New license request: DRL

[defensivedepth]

1. License Name: Detection Rule License - DRL
2. Short identifier: DRL
3. License Author or steward: Author - Florian Roth, Steward - Josh Brower, Josh@defensivedepth.com
4. Comments: N/A
5. Standard License Header:
6. URL: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md
7. OSI Status: Not Submitted

[swinslow]

@defensivedepth Thanks for this -- are you aware of any projects using this other than the URL you listed above?

[defensivedepth]

@swinslow I don't think there are any other public projects, but there are internal teams that make use of that license when authoring their own rules. I do not know how widespread it is.

I am submitting this license for inclusion because I help maintain an open source project that is a frontend for the rule. As part of each rule's metadata, it includes a license, which we point to https://spdx.org/licenses/. If a rule uses DRL, that part is broken as DRL is not included in https://spdx.org/licenses/.

Hope that all made sense.

[pmadick]

This license appears to meet most of the license inclusion guidelines to be added to the SPDX license list with the exception that the license does not appear to be widely used. However, the project encourages others to make Rules and then place those rules under the license so it may make sense to add it to the SPDX LL. If it is added the short identifier and the license name should both include the version number 1.0.

[swinslow]

@pmadick, I agree, I'm in favor of adding this to the list based on the inclusion guidelines. I'll bring this up during the legal team call today to get input from the other attendees.

[swinslow]

Discussed on 2020-11-19 legal team call, agreed to add.

[swinslow]

I don't think we're going to get this added for this release, so I'm bumping it to 3.12 -- we'll get it added early in the 3.12 cycle.

[jlovejoy]

@defensivedepth - I think the short identifier should be DRL-1.0
in light of there being a version number on the license (yeah) and that we always try to include that in case of later versions. Can you affirm that and then we can get this ready?

[defensivedepth]

Yes, sounds good to me, thanks!

[jlovejoy]

fixed by #1183

[jlovejoy]

closing this now, as we have PR and that should be merged soon

[tchetwin]

The license in this location is now DRL-1.1:
https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md

It was updated here: SigmaHQ/sigma#1839

SPDX currently lists only DRL-1.0, here:
https://spdx.org/licenses/DRL-1.0.html

[jlovejoy]

if this is a new version, then it would be a new license submission and issue - please don't comment on closed issues, as we often don't see them! :)