Firmwares with multiple payload licenses

Richard Hughes <[email protected]> Mon, 22 Apr 2024 11:09:38 +0100
Newsgroups dev.linux.lists.lvfs-announce
Message-ID <CAD2FfiGy4z1Ld5Ym0VCZyRe=z5dtUdg47q30V+GyifhhD-TeLg@mail.gmail.com>
Hi all,

I=E2=80=99ve just merged a new feature to the LVFS which allows the firmwar=
e
uploader to indicate that the payload is under more than one license.
One example here would be when a GPLv2+ boot-loader is bundled up with
a proprietary payload and where the OEM legal team say both licenses
need to be indicated on the device project page.

Multiple licenses can be specified in a deliberately-reduced SPDX
grammar in the XML metainfo file =E2=80=93 so no OR clauses or brackets =E2=
=80=93 on
the logic we want to make this as simple as possible for clients
consuming the metadata. Valid examples:

* <project_license>LicenseRef-proprietary</project_license>
* <project_license>LicenseRef-proprietary AND MIT</project_license>
* <project_license>GPL-2.0+</project_license>
* <project_license>GPL-2.0+ AND MIT AND LicenseRef-proprietary</project_lic=
ense>

Invalid examples (that will not be parsed correctly):

* <project_license>GPL-2.0+ OR MIT</project_license>
* <project_license>(GPL-2.0+ AND MIT) OR
LicenseRef-proprietary</project_license>

In most cases no action is needed as most vendors are using
=E2=80=9CLicenseRef-proprietary=E2=80=9D (or its alias, =E2=80=9CProprietar=
y=E2=80=9D).

The only user-visible change for LVFS users is the disappearance of
the =E2=80=9CProject License=E2=80=9D dropdown in the =E2=80=9CComponent De=
tails=E2=80=9D section and
the appearance of a =E2=80=9CLicense=E2=80=9D tab in the component navbar. =
As QA users
do not typically change the license of the uploaded archive, no real
action is required, and this is just an advisory email about the UI
change.

Questions and concerns welcome, either on lvfs-general or by private
email. Thanks!

Richard.