SourcePackage licenses

Overview

• Launchpad entry: https://blueprints.edge.launchpad.net/soyuz/+spec/sourcepackage-licenses

• Created: 2008-12-01 by CelsoProvidelo

• Contributors: JulianEdwards

Overall Summary

Summary: This specification describes how sourcepackage licenses will be stored and tracked within Launchpad using the new debian copyright format. See http://wiki.debian.org/Proposals/CopyrightFormat and https://wiki.canonical.com/UbuntuPlatform/Roadmaps/9.04/PackageLicensing for more information.

Goal/Deliverables: Extract and store as much information as possible from the new machine readable copyright format when it's used.

We will know we have finished when the license relationships expressed in the new copyright format are stored and accessible after a sourcepackage upload is processed.

Release Note

This basic implementation will enrich the Launchpad sourcepackage model with all the copyright information provided by the packager. Once it's completed other subsystems will be able to deal with sourcepackages according to their licences.

Rationale

Licenses are not well represented at the sourcepackage level. It's currently very hard to extract that information and consider licences as an attribute of the package itself. It's about time to allow developers to equate licences issues properly in their packages and allow users to browse/query packages considering this aspect.

Use cases

• John, a developer, has packaged a new upstream source and should be able to express all the licenses involved in his package for uploading it and would be very happy if all his efforts are visible in the Launchpad UI.
• Richard is a strong GPL-v3 advocate, and to prove his point, he want to produce a report of all sources currently published in ubuntu/jaunty which contains GPL-v3 license code.
• Romeu, a release manager of a distribution hosted in Launchpad, wants to audit all the sources published in his release and decide, based on their licenses, which sources can be redistributed on their mirrors.
• Juliet, a package reviewer, should be able to inspect the licenses involved in a new source uploaded to ubuntu before accept it.
• Ruben, an user, wants to find a ERP application already packaged in ubuntu and licensed under a GPL-compatible license, so he can start to implement his free extensions for it.
• ...

Assumptions

1. The ubuntu and the debian community are happy with http://wiki.debian.org/Proposals/CopyrightFormat specification;

2. There is no major different (pattern-wise) between the debian format and the RPM proposal (see http://fedoraproject.org/wiki/Packaging/LicensingGuidelines);

3. This specification will focus in storing a comprehensive set of data that represents what is encoded in the debian/copyright file. No UI features have to be delivered yet.
4. ...

User Interface

None, see Assumptions

Implementation

Code Changes

The debian/copyright content is already stored during upload processing as part of the NascentUpload workflow.

That step of the code should be extended to also parse the copyright content in a intermediate object (probably reusing or current RFC-822 parser) to allow the SourcePackageReleaseCopyright records to inserted later, at the same point we actually create the SourcePackageRelease.

Schema Changes

• SourcePackageRelease table new fields:

  • copyright_format_url: Text (valid_url);
  • upstream_name: Text;
  • upstream_source: Text (valid_url);

• SourcePackageReleaseCopyright (new table):

  • sourcepackagerelease: SourcePackageRelease FK;

  • license: DBEnum License;
  • file_glob: Text (fti);
  • copyright_note: Text (fti);
  • copyright_holder: Person FK (may be null on copyright_note without email address);

Migration

Since the new copyright format isn't being used yet, no migration is required.

However if the deployment get late and sources using the new format get uploaded, the original debian/copyright content is being stored in SourcePackageRelease and could be easily re-processed.

Unresolved issues

None, so far.

CategoryProposal