Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update the SPDX license list #4031

Closed
spencerschrock opened this issue Apr 15, 2024 · 7 comments · Fixed by #4323
Closed

update the SPDX license list #4031

spencerschrock opened this issue Apr 15, 2024 · 7 comments · Fixed by #4323
Assignees
@lelia
Labels
check/License good first issue Good for newcomers kind/enhancement New feature or request

Comments

@spencerschrock
Copy link
Contributor

As noticed in #3838 (comment) (which I'm noticing know is wrong because Beerware shouldn't be on out list in the sense of FSF or OSI approved), the SPDX list seems to have fallen out of date and could be refreshed. The list was added ~2 years ago (via #2442) and we're probably missing a few entries.

scorecard/checks/raw/license.go

Lines 399 to 418 in 0b9dfb6

// (there's no magic here)
// created from the table at https://spdx.org/licenses
// 1) convert table to CSV and convert to json
// (inspired from inspired from https://stackoverflow.com/questions/17912307/u-ufeff-in-python-string)
//
// cat SPDX-license-IDs-202211131030CST.csv | \
// python -c \
// 'import csv, json, sys; print(json.dumps([dict(r) for r in csv.DictReader(sys.stdin)]))' | \
// sed 's/\\ufeff//g' > SPDX-license-IDs-202211131030CST.json
//
// 2) convert json to go lang compatible map
//
// cat SPDX-license-IDs-202211131030CST.json | \
// jq -c '.[] | select((."FSF Free/Libre?"=="Y") or (."OSI Approved?"=="Y")) | \
// [."Identifier",."Full Name"]' | \
// sed 's/","/": \{ Name: "/;s/\["/"/;s/"\]/" },/' | \
// sed 's/[- ]only//g;s/[- ]or[- ]later//g' | \
// sort | \
// uniq
var fsfOsiApprovedLicenseMap = map[string]fsfOsiLicenseType{

@spencerschrock spencerschrock added kind/enhancement New feature or request good first issue Good for newcomers check/License labels Apr 15, 2024
@lelia
Copy link
Contributor

lelia commented Apr 15, 2024

I can work on this

@spencerschrock spencerschrock mentioned this issue Jun 5, 2024
Closed
@spencerschrock
Copy link
Contributor Author

@lelia are you still interested in this?

@lelia
Copy link
Contributor

lelia commented Jun 17, 2024

@lelia are you still interested in this?

Yeah, sorry got sidetracked with some other priorities, but I did generate a new map of updated licenses a while back. I was holding off on making a contribution so we could have a more sustainable solution going forward, but I could always split the contribution into two parts.

@spencerschrock
Copy link
Contributor Author

I was holding off on making a contribution so we could have a more sustainable solution going forward, but I could always split the contribution into two parts.

At the time, I had thought stale data was part of the cause for #4144, but that wasn't the case. So there isn't a time critical part of this

@bagder
Copy link

bagder commented Aug 26, 2024

Our project which is 100% REUSE compliant (every single file clearly shows copyright and license) does not score full on License by the scorecard because of this problem.

@lelia lelia mentioned this issue Aug 30, 2024
Merged
2 tasks
@spencerschrock
Copy link
Contributor Author

Our project which is 100% REUSE compliant (every single file clearly shows copyright and license) does not score full on License by the scorecard because of this problem.

While the issue is closed, it wasn't the root cause for the scoring.

  1. We rely on GitHub for license type detection. https://api.github.com/repos/curl/curl/license doesn't identify the curl license, but rather NOASSERTION
  2. The check (as written) awards the last point for "FSF Free/Libre" or "OSI Approved" licenses. An issue or discussion around changing this behavior in favor of REUSE or some other metric (originally just having a LICENSE file was a full score) is a valid discussion, it's just unrelated to this issue.

@bagder
Copy link

bagder commented Sep 10, 2024

Okay. I'm a little disappointed that the aspirations aren't higher but I'll live.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lelia lelia

Labels
check/License good first issue Good for newcomers kind/enhancement New feature or request
Projects
Scorecard - NEW
Status: Done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

✨ Update SPDX license list, source for license data lelia/scorecard
3 participants
@bagder @lelia @spencerschrock