SPDX check in License?

[vermaete]

I could be wrong, but I think that 'BSD' is not a valid SPDX string to identify a LICENSE.
At least I could not find it here: https://opensource.org/license

But a recipe in meta-ros does have it. And it is giving an error when creating the spdx file for the image.

And no error/warning/note was generated with the latest version of oelint-adv.

br

[priv-kweihmann]

I think you got a completely wrong impression of what is checked.
The rule itself only checks for the correct usage of spaces in a multi-licensed license string.
There is no (and there will be no) check on the individual items, at least not as part of the standard delivery of the linter (meta-rubygems does a in detail check of the license settings, but it does not support custom licenses).

[vermaete]

Hi,

I thought about a new rule that checks if the value of values of the LICENSE variable are valid.
https://docs.yoctoproject.org/singleindex.html#term-LICENSE

The the example above 'BSD' in not part of meta/files/common-licenses/ nor the SPDXLICENSEMAP thingy.

Although Yocto/OE will check this also during 'do_populate_lic', oelint-adv could check this faster and sooner.

Feel free to close it if it's not something for your tooling.

Br

[priv-kweihmann]

I'm not against a proper check but it would need to come from a reliable source (psi, spdx, Scancode - all having there drawbacks and weaknesses) as a 3rd party maintained lib to consume (license needs to also match the permissive group).

Another problem is that Yocto doesn't follow the general agreement to prefix non-osi-approved licenses with "LicenseRef-", as there is no way for the linter to expand those custom licenses you can inject into each layer, custom licenses will create a ton of false positives (within poky there is also that spdx alias list, which is another source of information, that likely won't be easy to include).

Hence I think this is not doable without creating a mess of false positives - but of course I leave the option open for someone to step up with a PR, as long as it solves all of the problems mentioned above.

And about that "BSD" license ID... That one will not make it pass a modern day poky build.
So there will already be a good enough indication that something is wrong here.
I personally see the linter as a companion of a build not as a replacement

[vermaete]

@priv-kweihmann Fine for me. I do understand you point of view. And indeed, invalid license will be detected by yocto itself.