Curation guideline - Revision history

Ckresse: Adapt to consider new FOSSology version and Github actions

2026-03-23T07:43:00Z

Adapt to consider new FOSSology version and Github actions

← Older revision		Revision as of 09:43, 23 March 2026
Line 105:		Line 105:

	==== Both reports ====		==== Both reports ====
	* Set line break to 80 characters.		* Set line break to 80 characters for license texts (please note: Not for the entire SPDX file, as this will break checksums and render an invalid SPDX report)
	* Remove empty lines.		* Remove empty lines.

Line 122:		Line 122:
	* ''PackageLicenseConcluded:'' NOASSERTION		* ''PackageLicenseConcluded:'' NOASSERTION
	* (Not required for FOSSology versions 4.3 or higher) If main license is not a template license text, add correct customized license reference to ''PackageLicenseDeclared''.		* (Not required for FOSSology versions 4.3 or higher) If main license is not a template license text, add correct customized license reference to ''PackageLicenseDeclared''.
	* Dual licensing conclusions: Remove "LicenseRef-Dual-license" and correct AND operator to OR (e.g. LicenseA AND LicenseB AND LicenseRef-Dual-license → LicenseA OR LicenseB). ~~If there is dual licensing and multiple licenses, be~~ aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR)~~. For only two licenses, this is not required for FOSSology versions 4.3 or higher, but for three or more licenses, manual editing is still necessary~~.		* Dual licensing conclusions: In cases where more than two licenses are involved, manual post-processing is required. Remove "LicenseRef-Dual-license" and correct AND operator to the correct SPDX license expression (e.g. LicenseA AND LicenseB AND LicenseC AND LicenseRef-Dual-license → (LicenseA OR LicenseB) AND LicenseC). Be aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR).
	* As the SPDX standard does not contain template license texts but the OSSelot variant does, we need to add the prefix "LicenseRef-" to all license IDs that do not yet carry it to obtain a valid SPDX document. See patch in [[FOSSology#Customization]].		* As the SPDX standard does not contain template license texts but the OSSelot variant does, we need to add the prefix "LicenseRef-" to all license IDs that do not yet carry it to obtain a valid SPDX document. See patch in [[FOSSology#Customization]]. From FOSSology 4.6 and higher, this is included when selecting the report setting "Enable OSSelot export" for the SPDX report.

	The SPDX tag:value file ~~must~~ be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools]. ~~When the SPDX tag:value file is valid, convert~~ to spdx.json, spdx.rdf.xml, spdx.yaml formats.		The SPDX tag:value file should be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools], however, the report will also be validated on merge into the Github repository. The conversion to spdx.json, spdx.rdf.xml, spdx.yaml formats will also be automatically done at merge.

	== Contribution ==		== Contribution ==
Line 131:		Line 131:
	* README with download URL, purl, creator name		* README with download URL, purl, creator name
	* OSS disclosure file		* OSS disclosure file
	* SPDX tag:value file
	* SPDX json file
	* SPDX rdf.xml file
	* SPDX yaml file

	To contribute, the repository [https://github.com/Open-Source-Compliance/package-analysis https://github.com/Open-Source-Compliance/package-analysis] must be forked and a pull request must be created.		To contribute, the repository [https://github.com/Open-Source-Compliance/package-analysis https://github.com/Open-Source-Compliance/package-analysis] must be forked and a pull request must be created.

Ckresse: /* Post-processing */ : Layout hints

2024-01-09T11:10:47Z

Post-processing: : Layout hints

← Older revision		Revision as of 13:10, 9 January 2024
Line 105:		Line 105:

	==== Both reports ====		==== Both reports ====
	~~(Not~~ required for FOSSology versions 4.3 or ~~higher.)~~		* Set line break to 80 characters.
	* For "or later" license references, replace "+" with "-or-later", e.g. GPL-2.0+ → GPL-2.0-or-later.		* Remove empty lines.
	* For GNU licenses without "or later" extension, add "-only", e.g. GPL-2.0 → GPL-2.0-only.
			* Only required for FOSSology versions 4.2 or lower:
			** For "or later" license references, replace "+" with "-or-later", e.g. GPL-2.0+ → GPL-2.0-or-later.
			** For GNU licenses without "or later" extension, add "-only", e.g. GPL-2.0 → GPL-2.0-only.

	==== OSS disclosure report ====		==== OSS disclosure report ====

Ckresse: /* SPDX tag:value report */ : Fix wikilink to patch

2024-01-09T10:14:55Z

SPDX tag:value report: : Fix wikilink to patch

← Older revision		Revision as of 12:14, 9 January 2024
Line 120:		Line 120:
	* (Not required for FOSSology versions 4.3 or higher) If main license is not a template license text, add correct customized license reference to ''PackageLicenseDeclared''.		* (Not required for FOSSology versions 4.3 or higher) If main license is not a template license text, add correct customized license reference to ''PackageLicenseDeclared''.
	* Dual licensing conclusions: Remove "LicenseRef-Dual-license" and correct AND operator to OR (e.g. LicenseA AND LicenseB AND LicenseRef-Dual-license → LicenseA OR LicenseB). If there is dual licensing and multiple licenses, be aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR). For only two licenses, this is not required for FOSSology versions 4.3 or higher, but for three or more licenses, manual editing is still necessary.		* Dual licensing conclusions: Remove "LicenseRef-Dual-license" and correct AND operator to OR (e.g. LicenseA AND LicenseB AND LicenseRef-Dual-license → LicenseA OR LicenseB). If there is dual licensing and multiple licenses, be aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR). For only two licenses, this is not required for FOSSology versions 4.3 or higher, but for three or more licenses, manual editing is still necessary.
	* As the SPDX standard does not contain template license texts but the OSSelot variant does, we need to add the prefix "LicenseRef-" to all license IDs that do not yet carry it to obtain a valid SPDX document. See patch in [[~~fossypatch\|~~FOSSology:Customization]].		* As the SPDX standard does not contain template license texts but the OSSelot variant does, we need to add the prefix "LicenseRef-" to all license IDs that do not yet carry it to obtain a valid SPDX document. See patch in [[FOSSology#Customization]].

	The SPDX tag:value file must be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools]. When the SPDX tag:value file is valid, convert to spdx.json, spdx.rdf.xml, spdx.yaml formats.		The SPDX tag:value file must be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools]. When the SPDX tag:value file is valid, convert to spdx.json, spdx.rdf.xml, spdx.yaml formats.

Ckresse: /* SPDX tag:value report */: Add version variants

2024-01-09T10:09:50Z

SPDX tag:value report: : Add version variants

← Older revision		Revision as of 12:09, 9 January 2024
Line 118:		Line 118:
	* ''CreatorComment:'' <text>This document was created using license information and a generator from Fossology. It contains the license and copyright analysis of [package]. Please check "LicenseComments" for explanations of concluded licenses.</text>		* ''CreatorComment:'' <text>This document was created using license information and a generator from Fossology. It contains the license and copyright analysis of [package]. Please check "LicenseComments" for explanations of concluded licenses.</text>
	* ''PackageLicenseConcluded:'' NOASSERTION		* ''PackageLicenseConcluded:'' NOASSERTION
	* If main license is not a template license text, add correct customized license reference to ''PackageLicenseDeclared''.		* (Not required for FOSSology versions 4.3 or higher) If main license is not a template license text, add correct customized license reference to ''PackageLicenseDeclared''.
	* Dual licensing conclusions: Remove "LicenseRef-Dual-license" and correct AND operator to OR (e.g. LicenseA AND LicenseB AND LicenseRef-Dual-license → LicenseA OR LicenseB). If there is dual licensing and multiple licenses, be aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR).		* Dual licensing conclusions: Remove "LicenseRef-Dual-license" and correct AND operator to OR (e.g. LicenseA AND LicenseB AND LicenseRef-Dual-license → LicenseA OR LicenseB). If there is dual licensing and multiple licenses, be aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR). For only two licenses, this is not required for FOSSology versions 4.3 or higher, but for three or more licenses, manual editing is still necessary.
	* As the SPDX standard does not contain template license texts but the OSSelot variant does, we need to add the prefix "LicenseRef-" to all license IDs that do not yet carry it to obtain a valid SPDX document.		* As the SPDX standard does not contain template license texts but the OSSelot variant does, we need to add the prefix "LicenseRef-" to all license IDs that do not yet carry it to obtain a valid SPDX document. See patch in [[fossypatch\|FOSSology:Customization]].

	The SPDX tag:value file must be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools]. When the SPDX tag:value file is valid, convert to spdx.json, spdx.rdf.xml, spdx.yaml formats.		The SPDX tag:value file must be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools]. When the SPDX tag:value file is valid, convert to spdx.json, spdx.rdf.xml, spdx.yaml formats.

Ckresse: Version update

2024-01-09T09:59:25Z

Version update

← Older revision		Revision as of 11:59, 9 January 2024
Line 105:		Line 105:

	==== Both reports ====		==== Both reports ====
			(Not required for FOSSology versions 4.3 or higher.)
	* For "or later" license references, replace "+" with "-or-later", e.g. GPL-2.0+ → GPL-2.0-or-later.		* For "or later" license references, replace "+" with "-or-later", e.g. GPL-2.0+ → GPL-2.0-or-later.
	* For GNU licenses without "or later" extension, add "-only", e.g. GPL-2.0 → GPL-2.0-only.		* For GNU licenses without "or later" extension, add "-only", e.g. GPL-2.0 → GPL-2.0-only.

	==== OSS disclosure report ====		==== OSS disclosure report ====
	* Remove headings "Main license" and "Other licenses", and replace by heading "Licenses".		* Remove headings "Main license" and "Other licenses", and replace by heading "Licenses".

Ckresse: /* SPDX tag:value report */

2023-11-06T10:43:15Z

SPDX tag:value report

← Older revision		Revision as of 12:43, 6 November 2023
Line 118:		Line 118:
	* If main license is not a template license text, add correct customized license reference to ''PackageLicenseDeclared''.		* If main license is not a template license text, add correct customized license reference to ''PackageLicenseDeclared''.
	* Dual licensing conclusions: Remove "LicenseRef-Dual-license" and correct AND operator to OR (e.g. LicenseA AND LicenseB AND LicenseRef-Dual-license → LicenseA OR LicenseB). If there is dual licensing and multiple licenses, be aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR).		* Dual licensing conclusions: Remove "LicenseRef-Dual-license" and correct AND operator to OR (e.g. LicenseA AND LicenseB AND LicenseRef-Dual-license → LicenseA OR LicenseB). If there is dual licensing and multiple licenses, be aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR).
			* As the SPDX standard does not contain template license texts but the OSSelot variant does, we need to add the prefix "LicenseRef-" to all license IDs that do not yet carry it to obtain a valid SPDX document.

	The SPDX tag:value file must be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools]. When the SPDX tag:value file is valid, convert to spdx.json, spdx.rdf.xml, spdx.yaml formats.		The SPDX tag:value file must be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools]. When the SPDX tag:value file is valid, convert to spdx.json, spdx.rdf.xml, spdx.yaml formats.

CarstenEmde: Updated OSSelot logo to new font feature

2023-11-01T14:45:13Z

Updated OSSelot logo to new font feature

← Older revision		Revision as of 16:45, 1 November 2023
Line 1:		Line 1:
	This information is intended to provide guidelines on how data are curated for the <span style="font-family: OSSelot-Bold; font-weight: 500; color: #1565af;">O</span> project and how contributing works. The curator should be familiar with their preferred scanning tool (ours is [[FOSSology\|Fossology]]) and have a general understanding of copyright law and in particular knowledge of FOSS licensing.		This information is intended to provide guidelines on how data are curated for the <span style="font-family: OSSelot-Bold; font-weight: 500; color: #1565af;">OSSelot</span> project and how contributing works. The curator should be familiar with their preferred scanning tool (ours is [[FOSSology\|Fossology]]) and have a general understanding of copyright law and in particular knowledge of FOSS licensing.

	''Note:'' Whenever information is given that is specific to [[FOSSology\|Fossology]], it is prepended with the keyword '''fossy'''.		''Note:'' Whenever information is given that is specific to [[FOSSology\|Fossology]], it is prepended with the keyword '''fossy'''.
Line 89:		Line 89:

	== Report export and post-processing ==		== Report export and post-processing ==
	In the SPDX standard, licenses are denoted by a short identifier (e.g. GPL-2.0-only or LicenseRef-MIT-customized). Licenses that are not listed in the [https://spdx.org/licenses SPDX License List] are prefixed by "LicenseRef-", and in the section "License information" of the SPDX tag:value file, the full license text is given. Licenses with standard texts according to the [https://spdx.org/licenses SPDX License List] do not carry the "LicenseRef-" prefix, and their license text is not given in the tag:value file. For the <span style="font-family: OSSelot-Bold; font-weight: 500; color: #1565af;">O</span> project however, the SPDX tag:value file is intended to be self-consistent, i.e. for every short license identifier the corresponding full license text must be given.		In the SPDX standard, licenses are denoted by a short identifier (e.g. GPL-2.0-only or LicenseRef-MIT-customized). Licenses that are not listed in the [https://spdx.org/licenses SPDX License List] are prefixed by "LicenseRef-", and in the section "License information" of the SPDX tag:value file, the full license text is given. Licenses with standard texts according to the [https://spdx.org/licenses SPDX License List] do not carry the "LicenseRef-" prefix, and their license text is not given in the tag:value file. For the <span style="font-family: OSSelot-Bold; font-weight: 500; color: #1565af;">OSSelot</span> project however, the SPDX tag:value file is intended to be self-consistent, i.e. for every short license identifier the corresponding full license text must be given.
	* '''fossy:''' In order to achieve this while ensuring the SPDX file can be valid, we have patched our [[FOSSology\|Fossology]] installation to add the "LicenseRef-" prefix to all license identifiers. For details, see the article on [[FOSSology\|Fossology]].		* '''fossy:''' In order to achieve this while ensuring the SPDX file can be valid, we have patched our [[FOSSology\|Fossology]] installation to add the "LicenseRef-" prefix to all license identifiers. For details, see the article on [[FOSSology\|Fossology]].

Line 110:		Line 110:
	* Remove headings "Main license" and "Other licenses", and replace by heading "Licenses".		* Remove headings "Main license" and "Other licenses", and replace by heading "Licenses".
	==== SPDX tag:value report ====		==== SPDX tag:value report ====
	To see how the SPDX tag:value file is generally used in <span style="font-family: OSSelot-Bold; font-weight: 500; color: #1565af;">O</span> have a look at the [[SPDX2TV template\|SPDX2TV template]].		To see how the SPDX tag:value file is generally used in <span style="font-family: OSSelot-Bold; font-weight: 500; color: #1565af;">OSSelot</span> have a look at the [[SPDX2TV template\|SPDX2TV template]].

	The following tags must be edited:		The following tags must be edited:

Ckresse at 15:07, 14 September 2023

2023-09-14T15:07:15Z

← Older revision		Revision as of 17:07, 14 September 2023
Line 22:		Line 22:
	**** Copyright		**** Copyright
	** [[Scancode\|Scancode]] default options for analysis:<syntaxhighlight lang="bash">		** [[Scancode\|Scancode]] default options for analysis:<syntaxhighlight lang="bash">
	scancode -cli --license-text ~~–json~~ [package name-version].json [package]		scancode -cli --license-text -json [package name-version].json [package]
	</syntaxhighlight>c: copyrights; l: licenses; i: file information; --license-text: include full license text		</syntaxhighlight>c: copyrights; l: licenses; i: file information; --license-text: include full license text

Ckresse: Add "Contribution" and "Contact" sections.

2023-08-03T08:50:11Z

Add "Contribution" and "Contact" sections.

← Older revision		Revision as of 10:50, 3 August 2023
Line 119:		Line 119:
	* Dual licensing conclusions: Remove "LicenseRef-Dual-license" and correct AND operator to OR (e.g. LicenseA AND LicenseB AND LicenseRef-Dual-license → LicenseA OR LicenseB). If there is dual licensing and multiple licenses, be aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR).		* Dual licensing conclusions: Remove "LicenseRef-Dual-license" and correct AND operator to OR (e.g. LicenseA AND LicenseB AND LicenseRef-Dual-license → LicenseA OR LicenseB). If there is dual licensing and multiple licenses, be aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR).

	The SPDX tag:value file must be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools]. When the SPDX tag:value file is valid, convert to spdx.rdf.xml, spdx.json, ~~spdx~~.~~yaml formats~~.		The SPDX tag:value file must be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools]. When the SPDX tag:value file is valid, convert to spdx.json, spdx.rdf.xml, spdx.yaml formats.

			== Contribution ==
			The contribution of a newly curated package must contain the following artifacts:
			* README with download URL, purl, creator name
			* OSS disclosure file
			* SPDX tag:value file
			* SPDX json file
			* SPDX rdf.xml file
			* SPDX yaml file

			To contribute, the repository [https://github.com/Open-Source-Compliance/package-analysis https://github.com/Open-Source-Compliance/package-analysis] must be forked and a pull request must be created.
			* The Contribution must be licensed under CC0-1.0.
			* The pull request must contain a "Signed-off-by: [Name] <Email>" statement to indicate acceptance of the [https://github.com/Open-Source-Compliance/package-analysis/blob/main/CONTRIBUTING.md Certificate of Origin].
			* The contribution will be reviewed. If changes are required, we kindly ask the contributor to be persistent and resubmit the reworked contribution. When it is accepted, the artifacts will be published.

			== Contact ==
			Please direct any questions or remarks to [mailto:info@osselot.org info@osselot.org]. We will be happy to help.

Ckresse: Add "Report export and post-processing" section

2023-08-03T08:40:50Z

Add "Report export and post-processing" section

@@ Line 1: / Line 1: @@
-This information is intended to provide guidelines on how data are curated for the OSSelot project and how contributing works. The curator should be familiar with their preferred scanning tool (ours is [[FOSSology|Fossology]]) and have a general understanding of copyright law and in particular knowledge of FOSS licensing.
+This information is intended to provide guidelines on how data are curated for the <span style="font-family: OSSelot-Bold; font-weight: 500; color: #1565af;">O</span> project and how contributing works. The curator should be familiar with their preferred scanning tool (ours is [[FOSSology|Fossology]]) and have a general understanding of copyright law and in particular knowledge of FOSS licensing.
 ''Note:'' Whenever information is given that is specific to [[FOSSology|Fossology]], it is prepended with the keyword '''fossy'''.
@@ Line 87: / Line 87: @@
 Only If there is a LICENSE or COPYING or similar file in the root directory that states a main license for the package, we give this information as value to the SPDX tag ''PackageLicenseDeclared''.
 * '''fossy:''' In [[FOSSology|Fossology]], this is marked as the "main license" by activating the star symbol. Caution: If the main license is a custom text, [[FOSSology|Fossology]] takes the standard template text anyway. This has to be corrected manually in the post-processing stage (see section “Post-processing” below).