The Linux Foundation Member Summit

The licensing of open source software, as embodied in source code and package metadata, has long suffered from lack of clarity and consistency. This has become more evident with the use of sophisticated license scanning tools. Discussions among open source legal and compliance experts often express the desirability of having such problems addressed upstream.

We will describe the progress on an initiative driven by Red Hat and the Fedora Project community to revitalize its traditional role of curating a distribution with careful attention to licensing. This initiative includes: improved documentation and explanation of license policies, evolution of "allowed" and "not allowed" license lists from a project wiki to a repository of machine-readable data; the use of SPDX identifiers in package license metadata, including close collaboration with the SPDX-legal community; and traceable license review process. We will cover an overview of the process, challenges faced and overcome, and planned next steps.

By sharing the Fedora approach, we hope others can learn or borrow from this work and also contribute to improving license information upstream.