Firmwares with multiple payload licenses

Firmwares with multiple payload licenses

[Richard Hughes]

Hi all,

I’ve just merged a new feature to the LVFS which allows the firmware
uploader to indicate that the payload is under more than one license.
One example here would be when a GPLv2+ boot-loader is bundled up with
a proprietary payload and where the OEM legal team say both licenses
need to be indicated on the device project page.

Multiple licenses can be specified in a deliberately-reduced SPDX
grammar in the XML metainfo file – so no OR clauses or brackets – on
the logic we want to make this as simple as possible for clients
consuming the metadata. Valid examples:

* <project_license>LicenseRef-proprietary</project_license>
* <project_license>LicenseRef-proprietary AND MIT</project_license>
* <project_license>GPL-2.0+</project_license>
* <project_license>GPL-2.0+ AND MIT AND LicenseRef-proprietary</project_license>

Invalid examples (that will not be parsed correctly):

* <project_license>GPL-2.0+ OR MIT</project_license>
* <project_license>(GPL-2.0+ AND MIT) OR
LicenseRef-proprietary</project_license>

In most cases no action is needed as most vendors are using
“LicenseRef-proprietary” (or its alias, “Proprietary”).

The only user-visible change for LVFS users is the disappearance of
the “Project License” dropdown in the “Component Details” section and
the appearance of a “License” tab in the component navbar. As QA users
do not typically change the license of the uploaded archive, no real
action is required, and this is just an advisory email about the UI
change.

Questions and concerns welcome, either on lvfs-general or by private
email. Thanks!

Richard.