbers/viewNumber.do?ownerNumber=6053870&audioType=RP&viewGa=false&ga=OFF Web: Note, we will be using a different URL for each meeting for purposes of taking attendance. When you login please include your full name and company name in this form: Phil Odence, Black Duck Software so I can just copy/paste into minutes. THX.
Legal update from LF Member Counsel call- Rockett Action Items Note: Drafting related action items are embedded in the Wiki. http://www.spdx.org/wiki/spdx/specification
Technical Agenda
L. Philip Odence Vice President of Business Development Black Duck Software, inc. 265 Winter Street, Waltham, MA 02451 Phone: 781.810.1819, Mobile: 781.258.9502
|
|
SPDX RDF Sub-group Mtg 3
Bill Schineller
Colleagues,
Those interested in participating in the RDF track, please reconvene next Tuesday. Among other hot topics, we'd like to review in more detail the relationship between SPDX and other standard ontologies like the dublin core SPDX RDF Sub-group Mtg 3 Tuesday Sept 21, 11AM eastern time Toll-free dial-in number (U.S. and Canada): (877) 435-0230 International dial-in number: (253) 336-6732 Conference code: 7833942033 URL to join meeting: http://blackducksoftware.na6.acrobat.com/r82947904/ Bill Schineller Knowledge Base Manager Black Duck Software Inc. T: +1.781.810.1829 F: +1.781.891.5145 E: bschineller@... http://www.blackducksoftware.com |
|
Help Wanted for Successful Rollout of SPDX
Kim Weins
Hello Everyone, The SPDX team is hard at work on completing the spec and nailing down all of the license details. To make sure we are successful in getting SPDX accepted and adopted, we are working on a rollout plan that will cover all of those “non-spec” items, including documentation, training, websites, beta program, marketing, etc. There is a lot to do, so we will need your help and the help of others at your company. Please review the attached slides, and let us know if you can help. We are especially looking for the types of skills listed below – although don’t let it hold you back if this is not your “official” job title. If you are willing to help, we can use you. Keep in mind that your level of contribution can vary — from a one time effort to a few hours a week. If you, or someone at your company, can contribute time to help in any of these areas, please respond to either me or the mailing list and let me know what skills you have available and how much time you can spend. We will start to put together our list of volunteers for the rollout team. We are also planning a face to face meeting for the Rollout Team – tentatively scheduled for Nov 16-17 (Location TBD). At this meeting we will be fleshing out the Rollout plan, assigning tasks, and planning milestones. If you want to help with the Rollout, we’d love to have you attend. Kim Skills needed Writing/Documentation Website content/design Training development Marketing/Product marketing/Product management Project management Translation Kim Weins | Senior Vice President, Marketing kim.weins@... Follow me on Twitter @KimAtOpenLogic 650 279 0410 | cell www.openlogic.com Follow OpenLogic on Twitter @OpenLogic OpenLogic, Inc. Headquarters, Broomfield, Colorado |
|
Re: on license variability
dmg
On Fri, Sep 17, 2010 at 10:00 AM, Gary O'Neall <gary@...> wrote:
I agree with Tom’s comment – some of these are defined terms within the The main problem is that these terms are not really context free. If you see: "This (program|library|software) is (release|made available) under the GPL version 2", you will all probably agree that they are equivalent. But in general, they are not. So I agree, they are context dependent. -- --dmg --- Daniel M. German http://turingmachine.org |
|
Re: on license variability
Mark Radcliffe
I agree, distribute and make available have very different
legal implications. I also believe that licensed and released are not equivalent
to distribute Please consider the environment before printing this email. The information contained in this email may be confidential and/or legally privileged. It has been sent for the sole use of the intended recipient(s). If the reader of this message is not an intended recipient, you are hereby notified that any unauthorized review, use, disclosure, dissemination, distribution, or copying of this communication, or any of its contents, is strictly prohibited. If you have received this communication in error, please reply to the sender and destroy all copies of the message. To contact us directly, send to postmaster@.... Thank you. |
|
Re: on license variability
Gary O'Neall
I agree with Tom’s comment – some of these are defined terms within the license itself (e.g. in GPL 3.0, “The Program” has a specific definition), so we should be careful about making these terms equivalent. Whether these words are equivalent may well depend on the specific license.
Gary
From:
spdx-bounces@... [mailto:spdx-bounces@...] On Behalf
Of Tom Incorvia
Hi Dan,
Regarding the equivalent terms. I have seen different commercial legal interpretations based on two of the sets of "equivalent" terms below. I believe that these need to be distinct. With regards to library/program/software, I am OK if we remove “library”
- distributable|licensed|released|made available - library|program|software
Tom
Tom Incorvia Direct: (512) 340-1336 Mobile: (408) 499 6850
-----Original Message-----
From: spdx-bounces@... [mailto:spdx-bounces@...] On Behalf Of D M German Sent: Thursday, September 16, 2010 1:14 PM To: spdx@... Subject: on license variability
First, some common equivalent words/phrases:
---------------------------------------------------------------------- license|licence distributable|licensed|released|made available can|may terms and conditions|terms library|program|software developed|written MERCHANTIBILITY|MERCHANTABILITY is|are do not|don<quotes>t the copyright|that copyright would|will IN THE SOFTWARE WITH THE SOFTWARE deal in|deal with ---------------------------------------------------------------------- The quotes are also very different in different files:
quotes can be ``, '', ", '
---------------------------------------------------------------------- Finally, this is a subset of the way Ninka recognizes the BSD3 clauses. I believe this will cover most versions. The numbers preceding the conditions are sometimes not there (Ninka drops them, or any bullets before it continues with the processing).
Copyright (c) <field1> All rights reserved\.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1\. Redistributions? of source code must retain the (above )?copyright notice, this list of conditions(,)? and the following disclaimer(, without modification)?.
2\. Redistributions in binary form must reproduce the above copyright notice(\(s\))?, this list of conditions(,)? and the following disclaimer(s)? in the documentation and/or other materials provided with the distribution\.
3\. Neither the name(s)? of <field2> may be used to endorse or promote products derived from this software without (specific )?prior written permission:
THIS SOFTWARE IS PROVIDED BY <field3><quotes>AS IS<quotes> AND ANY EXPRESS(ED)? OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANT(A|I)BILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED\. IN NO EVENT SHALL <field4> BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES \(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF (MIND, )?USE, DATA,( LIFE)? OR PROFITS; OR BUSINESS INTERRUPTION\) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT \(INCLUDING NEGLIGENCE OR OTHERWISE\) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE\. ----------------------------------------------------------------------
-- -- Daniel M. German http://turingmachine.org/ http://silvernegative.com/ dmg (at) uvic (dot) ca replace (at) with @ and (dot) with . _______________________________________________ Spdx mailing list Spdx@... https://fossbazaar.org/mailman/listinfo/spdx
This message has been scanned for viruses by MailController - www.MailController.altohiway.com |
|
Re: on license variability
Tom Incorvia
Hi Dan,
Regarding the equivalent terms. I have seen different commercial legal interpretations based on two of the sets of "equivalent" terms below. I believe that these need to be distinct. With regards to library/program/software, I am OK if we remove “library”
- distributable|licensed|released|made available - library|program|software
Tom
Tom Incorvia Direct: (512) 340-1336 Mobile: (408) 499 6850
-----Original Message-----
From: spdx-bounces@... [mailto:spdx-bounces@...] On Behalf Of D M German Sent: Thursday, September 16, 2010 1:14 PM To: spdx@... Subject: on license variability
First, some common equivalent words/phrases:
---------------------------------------------------------------------- license|licence distributable|licensed|released|made available can|may terms and conditions|terms library|program|software developed|written MERCHANTIBILITY|MERCHANTABILITY is|are do not|don<quotes>t the copyright|that copyright would|will IN THE SOFTWARE WITH THE SOFTWARE deal in|deal with ---------------------------------------------------------------------- The quotes are also very different in different files:
quotes can be ``, '', ", '
---------------------------------------------------------------------- Finally, this is a subset of the way Ninka recognizes the BSD3 clauses. I believe this will cover most versions. The numbers preceding the conditions are sometimes not there (Ninka drops them, or any bullets before it continues with the processing).
Copyright (c) <field1> All rights reserved\.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1\. Redistributions? of source code must retain the (above )?copyright notice, this list of conditions(,)? and the following disclaimer(, without modification)?.
2\. Redistributions in binary form must reproduce the above copyright notice(\(s\))?, this list of conditions(,)? and the following disclaimer(s)? in the documentation and/or other materials provided with the distribution\.
3\. Neither the name(s)? of <field2> may be used to endorse or promote products derived from this software without (specific )?prior written permission:
THIS SOFTWARE IS PROVIDED BY <field3><quotes>AS IS<quotes> AND ANY EXPRESS(ED)? OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANT(A|I)BILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED\. IN NO EVENT SHALL <field4> BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES \(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF (MIND, )?USE, DATA,( LIFE)? OR PROFITS; OR BUSINESS INTERRUPTION\) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT \(INCLUDING NEGLIGENCE OR OTHERWISE\) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE\. ----------------------------------------------------------------------
-- -- Daniel M. German http://turingmachine.org/ http://silvernegative.com/ dmg (at) uvic (dot) ca replace (at) with @ and (dot) with . _______________________________________________ Spdx mailing list Spdx@... https://fossbazaar.org/mailman/listinfo/spdx
This message has been scanned for viruses by MailController - www.MailController.altohiway.com |
|
Re: on license variability
dmg
Posix regular expressions. Yes, (s)? means that sometimes the s is not there.
toggle quoted message
Show quoted text
On Thu, Sep 16, 2010 at 11:47 AM, <kate.stewart@...> wrote:
The ? notation in the template, does it mean that what preceeds in brackets is optional. ie. (s)? means that the s could or could not appear? |
|
Re: on license variability
kate.stewart@...
The ? notation in the template, does it mean that what preceeds in brackets is optional. ie. (s)? means that the s could or could not appear?
toggle quoted message
Show quoted text
Kate --- On Thu, 9/16/10, D M German <dmg@...> wrote:
From: D M German <dmg@...> |
|
ninka
dmg
Kim asked about Ninka. It is our license identification tool. It is
really a research prototype, but it works. It is particularly good at not making mistakes, at the expense if not identifying the license of some files. For those of you interested in the issue of licenses, and how they should be specified in SPDX, please read it. It is going to be presented in few days at the International Conference in Automated Software Engineering: http://turingmachine.org/~dmg/papers/#sec-4_1_5 and if you are interested in the tool itself, you can download it here: http://turingmachine.org/~dmg/temp/ninka-1.0-pre1.tar.bz2 --dmg -- -- Daniel M. German http://turingmachine.org/ http://silvernegative.com/ dmg (at) uvic (dot) ca replace (at) with @ and (dot) with . |
|
on license variability
dmg
First, some common equivalent words/phrases:
---------------------------------------------------------------------- license|licence distributable|licensed|released|made available can|may terms and conditions|terms library|program|software developed|written MERCHANTIBILITY|MERCHANTABILITY is|are do not|don<quotes>t the copyright|that copyright would|will IN THE SOFTWARE WITH THE SOFTWARE deal in|deal with ---------------------------------------------------------------------- The quotes are also very different in different files: quotes can be ``, '', ", ' ---------------------------------------------------------------------- Finally, this is a subset of the way Ninka recognizes the BSD3 clauses. I believe this will cover most versions. The numbers preceding the conditions are sometimes not there (Ninka drops them, or any bullets before it continues with the processing). Copyright (c) <field1> All rights reserved\. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1\. Redistributions? of source code must retain the (above )?copyright notice, this list of conditions(,)? and the following disclaimer(, without modification)?. 2\. Redistributions in binary form must reproduce the above copyright notice(\(s\))?, this list of conditions(,)? and the following disclaimer(s)? in the documentation and/or other materials provided with the distribution\. 3\. Neither the name(s)? of <field2> may be used to endorse or promote products derived from this software without (specific )?prior written permission: THIS SOFTWARE IS PROVIDED BY <field3><quotes>AS IS<quotes> AND ANY EXPRESS(ED)? OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANT(A|I)BILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED\. IN NO EVENT SHALL <field4> BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES \(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF (MIND, )?USE, DATA,( LIFE)? OR PROFITS; OR BUSINESS INTERRUPTION\) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT \(INCLUDING NEGLIGENCE OR OTHERWISE\) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE\. ---------------------------------------------------------------------- -- -- Daniel M. German http://turingmachine.org/ http://silvernegative.com/ dmg (at) uvic (dot) ca replace (at) with @ and (dot) with . |
|
Reminder: License Focus Call at 11am CDT (1600 UTC) for 30 minutes
kate.stewart@...
This should have gone out sooner so we may want to reschedule to ensure better attendance. I propose to have a quick call for those who are expecting it. For those who this note is catching off guard, I appologize, and will summarize and will propose another call later (with adequate warning).
Call details: at 12 noon (EDT) / 11am (CDT) / 16:00 UTC Phil's dial in number: Conference code: 7812589502 Toll-free dial-in number (U.S. and Canada): (877) 435-0230 International dial-in number: (253) 336-6732 Agenda: see: https://fedoraproject.org/wiki/TomCallaway/SPDX_License_List 1) discuss how we want summary table structured - see proposals in link above, any others? 2) check there is concensus on the 1 page per license on SPDX approach, if not, who has alternate proposals. 3) volunteers to help with pulling the license list together in form above (based on what's in Appendix I today, and mail list input)? Then translate into the forms decided above. (we may want to defer the following until wider audience has chance to participate) 4) logistics - process for accepting new license into list, pre 1.0 freeze, and then post. 5) what to carry in the SPDX spec, and what to carry on the web site? anything else to add? Kate |
|
Re: format requirements inconsistency
kate.stewart@...
Hi Armijn,
toggle quoted message
Show quoted text
Thanks for working through the spec, and finding the typo. ;) All updates and corrections much appreciated. In terms of the requirements, as more technical folk have started participating, that has been a growing request. You're right, its possible to do both, but it is suboptimal in some cases. If we can get tools and the support infrastructure created in an open source project, to demonstrate we can relax the human readable form requirement, and accomplish the readability goal, we can revist this requirement. Key is getting some prototype tools in place. Do you have bandwidth to help out with the tool creation? ;) Gary O'Neal's pretty printer is a good step in this direction. The RDF call that Bill S. is hosting is where this is getting actively discussed. So we don't spam the legal and business folk on the maillist, we're thinking of setting a separate spdx technical maillist up as well so we can discuss the specifics a bit more. When its set up, we'll announce, and anyone interested is welcome to subscribe and contribute to the tools development and format decisions. Kate --- On Wed, 9/15/10, Armijn Hemel <armijn@...> wrote:
From: Armijn Hemel <armijn@...> |
|
format requirements inconsistency
Armijn Hemel <armijn@...>
hi all,
I read the specs and saw: 1.6. Format Requirements: 1.6.1. Must be in a human readable form. 1.6.2. Must be in a syntax that a software tool can read and write. In my experience these two are not mutually exclusive, but they don't go well together without making sacrifices to either one, or both. Please drop one, preferably the human readable form, since that one can be derived from the machine readable format with some templating engine or stylesheets. Dropping it also makes automated checking and comparing of SPDX files a lot easier. Also, 1.5.2 has a tpyo ('and' should be 'an') armijn -- --------------------------------------------------------------------------- armijn@... || http://www.gpl-violations.org/ --------------------------------------------------------------------------- |
|
Re: MInutes from Sept 9 call
Armijn Hemel <armijn@...>
On Mon, 2010-09-13 at 08:09 -0400, Philip Odence wrote:
Thanks, Soeren. I believe in my memo (just to you) last week, IGMT is an old term and UTC is the new black. The good thing about UTC is that it does not change, no matter how many timezones the UK skips in summer (there used to be this thing called "double summer time" http://en.wikipedia.org/wiki/British_summer_time ). There are also plenty of places where there is no summer time (I believe even in the US). UTC makes sense then (ask the US military about their "zulu time") In any case, this time stuff is tricky.It's not that tricky: use UTC and a converter (like http://www.timeanddate.com/worldclock/converter.html ) to calculate your local timezone :-P armijn -- --------------------------------------------------------------------------- armijn@... || http://www.gpl-violations.org/ --------------------------------------------------------------------------- |
|
Re: SPDX RDF Sub-group Mtg 2
Bruno Cornec <Bruno.Cornec@...>
Bill Schineller said on Fri, Sep 10, 2010 at 03:33:46PM -0400:
Those interested in participating in the RDF track, please reconvene nextSorry, I won't be able to attend this session, being at a customer site for a Workshop. Bruno. -- Open Source & Linux Profession Lead EMEA / http://opensource.hp.com HP/Intel/Red Hat Open Source Solutions Initiative / http://www.hpintelco.net http://www.HyPer-Linux.org http://mondorescue.org http://project-builder.org La musique ancienne? http://www.musique-ancienne.org http://www.medieval.org |
|