Re: SPDX Agenda/Minutes
Kim Weins
I also agree that we should decouple spec from licenses. We need a way to
add licenses without having to rev the spec. Otherwise we will get lots of spec revisions or very few license updates. I know there has been some concern that if the list of licenses is not "fixed" with the spec version, you won't know what list of licenses you need to be able to "understand" when you get an SPDX file based on a particular version of the spec. I'd like to dig into this use case more, since it seems to me that any tooling or even manual review processes can be designed to just pull the latest and greatest version of licenses from the website. The only issue is that you may get an SPDX file that has something marked as an "Other" license that is now in the standard license repo. That shouldn't really be a problem, since all the "Other" licenses will have full license text in the SPDX file. Here's an example: Company A creates SPDX on 1/1/2011 using latest set of standard licenses at that point. They identify: File A has Standard License A File B has Standard License B File C has Other License C File D has Other License D On 2/1/2011, License C is added to standard license repo Company B reviews SPDX on 3/1/2011 All of the info is still valid -- since License C and D are in the SPDX file. Company B could choose to update the SPDX file as: File A has Standard License A File B has Standard License B File C now has STANDARD License C File D has Other License D Am I missing something here? Kim On Wed 9/8/10 12:48 PM, "dmg" <dmg@...> wrote: From the minutes: Kim Weins | Senior Vice President, Marketing kim.weins@... Follow me on Twitter @KimAtOpenLogic 650 279 0410 | cell www.openlogic.com Follow OpenLogic on Twitter @OpenLogic OpenLogic, Inc. Headquarters, Broomfield, Colorado
|
|
|
|
Re: SPDX Agenda/Minutes
dmg
From the minutes:
Our implicit path had tied a fixed license list of licenses to the spec rev, but JohnE put forth an impassioned argument as to why they should be decouples... I throw my support behind JohnE proposal. It addresses many of the issues I have discussed before. --dmg (hopefully I can make wake up in time for the meeting, but it is tough to only have 5 hrs of sleep :) On Wed, Sep 8, 2010 at 11:24 AM, Philip Odence <podence@...> wrote: Per discussion late meeting, agendas will be going out in bodies of emails -- --dmg --- Daniel M. German http://turingmachine.org
|
|
|
|
SPDX Agenda/Minutes
Philip Odence
Per discussion late meeting, agendas will be going out in bodies of emails and minutes will go out as links to archive at spdx.org. I'll strive to get minutes out a week in advance, though I'm behind this time. Here's where they are posted (note that Kate is still editing, so they won't be final until tonight) http://www.spdx.org/wiki/minutes-26aug2010 Meeting Time: Sept 9, 8am PDT / 10 am CDT / 11am EDT / 16:00 GMT Conf call dial-in: NOTE: THIS NUMBER IS DIFFERENT FROM PAST NUMBERS AND WILL BE CHANGING IN THE FUTURE. Conference code: 7812589502 Toll-free dial-in number (U.S. and Canada): (877) 435-0230 International dial-in number: (253) 336-6732 For those dialing in from other regions, a list of toll free numbers can be found: https://www.intercallonline.com/portlets/scheduling/viewNumbers/viewNumber.do?ownerNumber=6053870&audioType=RP&viewGa=false&ga=OFF Web: Note, we will be using a different URL for each meeting for purposes of taking attendance. When you login please include your full name and company name, so I can just copy/pate into minutes. THX. http://blackducksoftware.na6.acrobat.com/spdx9sept10/ Administrative Agenda
Action Items Note: Drafting related action items are embedded in the Wiki. http://www.spdx.org/wiki/spdx/specification
Technical Agenda
L. Philip Odence Vice President of Business Development Black Duck Software, inc. 265 Winter Street, Waltham, MA 02451 Phone: 781.810.1819, Mobile: 781.258.9502
|
|
|
|
Re: Issue tracking
Martin Michlmayr
The Linux Foundation has a Bugzilla instance that we should be able to
toggle quoted messageShow quoted text
use. * Peter Williams <peter.williams@...> [2010-09-07 16:25]:
Now that the technical sub-group has initiated its work i think it would --
Martin Michlmayr Open Source Program Office, Hewlett-Packard
|
|
|
|
Issue tracking
Peter Williams <peter.williams@...>
Now that the technical sub-group has initiated its work i think it would be worth having a issue tracking system. This would allow us to reliably track issues with the spec and to make sure nothing falls through the cracks.
Peter Williams <http://openlogic.com>
|
|
|
|
Re: SPDX RDF 'sub-group' meeting Tues Sept 7 invitation details
Bruno Cornec <Bruno.Cornec@...>
Hello,
toggle quoted messageShow quoted text
I may be able to attend the last half-hour of the talk, if my previous conf call with my partner doesn't extend to much :-(. Bruno. kate.stewart@... said on Thu, Sep 02, 2010 at 10:10:20PM -0700:
Hi Bill, --
Open Source & Linux Profession Lead EMEA / http://opensource.hp.com HP/Intel/Red Hat Open Source Solutions Initiative / http://www.hpintelco.net http://www.HyPer-Linux.org http://mondorescue.org http://project-builder.org La musique ancienne? http://www.musique-ancienne.org http://www.medieval.org
|
|
|
|
Re: anybody has been successful at using Ninka?
Armijn Hemel <armijn@...>
hi!
Is anybody being successful at building and using ninka? So far I haveIt was not entirely trivial to get it working: the documentation and the actual names of files and patches are not in sync, so it cost me about 10 minutes to get everything working (I will send more detailed feedback after I have had some sleep) but it works now. The output is of course quite terse, but at least it's something :-) $ ./ninka.pl ./ninka.pl ./ninka.pl;AGPLv3+;,;2 $ ./ninka.pl /tmp/blaat/gettext-0.15/gettext-tools/src/write-qt.h /tmp/blaat/gettext-0.15/gettext-tools/src/write-qt.h;GPLv2+;,;1 armijn -- --------------------------------------------------------------------------- armijn@... || http://www.gpl-violations.org/ ---------------------------------------------------------------------------
|
|
|
|
Re: SPDX RDF 'sub-group' meeting Tues Sept 7 invitation details
kate.stewart@...
--- On Thu, 9/2/10, Bill Schineller <bschineller@...> wrote:
|
|
|
|
anybody has been successful at using Ninka?
dmg
hi everybody,
Is anybody being successful at building and using ninka? So far I have not heard from anybody (neither good or bad news). Based on feedback we are planning to make a wider release. thanks again! --dmg -- Daniel M. German http://turingmachine.org/ http://silvernegative.com/ dmg (at) uvic (dot) ca replace (at) with @ and (dot) with .
|
|
|
|
SPDX RDF 'sub-group' meeting Tues Sept 7 invitation details
Bill Schineller
Anyone is welcome; Gary, Jeff, Peter have accepted.
Details below. SDPX RDF Sub-group Mtg 1 Tuesday Sept 7, 11AM eastern time Toll-free dial-in number (U.S. and Canada): (877) 435-0230 International dial-in number: (253) 336-6732 Conference code: 7833942033 URL: http://blackducksoftware.na6.acrobat.com/r39125695/ On 9/1/10 4:44 PM, "Gary O'Neall" <gary@...> wrote: Tuesday 11AM eastern (8AM pacific) works for me. Bill Schineller Knowledge Base Manager Black Duck Software Inc. T: +1.781.810.1829 F: +1.781.891.5145 E: bschineller@... http://www.blackducksoftware.com
|
|
|
|
Re: shout out re: SPDX RDF 'sub-group'
Gary O'Neall
Tuesday 11AM eastern (8AM pacific) works for me.
toggle quoted messageShow quoted text
Gary
-----Original Message-----
From: Bill Schineller [mailto:bschineller@...] Sent: Wednesday, September 01, 2010 7:09 AM To: peter.williams@...; Jeff@...; Gary SourceAuditor; Bruno.Cornec@...; spdx@... Subject: shout out re: SPDX RDF 'sub-group' SPDX colleagues: As per the last con-call, here's a shout out to those who wish to collaborate outside of the current bi-weekly calls to focus on the details of the RDF representation of an SPDX document. I've called out individually peter.williams AT openlogic.com Jeff AT palamida.com gary AT sourceauditor.com Bruno.Cornec AT hp.com who I remember commenting on RDF specifics, and thus may form a 'quorum' to get started, but anyone else who would like to be on this sub-group please let me know. Would you like to participate in a separate concall - I'm proposing Tuesday Sept 7 at 11am Boston time? (same time as the bi-weekly calls, to permit possibility of spanning CA-MA-Europe) Sampling of issues to tackle: working examples / tools Jeff promised an update? Gary's github repo for 'prettyprinter' github.com/goneall validation use of ontology to check integrity constraints ? extensibility / relationship to DOAP namespace rules / URI generation conventions permanent URLs for licenses RDF (PURL) license RDF (use rdfa ??) Please respond on your availability and interest - I'd like to have a 'quorum' on our first call, and from there work out how best to collaborate. Thanks, Bill Bill Schineller Knowledge Base Manager Black Duck Software Inc. T: +1.781.810.1829 F: +1.781.891.5145 E: bschineller@... http://www.blackducksoftware.com
|
|
|
|
Re: shout out re: SPDX RDF 'sub-group'
Jeff Luszcz
This will work for me.
toggle quoted messageShow quoted text
Jeff
-----Original Message-----
|
|
|
|
shout out re: SPDX RDF 'sub-group'
Bill Schineller
SPDX colleagues:
As per the last con-call, here's a shout out to those who wish to collaborate outside of the current bi-weekly calls to focus on the details of the RDF representation of an SPDX document. I've called out individually peter.williams AT openlogic.com Jeff AT palamida.com gary AT sourceauditor.com Bruno.Cornec AT hp.com who I remember commenting on RDF specifics, and thus may form a 'quorum' to get started, but anyone else who would like to be on this sub-group please let me know. Would you like to participate in a separate concall - I'm proposing Tuesday Sept 7 at 11am Boston time? (same time as the bi-weekly calls, to permit possibility of spanning CA-MA-Europe) Sampling of issues to tackle: working examples / tools Jeff promised an update? Gary's github repo for 'prettyprinter' github.com/goneall validation use of ontology to check integrity constraints ? extensibility / relationship to DOAP namespace rules / URI generation conventions permanent URLs for licenses RDF (PURL) license RDF (use rdfa ??) Please respond on your availability and interest - I'd like to have a 'quorum' on our first call, and from there work out how best to collaborate. Thanks, Bill Bill Schineller Knowledge Base Manager Black Duck Software Inc. T: +1.781.810.1829 F: +1.781.891.5145 E: bschineller@... http://www.blackducksoftware.com
|
|
|
|
Re: CeCILL licences
kate.stewart@...
Bonjour Patrick,
toggle quoted messageShow quoted text
CeCILL licenses have been mentioned before by others as well, so unless someone objects I'll just add them to the next draft with some of the others that have been discussed and advocated as candidates for 1.0 on the maillist. Thank you for your input. Merci, Kate
--- On Mon, 8/30/10, Patrick MOREAU <Patrick.MOREAU@...> wrote:
From: Patrick MOREAU <Patrick.MOREAU@...>
|
|
|
|
Re: Spdx Digest, Vol 1, Issue 16
Soeren_Rabenstein@...
Provided that we still go with the license text repository, what about something like a "diff"-standard for exceptions and variations of the standard licenses? (i.e. a standardized syntax describing lines to add to / delete from the original license text)1) I noticed the license list included some of the GPLText for each exception, should include exception and original licenses. BR Soeren ===================================================================================================================================== This email and any attachments to it contain confidential information and are intended solely for the use of the individual to whom it is addressed.If you are not the intended recipient or receive it accidentally, please immediately notify the sender by e-mail and delete the message and any attachments from your computer system, and destroy all hard copies. If any, please be advised that any unauthorized disclosure, copying, distribution or any action taken or omitted in reliance on this, is illegal and prohibited. Furthermore, any views or opinions expressed are solely those of the author and do not represent those of ASUSTeK. Thank you for your cooperation. =====================================================================================================================================
|
|
|
|
Re: Names of licenses we currently support / where should licensetext live?
Soeren_Rabenstein@...
The license would be embedded in the SPDX file. In fact, you will havean/listinfo/spdx What is the intended use case for an spdx file? So far it appears to me that it is supposed to describe one single software package. If so, I indeed see us attaching giant data amounts of license texts to tiny data amounts of code, if we embed all license texts into the spdx file, instead of keeping them in a license repository. BR Soeren ===================================================================================================================================== This email and any attachments to it contain confidential information and are intended solely for the use of the individual to whom it is addressed.If you are not the intended recipient or receive it accidentally, please immediately notify the sender by e-mail and delete the message and any attachments from your computer system, and destroy all hard copies. If any, please be advised that any unauthorized disclosure, copying, distribution or any action taken or omitted in reliance on this, is illegal and prohibited. Furthermore, any views or opinions expressed are solely those of the author and do not represent those of ASUSTeK. Thank you for your cooperation. =====================================================================================================================================
|
|
|
|
Re: Names of licenses we currently support / where should license text live?
dmg
RUFFIN> The problem is that except for licenses like GPL or Apache2 a
RUFFIN> lot of licenses MIT, BSD, Apache1.1 contain a part which is RUFFIN> different from one license to another (such as the copyright RUFFIN> and for old BSD the acknowledgement). And most licenses RUFFIN> contain the obligation to propagate the copyright/license. So RUFFIN> if you do not keep a copy of such license, the day you want to RUFFIN> properly package your product with hundreds of open sources, RUFFIN> you have again to do the job to look for most licenses. The license would be embedded in the SPDX file. In fact, you will have all different licenses in a single place (the SPDX file) for every project. No need to go back to the source, if it hasn't changed. Next versions of the SPDX will allow you to extract the licenses from the SPDX and name them. By the way, Ninka is not bad at extracting this data. Here are two examples This is a nice one: * Copyright (c) 2001 Marko Kreen * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. that results into: AllRights,0,Copyright (c) 2001 Marko Kreen ,, BSDpre,70,,<colon> BSDcondSource,70,,,above ,, BSDcondBinary,70,,,, BSDasIs,10,,,THE AUTHOR AND CONTRIBUTORS ,,A, BSDWarr,70,,,THE AUTHOR OR CONTRIBUTORS, ---------------------------------------------------------------------- And this one is more complicated: * Copyright (c) 1983, 1990, 1993 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ that results into (yes, the all rights sentence misses the copyright owner because it is in a different one): AllRights,0,,, BSDpre,70,,<colon> BSDcondSource,70,,,above ,, BSDcondBinary,70,,,, BSDcondEndorse,70,,,,the University nor the names of its contributors,specific BSDasIs,10,,,THE REGENTS AND CONTRIBUTORS ,,A, BSDWarr,70,,,THE REGENTS OR CONTRIBUTORS, -- -- Daniel M. German http://turingmachine.org/ http://silvernegative.com/ dmg (at) uvic (dot) ca replace (at) with @ and (dot) with .
|
|
|
|
Re: fossbazaar wiki and LinuxCon followup
Tom "spot" Callaway
On 08/31/2010 08:53 AM, Martin Michlmayr wrote:
* Tom spot Callaway <tcallawa@...> [2010-08-24 21:26]:This is fantastic, thanks Martin! I'll bring the content from FedoraDrupal is a great CMS, but it is not such a great wiki.Sure, I'd agree with that. The Drupal wiki functionality has been over to the spdx.org site this week. Apologies for missing last Thursday's meeting (Thursdays are... busy for me). Was there any feedback on the mockups I did? ~tom
|
|
|
|
Re: fossbazaar wiki and LinuxCon followup
Martin Michlmayr
* Tom spot Callaway <tcallawa@...> [2010-08-24 21:26]:
Drupal is a great CMS, but it is not such a great wiki.Sure, I'd agree with that. The Drupal wiki functionality has been enough for our needs so far but MediaWiki (or another proper wiki) is definitely more powerful. I've installed MediaWiki on spdx.org now so you can play around with it there. If we decide this is the way to go, we can point spdx.org/wiki to it. I've installed the AuthDrupal extension so you can log into the MediaWiki with your spdx.org account. http://spdx.org/mediawiki/ -- Martin Michlmayr Open Source Program Office, Hewlett-Packard
|
|
|
|
Re: Names of licenses we currently support / where should license text live?
RUFFIN MICHEL
The problem is that except for licenses like GPL or Apache2 a lot of licenses MIT, BSD, Apache1.1 contain a part which is different from one license to another (such as the copyright and for old BSD the acknowledgement). And most licenses contain the obligation to propagate the copyright/license. So if you do not keep a copy of such license, the day you want to properly package your product with hundreds of open sources, you have again to do the job to look for most licenses.
toggle quoted messageShow quoted text
Michel Michel.Ruffin@..., PhD Software Coordination Manager, Bell Labs, Corporate CTO Dpt Distinguished Member of Technical Staff Tel +33 (0) 1 3077 7045 Alcatel-Lucent HQ, Centre de Villarceaux Route De Villejust, 91620 Nozay, France
-----Message d'origine-----
De : spdx-bounces@... [mailto:spdx-bounces@...] De la part de D M German Envoyé : mardi 31 août 2010 07:45 À : spdx@... Objet : Re: Names of licenses we currently support / where should license text live? Peter> Once a license is "approved" and placed in the repo it should be Peter> immutable. That way there is no chance of the text changing once the Peter> license name is in use. Perhaps this is a good reason to go minimalistic in the very first version (perhaps even not include ANY license at all). As people use the draft it will become more clear what are the challenges of including licenses in the standard, and potential pitfalls. After all, if the license is not spdx-named, then it will have to be included verbatim in the XML doc, which is not a bad thing. It can be pragmatically upgraded once SPDX decides what licenses to include. --dmg -- Daniel M. German http://turingmachine.org/ http://silvernegative.com/ dmg (at) uvic (dot) ca replace (at) with @ and (dot) with . _______________________________________________ Spdx mailing list Spdx@... https://fossbazaar.org/mailman/listinfo/spdx
|
|
|