On Mon, Aug 17, 2020 at 2:16 PM Andreas Cord-Landwehr <cordlandw...@kde.org> wrote: > > Hi, I am currently looking into extending our metainfo.yaml files to provide > information about the outbound licenses of the artefacts that are provided by > a framework. Here a few examples: > > Attica: Provides libattica, which is legally OK to be used as LGPL-2.1 or > LGPL-3.0 (and of course also as GPL-2.0 or GPL-3.0). > > Baloo, which is quite complicated: The library is (supposed to be; there are a > few license issues here at the moment) LGPL-2.1 and may also be used as > LGPL-3.0. Moreover, there is the baloo-kioslave that is GPL, then there are a > few tools balooctl, balooshow and baloosearch, which are all GPL-2.0 or > GPL-3.0. > > **First question:** Shall we only list ONE or ALL licenses, same for the > license information overview that should be on api.kde.org?
The primary use would be api.kde.org, no? A third party looks for a solution to hardware shenanigans with Qt and finds the solid docs and the solid docs say "you may use this thingy under LGPL-2.1". If so, then surely we ought to encode all artifacts and their licensing terms. What's more,. the artifact a given class belongs to becomes relevant and I guess that's a bit tricky to sort out. > Now, I am wondering about the best approach to encode something like this into > the metainfo.yaml. I am currently considering a structure as follows: > > Attica's metainfo.yaml > [...] > outboundLicenses: > libattica: > - LGPL-2.1-only > - LGPL-3.0-only > > Baloo's metainfo.yaml > [...] > outboundLicenses: > libbaloo: > - LGPL-2.1-only > - LGPL-3.0-only > baloo-kioslave: > - GPL-2.0-only Why not actually use a SPDX expression? `LGPL-2.1-only OR LGPL-3.0-only`. Some additional concerns that come to mind: - what 's the actual artifact name? for libraries we already have a target name so I guess we might just use that so for example that'd be KF5::Baloo. What about plugins or binaries though? - how would we make sure all artifacts are encoded? do we want to even? HS
