Licensing Support by Build Systems and What Remains To Be Done
summary
Build systems (Yocto, ELBE, ISAR) reliably produce archives, source packages and build instructions and thus largely satisfy disclosure obligations, but generated license texts and copyright metadata are often incomplete, requiring manual review. A Yocto build plus the create_spdx class yields file-level SPDX material, a scanCode run on Linux 6.6.35 finds 102 unique license expressions, and meta-oselot/oselot offer a curated DB (≈200 packages now) to reuse reviewed compliance data and cut repeated scanning and human effort.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 2:55License compliance obligations
- 7:12Yocto and license info
- 12:52File-level SPDX compliance
- 17:12License scanners in Yocto
- 20:25Meta-OSELOT project
- 24:18Yocto disclosure support
- 25:41Debian license compliance
- 31:07Binary and source approaches
- 33:16Build systems compared
- 35:03Key takeaways
- 36:50Shared compliance need
- 37:32Q&A
related talks
49mLicensing Support by Build Systems and What Remains To Be Done
46mSPDX Generation via Yocto and the New LID code License Scanner
10mSPDX for Better License Statements
53mTooling Up for SPDX Software Package Data Exchange
31mLicense Compliance 101
33mREUSE: Making Free Software Licensing Easier For All
25mEnsuring OSS License Compliance the Easy Way
26mThe FOSSology Project – Open Source Software for Open Source License Compliance