License clarification

[xsuchy]

As part of the move to the SPDX identifier I have tried to convert rpm license to SPDX:

The current license string in Fedora is:

# Partially GPL/LGPL dual-licensed and some bits with BSD
# SourceLicense: (GPLv2+ and LGPLv2+ with exceptions) and BSD                                                                                                                                
License: GPLv2+

The README in this repository states:

RPM is Copyright (c) 1998 by Red Hat Software, Inc.,
and may be distributed under the terms of the GPL and LGPL (see  the
file COPYING for details).

http://rpm.org/about.html states

RPM is [free software](https://www.gnu.org/philosophy/free-sw.html), released under the [GNU GPL](https://www.fsf.org/licensing/licenses/gpl.html).

OpenSuse states in rpm.spec: GPL-2.0-or-later

And with respect to no effective analysis - what is the license of this project?

When crawling through the repository I:

• failed what is the exception suggested in "LGPLv2+ with exceptions"
• what is the BSD referred in the comment? - we have several variants of BSD in SPDX

If I omit these two issues I tend to think that the correct license is GPL-2.0-or-later AND LGPL-2.1-or-later but I will welcome your guidance.

[pmatilai]

See https://github.com/rpm-software-management/rpm/blob/master/COPYING for the exception(s) and other options.

[pmatilai]

The "BSD bits" probably refers to Berkeley DB which is long gone from rpm. There was a time when the entire BDB source, along with libmagic, lua and whoknowswhat was distributed in the rpm release tarballs.

[xsuchy]

I compared the second part of COPYING and COPYING-2 with https://www.gnu.org/licenses/old-licenses/lgpl-2.0.txt and it matches 100 % (sans formatting and old address). I still do not see any exceptions.

[xsuchy]

I filed https://src.fedoraproject.org/rpms/rpm/pull-request/44

[pmatilai]

I compared the second part of COPYING and COPYING-2 with https://www.gnu.org/licenses/old-licenses/lgpl-2.0.txt and it matches 100 % (sans formatting and old address). I still do not see any exceptions.

Um, the first part is the exception. More precisely, only parts of the codebase are alternatively available as LGPL. How that's supposed to be expressed in terms of SPDX or anything else, I have no idea.

[xsuchy]

Um, the first part is the exception. More precisely, only parts of the codebase are alternatively available as LGPL. How that's supposed to be expressed in terms of SPDX or anything else, I have no idea.

That should be GPL-2.0-or-later AND LGPL-2.1-or-later

[Conan-Kudo]

For RPM packaging purposes, the librpm subpackage would be LGPL-2.1-or-later. Fedora's rpm-libs package would be LGPL-2.1-or-later and GPL-2.0-or-later while the rest of the binary packages would be GPL-2.0-or-later.

[xsuchy]

Hmm, reading again the COPYING:

Alternatively,
all of the source code in the lib and rpmio subdirectories of the RPM source
code distribution as well as any code derived from that code may instead be
distributed under the GNU Library General Public License (LGPL), at the
choice of the distributor.

It is Alternatively ... at choice of distributor

So it should be GPL-2.0-or-later for the main part. And GPL-2.0-or-later OR LGPL-2.1-or-later for rpm-libs* and rpm-plugin*. Right?

[hroncok]

That depends on what files are built from what source. If anything in the main package is actually built from lib or rpmio dirs, the License would be GPL-2.0-or-later OR (GPL-2.0-or-later AND LGPL-2.1-or-later), based on the "no effective analysis" rule, wouldn't it? (Silly, isn't it?)

[pmatilai]

And that all depends on what exact package and version we're talking about. I assume current Fedora rawhide from the context, but the packaging has evolved quite a bit over time.

In the rawhide rpm, 'rpm-libs' is supposed to be "GPL or LGPL" and the rest just GPL. Except maybe 'rpm-devel', where at least librpmio and librpm related headers are necessarily "GPL or LGPL" too.

[pmatilai]

Let's continue this in the Fedora PR, other distros can and do package things differently so this could get confusing.