Re: LICENSE values for non-standard OSS licenses

[Jon Turney <jon.turney@dronecode.org.uk>]

On 11/10/2022 09:37, Adam Dinwoodie wrote:
[...
> ```
> ERROR: invalid hints git-filter-repo-2.38.0-1-src.hint
> ERROR: package 'git-filter-repo': errors in license expression: ['Unknown license key(s): LicenseRef-inherit-git, LicenseRef-inherit-libgit2, LicenseRef-inherit-libgit2-examples']
> ERROR: errors while parsing hints for package 'git-filter-repo'
> ERROR: error parsing /sourceware/cygwin-staging/home/Adam Dinwoodie/noarch/release/git-filter-repo/git-filter-repo-2.38.0-1-src.hint
> ERROR: error while reading uploaded arch noarch packages from maintainer Adam Dinwoodie
> SUMMARY: 5 ERROR(s)
> ```

Sigh.  Yeah, this isn't working well and is causing people problems, so 
I've changed this validation failure from an error to a warning, for the 
moment.

I might remove it totally, or revise how it works in the future.

> So it looks like the issue is the way I've encoded the non-standard
> licensing options.  "LicenseRef-"(idstring) seems to be the way to
> encode this sort scenario, per [1] and [2], but that doesn't seem to be
> acceptable to calm.
> 
> [1]: https://spdx.github.io/spdx-spec/v2.3/other-licensing-information-detected/
> [2]: https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/

That says that anything starting "LicenseRef-" can be used to indicate a 
license not on the SPDX license list, but I'm not sure where "inherit" 
comes from?  Does this just have a meaning defined in some other distro 
which uses SPDX license expressions?

Since these expressions containing LicenseRef ids don't have a definite 
meaning, perhaps it would just as good for it to be undefined, which is 
what omitting it currently indicates.

> Are there any suggestions about how to resolve this?  I don't think I
> can just use the standard license strings: even if we used GPL-2.0-only
> in place of LicenseRef-inherit-git -- incorrect as that's the license
> *currently* used by Git, but the license for git-filter-repo explicitly
> incorporates any future OSS license Git might use -- that still leaves
> the problem of LicenseRef-inherit-libgit2, which is currently GPL 2.0
> with an exception that's not covered by any of the SPDX standard
> exceptions.
> 
> For now I can just remove the LICENSE values to get the build released,
> but that seems like a temporary approach at best...

Well, yes, but then "everything is temporary, anyway" :-)