Re: [OE-core] [PATCH v2] create-spdx: Get SPDX-License-Identifier from source

[Jan-Simon Moeller <dl9pf@gmx.de>]

Hi Mikko,

> I guess reports from both will be a superset of used licenses (and possibly
> copyright statements too) since the list of source files which are actually
> compiled is not known to these services.
Yes, the input is the 'bare' patched source archives. Yes, you're right. We do
only know the 'input' side of things aka all licenses of the source tree.

We do *not* know the 'output' side of things, yet. Aka what of these do end-up
in the image.

But IMHO let's raise the bar step by step.

> Currently the source recipes which have multiple licenses including
> problematic ones, are not cleaned up for license compliance scan. E.g.
> GPLv3 licensed source code are not deleted at do_patch() time. Thus reports
> need to be manually adjusted.
Well, thats a different topic and should be discussed alongside meta-gplv2.

Best,
JS