Bug 2303404 - Review Request: rust-cargo-license - Cargo subcommand to see license of dependencies
Summary: Review Request: rust-cargo-license - Cargo subcommand to see license of depen...
Keywords:
Status: ASSIGNED
Alias: None
Product: Fedora
Classification: Fedora
Component: Package Review
Version: 40
Hardware: All
OS: Linux
unspecified
low
Target Milestone: ---
Assignee: Fabio Valentini
QA Contact: Fedora Extras Quality Assurance
URL: https://crates.io/crates/cargo-license
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-08-07 09:44 UTC by solomoncyj
Modified: 2024-09-09 19:53 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:
decathorpe: fedora-review?


Attachments (Terms of Use)
Srpm (21.05 KB, application/x-rpm)
2024-08-07 09:45 UTC, solomoncyj
no flags Details
spec (1.89 KB, text/plain)
2024-08-07 09:45 UTC, solomoncyj
no flags Details
spec-2 (1.95 KB, text/plain)
2024-08-23 23:05 UTC, solomoncyj
no flags Details
srpm-2 (21.11 KB, application/x-rpm)
2024-08-23 23:06 UTC, solomoncyj
no flags Details

Description solomoncyj 2024-08-07 09:44:11 UTC
Description: A cargo subcommand to see license of dependencies.
Fedora Account System Username: solomoncyj

Reproducible: Always

Comment 1 solomoncyj 2024-08-07 09:45:00 UTC
Created attachment 2043622 [details]
Srpm

Comment 2 solomoncyj 2024-08-07 09:45:22 UTC
Created attachment 2043623 [details]
spec

Comment 3 solomoncyj 2024-08-07 10:16:33 UTC
Spec URL: https://bugzilla.redhat.com/attachment.cgi?id=2043623
SRPM URL: https://bugzilla.redhat.com/attachment.cgi?id=2043622
Description: A cargo subcommand to see license of dependencies.
Fedora Account System Username: solomoncyj

Comment 4 Petr Menšík 2024-08-15 23:37:55 UTC
cargo-license subpackage clearly does have FIXME instead of its license. That should include License of the project and its dependencies combined. That seems to be what License of main package contains now. I think that belongs only to %{crate} subpackage, the rest should have just MIT license used by the project itself.

I expect that is a blocker for the review, but I am not rust expert.

Comment 5 solomoncyj 2024-08-16 02:55:33 UTC
(In reply to Petr Menšík from comment #4)
> cargo-license subpackage clearly does have FIXME instead of its license.
> That should include License of the project and its dependencies combined.
> That seems to be what License of main package contains now. I think that
> belongs only to %{crate} subpackage, the rest should have just MIT license
> used by the project itself.
> 
> I expect that is a blocker for the review, but I am not rust expert.

The main licenses is inherited by all subpackages

Comment 6 Fabio Valentini 2024-08-20 11:18:58 UTC
Petr is correct.

This is a normal Rust crate, you should not use SourceLicense at all. The way it's set up by rust2rpm is correct.

Make SourceLicense the License, and move the License to the subpackage instead of the FIXME.

Comment 7 solomoncyj 2024-08-23 23:05:17 UTC
Created attachment 2044727 [details]
spec-2

Comment 8 solomoncyj 2024-08-23 23:06:38 UTC
Created attachment 2044728 [details]
srpm-2

Comment 9 solomoncyj 2024-08-23 23:07:32 UTC
Spec URL: https://bugzilla.redhat.com/attachment.cgi?id=2044727
SRPM URL: https://bugzilla.redhat.com/attachment.cgi?id=2044728
Description: A cargo subcommand to see license of dependencies.
Fedora Account System Username: solomoncyj

Comment 10 solomoncyj 2024-09-06 09:48:43 UTC
SPEC URL: https://github.com/solomoncyj/cargo-license/releases/download/1/rust-cargo-license.spec
SRPM URL: https://github.com/solomoncyj/cargo-license/releases/download/1/rust-cargo-license-0.6.1-1.fc40.src.rpm
Description: A cargo subcommand to see license of dependencies.
Fedora Account System Username: solomoncyj

Comment 11 Fedora Review Service 2024-09-06 10:01:12 UTC
Copr build:
https://copr.fedorainfracloud.org/coprs/build/7988879
(succeeded)

Review template:
https://download.copr.fedorainfracloud.org/results/@fedora-review/fedora-review-2303404-rust-cargo-license/fedora-rawhide-x86_64/07988879-rust-cargo-license/fedora-review/review.txt

Found issues:

- License file cargo-license is not marked as %license
  Read more: https://docs.fedoraproject.org/en-US/packaging-guidelines/LicensingGuidelines/#_license_text

Please know that there can be false-positives.

---
This comment was created by the fedora-review-service
https://github.com/FrostyX/fedora-review-service

If you want to trigger a new Copr build, add a comment containing new
Spec and SRPM URLs or [fedora-review-service-build] string.

Comment 12 Fabio Valentini 2024-09-09 19:53:01 UTC
Replace this:

```
SourceLicense:        MIT
License:        %{shrink:
((MIT OR Apache-2.0) AND Unicode-DFS-2016) AND
(Apache-2.0 OR BSL-1.0) AND
(Apache-2.0 OR MIT) AND
MIT
}
```

With just this:

```
License:        MIT
```

And you should be good.

Setting the SourceLicense/License tag in the "main" package the way you did is wrong - it would cause the -devel subpackage have the "binary" license too, even if it should just be covered by the "Source" license.

I don't know where you got the idea for using the "SourceLicense" tag? It's not used at all by rust2rpm for this type of package (for good reasons).


Note You need to log in before you can comment on or make changes to this bug.