diff --git a/content/policies/license-expectations.md b/content/policies/license-expectations.md index eef5d8a6da6cdadf85602f2d2c3623483f1b3c1f..9271d49ec0debec7413351a0545c145bb59e6061 100644 --- a/content/policies/license-expectations.md +++ b/content/policies/license-expectations.md @@ -80,8 +80,8 @@ different copyright holders. Maintaining the open source licenses documentation is an incremental process: -At the time of rebase, licenses are checked manually for all packages involved -in the rebase. This covers the whole archive. +At the time of rebase, licenses are checked for all packages involved in the +rebase. This covers the whole archive. During the development, updates are monitored. The integration of a new project in Apertis and the update of source code are the operations that can @@ -98,13 +98,43 @@ licensing constraints to the software stack of preview and product releases. These constraints do not affect development releases, and it is possible to save some work on those releases. -In an ideal situation, regular checks of the whole archive would be automated -to ensure nothing escaped the manual checks. While the +Regular checks of the whole archive have been integrated into Apertis CI +pipelines to provide early detection of any change to the licensing status of +each package. A copyright report is generated and kept updated using +[scan-copyrights]( {{< ref "#scan-copyrights" >}} ), helping [Apertis maintainers]({{< ref "contributions.md#the-role-of-maintainers" >}}) -are already manually checking packages, the automated whole-archive checks are -not currently implemented. -[Future improvements]( {{< ref "#future-improvements" >}} ) presents a possible -solution. +to detect problematic licenses or missing information which may require manual +check. [Future improvements]( {{< ref "#future-improvements" >}} ) presents +an alternative solution. + +## scan-copyrights + +As a first step, the entire package source tree needs to be scanned to detect +and find copyright holders and known licenses for each file. In order to achieve +that, `scan-copyrights` tool has been integrated to Apertis CI pipeline, +rescanning and updating a copyright report for each package on every release. + +Written in Perl, `scan-copyrights` tool from +[libconfig-model-dpkg-perl](https://salsa.debian.org/perl-team/modules/packages/libconfig-model-dpkg-perl/) +uses [licensecheck](https://salsa.debian.org/perl-team/modules/packages/licensecheck) +to parse the source files, detect known licenses and copyright statements, +outputting the result in plain text or a Debian copyright file format. + +Apertis packages keep an exhaustive copyright report in +`debian/apertis/copyright`, containing information for **every** file in the +source tree. During this process, missing information and *unacceptable* +licenses are reported, which may require manual review from developers to +complete the package copyright report. Two files are used for this purpose: + +* `debian/apertis/copyright.yml`: Contains a *mapping* YAML structure, where the +key is a Perl pattern used to match a path, to manually provide the correct +copyright information. See +[Filling_the_blanks](https://manpages.debian.org/buster/libconfig-model-dpkg-perl/Dpkg::Copyright::Scanner.3pm.en.html#Filling_the_blanks). + +* `debian/apertis/copyright.whitelist`: Using *git ignore* format, lists files +that will be ignored if reported with a missing/unacceptable license. Note that +CI pipeline updates the copyright report with information for **every** file and +will fail reporting on those problematic entries that weren't whitelisted. # Apertis Licensing expectations @@ -247,14 +277,13 @@ specific exceptions. # Future improvements -Manually checking licenses will not scale and may not be done in a deterministic -way. Introducing automation is a key. - FOSSology is a license reporting tool. It is described in the [Automated License Compliance]({{< ref "automated-license-compliance.md" >}}) document along with an approach to enable end-to-end tracking of licensing -information. Although we trust the developer to check license, the use of -FOSSology could help ensure correct identification. +information. Although [scan-copyrights]( {{< ref "#scan-copyrights" >}} ) has +helped a lot on automating the process, the approach using FOSSology covered in +the Automated License Compliance concept will result in a finer grained and more +reliable license identification through to generation of binary packages. # Appendix