SPDX - How to handle MIT and BSD

Miroslav Suchý <msuchy@xxxxxxxxxx> · Mon, 14 Nov 2022 20:53:09 +0100



    MIT and BSD
        are very common licenses and can be tricky to convert to SPDX
        license identifiers. Just today, I got two questions about it.
        We have this covered in FAQ 
      https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1#I_have_a_package_with_BSD_or_MIT_in_the_License_field,_how_do_I_convert_that?
    But still, it
        can be confusing. So let me explain more verbosely than we have
        in the FAQ.
    

    You have a
        package that is licensed under the "MIT" license. So you run
    

    ```
    $
        license-fedora2spdx 'MIT' 
    Warning: more
        options how to interpret MIT. Possible options: ['mpich2',
        'libtiff', 'SMLNJ', 'SGI-B-2.0', 'NTP', 'MIT', 'MIT-open-group',
        'MIT-feh', 'MIT-enna', 'MIT-Modern-Variant', 'MIT-CMU', 'ICU',
        'HPND', 'BSL-1.0', 'Adobe-Glyph'] 
    Adobe-Glyph
    ```
    

    Can you choose
        any license from the output? No. Definitely no.
    

    You can take
        the result of this tool only when there is no warning. E.g.:
    

    ```
    $ license-fedora2spdx 'GPLv2'
      

      GPL-2.0-only

      
    ```

      
    Until now,
        what Fedora described as an "MIT" license was, in fact, a whole
        family of licenses. SPDX identify them differently. And the
        differences can be subtle. E.g., compare
    
      https://spdx.org/licenses/MIT.html
      https://spdx.org/licenses/MIT-feh.html
      https://spdx.org/licenses/MIT-open-group.html
    
    If your old
        Fedora license was MIT, there is a very high chance that the new
        one will be MIT too. But it is far from being 100 % sure. There
        are 14 other options. These that `license-fedora2spdx` listed in
        the warning above.

      
    Similarly, for
        BSD. BSD also identified the whole family. You likely end up
        with "BSD-2-Clause" or "BSD-3-Clause", but there are two
        different options as well.
    

    There are two
        common ways to find out what SPDX identifier you should use in
        such cases.
    

    1) You can use
        https://github.com/spdx/spdx-license-diff and use it to identify
        your license. This is a Chrome and Firefox plugin and allows you
        to select the text; and in the context menu, you can choose to
        identify the license. It will print, e.g., that it matches 60%
        of the MIT-feh license and highlight the difference. Or...
    

    2) you can
        navigate to 
      https://docs.fedoraproject.org/en-US/legal/allowed-licenses/
    in the search
        box above the first table, you enter your license and filter the
        content. If you enter "MIT", it will find you 26 licenses. Out
        of them, 15 have "MIT" in the "Fedora abbreviation" column (Hmm,
        this should be changed to "legacy name"). Now you have to open
        the link in the "URL" column and find your package's license.
        This may look painful, but you usually find the correct license
        within a few clicks.
    

    Miroslav

      
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue