Auto-generate OSI matches by comparing license text

[wking]

And ideally I'd like to see the OSI references removed from human-controlled source and autogenerated by iterating over OSI licenses and comparing the OSI-supplied license text with our local template. That would help avoid issues like our current declaration that the 0BSD is not OSI-approved (when, in fact, it is). This is related to #417, which is about what information we record after a match is found.

[goneall]

@wking Do you know of an API to access the OSI references? I recall a discussion where someone was working on this, but I couldn't find it with a quick google search. I found this repo: https://github.com/OpenSourceOrg/licenses but it is not authoritative and I would be hesitant to use something unofficial.

[wking]

More on authoritative-ness in OpenSourceOrg/licenses#47. If there's interest in machine readable data on both sides (and it seems like there is), I expect we can work together to get this working. If there are still reliability concerns, we can always have the automated tooling propose changes for human approval.

[goneall]

@wking I would propose we monitor the activity on the OSI licenses and API. Once it is official, we can look at updating the tools to autogenerate the field. We would need to review this by the SPDX legal team, but I personally like the idea of automating at least part of the synchronization with OSI.

[wking]

I would propose we monitor the activity on the OSI licenses and API.

Note that their API currently only supports links for text. So I suggest we start by scraping the license text out of their HTML pages, and we can do that without waiting for their API to stabilize.

[swinslow]

Following from the updated discussions at spdx/LicenseListPublisher#20, I think that any approach to auto-populating the "OSI approved?" field is going to be driven by utilizing APIs provided by OSI -- rather than us creating a license-scraping-and-matching tool.

I'm going to go ahead and close this old issue -- until the APIs are implemented / integrated, we can continue to maintain the OSI approval field manually as we've been doing.