SPDX Statistics - Dvořák Edition

Miroslav Suchý <msuchy@xxxxxxxxxx> · Fri, 27 Sep 2024 11:49:01 +0200



    Hot news:
    - I am going through "neither Callaway nor SPDX" license
      formulas. I submitted dozens PR for your packages. And beside
      obvious typos or partial conversion I see cases where maintainers
      use SPDX id of license. This is not enough the license id must
      have SPDX id **and** must be on fedora-license-data list. If you
      do not see the license on
      https://docs.fedoraproject.org/en-US/legal/all-allowed/ (or it
      does not pass `license-validate` test) then please open issue
      against fedora-license-data at
      https://gitlab.com/fedora/legal/fedora-license-data
    - when your package has in license string LicenseRef-Callaway-*
      then rpmlint and rpminspect will complain about it. While
      reverting the string silence these linter (for now) the correct
      way is to correctly identify SPDX id. Best way is to 

    
     $
        sudo dnf install scancode-toolkit

        $ fedpkg clone $PACKAGE

        $ cd $PACKAGE

        $ fedpkg prep

        $ cd $ARCHIVEDIR

        $ scancode --license --license-references --html /tmp/scan.html
        -n8 . && firefox /tmp/scan.html
    - We had a meeting with Garry
        O'Neal from SPDX who introduced to variety of tools he is using
        for license scanning. We would love to deploy fossology in
        Fedora infrastructure to ease your license scanning.

      
     Two weeks ago we had: 

    
      * 24376 spec files in Fedora 

            
      * 31002 license
            tags in all spec files
      * 5970 tags have not been
                            converted to SPDX yet

      
      * 188 tags
                        can be trivially converted using
                        `license-fedora2spdx`
      *
                        Progress: 81,24% ░░░░░░░░██
                        100%

      
      ELN
                        subset:
      142
                        out of 2322 packages are not converted yet
                        (progress 93.88%)

                      
    Today we have: 
    * 24426 spec files in Fedora 

          
    * 31052 license tags
          in all spec files
    * 5918 tags have not been
                          converted to SPDX yet

    
    * 181 tags
                      can be trivially converted using
                      `license-fedora2spdx`
    *
                      Progress: 81,11% ░░░░░░░░██
                      100%

    
    ELN
                      subset:
    140
                      out of 2325 packages are not converted yet
                      (progress 93.98%)

                    
    Graph of these data with the burndown chart:

      
         https://docs.google.com/spreadsheets/d/1QVMEzXWML-6_Mrlln02axFAaRKCQ8zE807rpCjus-8s/edit?usp=sharing
    The list of packages needed to be converted is here:
         https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-final.txt
    List by package maintainers is here
       https://pagure.io/copr/license-validate/blob/main/f/packages-without-spdx-final-maintainers.txt
    Packages that are neither in SPDX nor in Callaway format (highest
      priority for now):
    https://pagure.io/copr/license-validate/blob/main/f/neither-nor-remaining-packagers.txt
    New version of fedora-license-data has been released. With: 
         5 new licenses

          7 licenses are waiting to be reviewed by SPDX.org (and then to
      be added to fedora-license-data) https://gitlab.com/fedora/legal/fedora-license-data/-/issues/?label_name%5B%5D=SPDX%3A%3Ablocked

    
    Legal docs and especially 

      https://docs.fedoraproject.org/en-US/legal/allowed-licenses/
    was updated too. 

    
    New projection when we will be finished is 2025-03-27 (+17 days from
    last report).  Pure linear approximation. 

    If your package does not have
      neither git-log entry nor spec-changelog entry mentioning SPDX and
      you know your license tag matches SPDX formula, you can put your
      package on ignore list
      https://pagure.io/copr/license-validate/blob/main/f/ignore-packages.txt
    Either pull-request or direct
        email to me is fine. 

      
    Why Dvořák edition? Because
        on today's date at 1892 Czech composer Antonín Dvořák arrived on
        steam boat to New York per request of Jeanett Thurberg. Dvořák
        stayed in US for 3 years as director of National Conservatory of
        Music. Directly influenced by stay in US he composed "From the
        New World". Neil Armstrong took this recording for his Apollo 11
        mission and it was first musing that was played on the Moon.
    https://en.wikipedia.org/wiki/Symphony_No._9_(Dvo%C5%99%C3%A1k)
    https://open.spotify.com/album/6FMu88LoghMcmme2aDkK3S?si=OKGoOpwJSRCOPIhcxID17g 
        [40 minutes]

      
    https://en.wikipedia.org/wiki/Anton%C3%ADn_Dvo%C5%99%C3%A1k#United_States

      
    Miroslav

    
-- 
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue