calm: SPDX licence list data update please

[Brian Inglis]

On 2024-05-27 15:15, Jon Turney via Cygwin-apps wrote:
> On 24/05/2024 17:08, Brian Inglis via Cygwin-apps wrote:

>> Can we please get the SPDX licence list data updated in calm to 3.24 sometime 
>> if possible as the licences complained about below have been in 
> 
> I thought I wrote about this the last time you asked, but obviously not.

Thought not, but after recent reminder, not so sure now ;^>

> This is not quite straightforward, as the system python on sourceware is 
> currently python3.6, and the last supported nexB/license-expression on that is 
> 30.0.0, and moving to a later one has some wrinkles, since various pieces of 
> interconnected stuff aren't venv'd (yet?).
> 
>> releases for nearly a year since 3.21:

>> If not, perhaps I could be of some help if I knew requirements?
> 
> So, there aren't any requirements here except "validate the SPDX license 
> expression to detect maintainer mistakes and typos".
> 
> It looks like using that python module might have been a mistake.
> 
> I'm not sure why it needs to contain it's own version of the license data, 
> ideally we'd have something that read the official SPDX data (ratelimited to 
> once per day or something. It looks like maybe this would possible to do by 
> feeding our own license list into the module rather than using it's built in 
> one, but one could hope for this to be built in already...)

There have been changes in how to specify exceptions using WITH.

> It would also be useful if it could also be taught to accept 'LicenseRef-.*' 
> identifiers.

Ditto ExceptionRef-.* but that and LicenseRef-.* do not seem to be allowed by 
PEP 639, as they unrealistically expect projects to change existing licences, 
whereas we have to deal with historical reality like Fedora!

> So, suggestions on a different module to use, or patches to make this work 
> better, or cogent arguments why we should just remove this validation are all 
> welcome.

How about if we delegate licence validation to cygport, as someone recently 
offered, or as currently done in calm, with current Cygwin python - add licence 
validation hint to src hint - if not there, calm does it as now?

Would we or should we also allow specifying LICENSE_URI (as I have been doing) 
like PEP 639 license-files, with defaults searched as suggested:

	"LICEN[CS]E*", "COPYING*", "NOTICE*", "AUTHORS*"?

where globs and source paths are allowed as usual in cygport files, and 
directories may match these paths, implicitly including file entries, but no 
file *contents* checked, unless we see a need in future, to generate and 
validate licences.

>> You can also now remove the exceptions in calm/fixes.py(licmap):
> 
> Thanks, will do so.

Cheers!

-- 
Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada

La perfection est atteinte                   Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer     but when there is no more to cut
                                 -- Antoine de Saint-Exupéry